create-principles-disciple 1.121.8 → 1.121.9

package/README.md

@@ -126,7 +126,19 @@ PD supports updating through the Web UI:
 
 ## Requirements
 
-- Node.js >= 18.0.0
+- Node.js >= 22.0.0
+
+Self-contained native release assets are built locally (never cross-labelled) for:
+
+| Platform | Architectures | Node.js major / ABI |
+| --- | --- | --- |
+| Windows | x64 | 22 / 127, 24 / 137, 26 / 147 |
+| Linux | x64, arm64 | 22 / 127, 24 / 137, 26 / 147 |
+| macOS | x64, arm64 | 22 / 127, 24 / 137, 26 / 147 |
+
+Release builds require a fixed `SOURCE_DATE_EPOCH`. The output directory is published through one atomic rename and contains `payload/`, immutable `asset.tar`, and detached `asset.tar.sha256`. The installed machine does not run npm, lifecycle scripts, or native compilation.
+
+PR feedback uses the single-target `.github/workflows/release-reproducibility.yml` quick check. Before npm publication, `publish-npm.yml` must call `.github/workflows/release-reproducibility-full.yml`: for every supported OS/CPU/Node target it builds the real production asset twice from a clean checkout, byte-compares the archives and detached digests, then installs from the archive without npm. Evidence limits: Node versions are pinned exactly, but GitHub runner images float beneath the label — the same-job double build controls toolchain drift within a job; cross-runner absolute byte-equality is not claimed. Committed dependency locks under `release-locks/` are regenerated by maintainers via `npm run generate:release-locks` and verified installable by `npm run check:release-locks`.
 
 ## License
 

package/console/dist/server/config/pd-config-store.d.ts

@@ -111,9 +111,7 @@ export interface DefaultRuntimeUpdateResultErr {
 }
 export type DefaultRuntimeUpdateResult = DefaultRuntimeUpdateResultOk | DefaultRuntimeUpdateResultErr;
 export declare function updateDefaultRuntime(workspaceDir: string, payload: unknown): DefaultRuntimeUpdateResult;
-/** Valid values for principles.outputLanguage in config.yaml */
-export declare const VALID_OUTPUT_LANGUAGES: readonly ['zh-CN', 'en'];
-export type OutputLanguage = typeof VALID_OUTPUT_LANGUAGES[number];
+import type { OutputLanguage } from '@principles/core/runtime-v2';
 export interface OutputLanguageResultOk {
     ok: true;
     outputLanguage: OutputLanguage;

package/console/dist/server/config/pd-config-store.js

@@ -464,13 +464,13 @@ export function updateDefaultRuntime(workspaceDir, payload) {
     };
 }
 // ── Principles Output Language (PRI-332 P1-1) ─────────────────────────────
-/** Valid values for principles.outputLanguage in config.yaml */
-export const VALID_OUTPUT_LANGUAGES = ['zh-CN', 'en'];
+// PRI-611: the output-language contract derives from the canonical core
+// authority (runtime-v2/language-directive.ts). Do NOT re-declare the value
+// list or default here — a drift guard test fails on local re-declaration.
+import { VALID_OUTPUT_LANGUAGES, DEFAULT_OUTPUT_LANGUAGE } from '@principles/core/runtime-v2';
 function isValidOutputLanguage(value) {
     return typeof value === 'string' && VALID_OUTPUT_LANGUAGES.includes(value);
 }
-/** Default output language when not configured. */
-const DEFAULT_OUTPUT_LANGUAGE = 'zh-CN';
 /**
  * Read principles.outputLanguage from config.yaml.
  * Returns default ('zh-CN') when not set.

package/console/dist/server/feedback/channels.d.ts

@@ -1,17 +1,11 @@
+import type { FeedbackChannelStatus } from '../../shared/feedback-contract.js';
 import type * as childProcessNS from 'node:child_process';
 import type * as fsNS from 'node:fs';
 import type * as osNS from 'node:os';
 import type * as pathNS from 'node:path';
 import type { FeedbackChannelConfig } from '../config/pd-config-store.js';
 type ExecFileFn = typeof childProcessNS.execFile;
-export interface ChannelStatus {
-    id: 'ingest' | 'github' | 'email' | 'file';
-    available: boolean;
-    /** Human-readable reason when unavailable. */
-    reason?: string;
-    /** Concrete next action the user can take (rc-9). */
-    nextAction?: string;
-}
+export type ChannelStatus = FeedbackChannelStatus;
 export interface ChannelsResult {
     ok: true;
     channels: ChannelStatus[];

package/console/dist/server/feedback/channels.js

@@ -1,14 +1,3 @@
-// channels.ts
-// Channel-ladder availability probing for feedback submission (PRI-543).
-//
-// Spec §4 / §8.1: the UI orders channels by ladder position and disables
-// unavailable ones, showing reason + nextAction (rc-9). Probing is fail-open:
-// inability to probe is reported as available so a transient probe failure
-// never hides a channel; the submit path then fails loudly and surfaces a
-// structured reason + downgrade hint.
-//
-// Probing results are cached per (channel,url-or-repo) for 60s to avoid
-// hammering the relay /shelling out to gh on every list/via fetch.
 import { probeIngestHealth } from './ingest-adapter.js';
 import { detectGithubCli } from './github-adapter.js';
 const PROBE_CACHE_TTL_MS = 60_000;

package/console/dist/server/index.js

@@ -3,6 +3,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
 import { loadPdConfig, computeFlagsFromLoadResult, getFeedbackMaintainerEmail, getFeedbackChannelConfig, } from './config/pd-config-store.js';
+import { resolveOwnerIdentity, defaultOwnerIdentityHomeDir } from '@principles/core/runtime-v2';
+import { createProductTelemetryService, scheduleProductTelemetryExport } from '@principles/host-runtime';
 import { AuthConfig } from './config/AuthConfig.js';
 import { WorkspaceConfigStore } from './config/WorkspaceConfigStore.js';
 import { WorkspaceService } from './models/WorkspaceService.js';
@@ -15,7 +17,8 @@ import { handleLifecycleRoute, disposeLifecycleModels } from './routes/lifecycle
 import { handleActivationsRoute, disposeActivationsModels } from './routes/activations.js';
 import { handleReceiptsRoute, disposeReceiptsModels } from './routes/receipts.js';
 import { handleApprovalsGroupedRoute, disposeApprovalsGroupedModels } from './routes/approvals-grouped.js';
-import { handleGovernanceRoute, disposeGovernanceModels } from './routes/governance.js';
+import { handleGovernanceRoute, handleGovernanceExperienceRoute, resolveOwnerConfigSnapshot, disposeGovernanceModels } from './routes/governance.js';
+import { handleOwnerIdentityRoute } from './routes/owner-identity.js';
 import { handleEvidenceChainRoute, disposeEvidenceChainModels } from './routes/evidence-chain.js';
 import { handleIntentRoute, disposeIntentModels } from './routes/intent.js';
 import { handleIntentDecisionsRoute, disposeIntentDecisionModels } from './routes/intent-decisions.js';
@@ -214,11 +217,15 @@ async function initServices(workspaceDir, authConfig) {
     // Governance Recovery Actions v1: fail-closed — recovery stays disabled unless
     // explicitly enabled (default off keeps the Console read-only).
     const failedTaskRecoveryEnabled = pdFlags.flags.failed_task_recovery_console?.enabled ?? false;
+    // Governance Experience Snapshot v1.5.1 (PRI-584~587): default off; flag-off
+    // keeps the legacy Focus experience and 403s the endpoint before any DB access.
+    const governanceExperienceEnabled = pdFlags.flags.governance_experience_v1?.enabled ?? false;
     const feedbackFlags = {
         feedback_channel: { enabled: feedbackChannelEnabled },
         failed_tasks_observability: { enabled: failedTasksObservabilityEnabled },
         principle_governance_projection_v2: { enabled: governanceProjectionEnabled },
         failed_task_recovery_console: { enabled: failedTaskRecoveryEnabled },
+        governance_experience_v1: { enabled: governanceExperienceEnabled },
     };
     if (!configResult.ok) {
         console.warn('[pd-console] PD config loading failed (using defaults for feedback channel):', configResult.errors.map(e => e.reason).join('; '));
@@ -380,10 +387,10 @@ function handleRequest(services) {
             // CR8: GET /api/v1/activations
             if (urlPath === '/api/v1/activations' || urlPath.startsWith('/api/v1/activations/')) {
                 const subPath = urlPath.slice('/api/v1/activations'.length);
-                const ownerId = process.env.PD_OWNER_ID?.trim();
-                const credentialId = process.env.PD_OWNER_CREDENTIAL_ID?.trim();
-                const ownerActor = services.authConfig.isEnabled() && ownerId && credentialId
-                    ? { principal: { kind: 'configured_owner', ownerId }, authentication: { method: 'console_token', credentialId } }
+                // ADR-0022 (PRI-578): single resolver — env > ~/.pd/owner.json > none
+                const identity = resolveOwnerIdentity(process.env, defaultOwnerIdentityHomeDir());
+                const ownerActor = services.authConfig.isEnabled() && identity.ownerId && identity.credentialId
+                    ? { principal: { kind: 'configured_owner', ownerId: identity.ownerId }, authentication: { method: 'console_token', credentialId: identity.credentialId } }
                     : null;
                 asyncHandler(() => handleActivationsRoute(req, res, services.workspaceDir, subPath, {
                     ownerActor,
@@ -391,6 +398,21 @@ function handleRequest(services) {
                 }))(req, res);
                 return;
             }
+            // ADR-0022 (PRI-578): /api/v1/owner-identity — GET status, POST register, DELETE unregister
+            if (urlPath === '/api/v1/owner-identity' || urlPath.startsWith('/api/v1/owner-identity/')) {
+                const subPath = urlPath.slice('/api/v1/owner-identity'.length);
+                asyncHandler(() => handleOwnerIdentityRoute(req, res, defaultOwnerIdentityHomeDir(), subPath, services.authConfig))(req, res);
+                return;
+            }
+            // PRI-585: GET /api/v1/governance/experience (flag-gated read-only snapshot)
+            if (urlPath === '/api/v1/governance/experience') {
+                asyncHandler(() => handleGovernanceExperienceRoute(req, res, {
+                    workspaceDir: services.workspaceDir,
+                    featureFlags: services.feedbackFlags,
+                    ownerConfig: resolveOwnerConfigSnapshot(services.authConfig, resolveOwnerIdentity(process.env, defaultOwnerIdentityHomeDir())),
+                }))(req, res);
+                return;
+            }
             // CR8: GET /api/v1/governance/queue
             if (urlPath === '/api/v1/governance/queue') {
                 asyncHandler(() => handleGovernanceRoute(req, res, services.workspaceDir))(req, res);
@@ -461,6 +483,13 @@ export async function main() {
         console.warn('[pd-console] Legacy backup migration failed:', err instanceof Error ? err.message : err);
     }
     const server = http.createServer(handleRequest(services));
+    // Anonymous Product Telemetry v1 (PRI-595~603): one fire-and-forget export
+    // attempt per console startup. The console process is the long-lived PD
+    // surface for Codex-host installations (the pd-hook subprocess is too
+    // short-lived to host async export). All gating (flag + consent +
+    // environment eligibility) happens inside the service; failures are
+    // contained and never affect console behavior.
+    scheduleProductTelemetryExport(createProductTelemetryService({ logger: { info: (m) => console.log(m), warn: (m) => console.warn(m) } }), workspace);
     const shutdown = async (signal) => {
         console.log(`[pd-console] Received ${signal}, shutting down...`);
         await new Promise((resolve) => { server.close(() => resolve()); });

package/console/dist/server/models/ActivationsConsoleModel.d.ts

@@ -106,12 +106,39 @@ export interface OwnerMutationInput {
     reasonCode: string;
     note?: string;
 }
+/**
+ * PRI-577: RuleCode event telemetry candidate directories, in priority order.
+ *
+ * Runtime V2 convention is `.pd/logs`, but the v1 EventLog writer
+ * (openclaw-plugin `src/core/event-log.ts`) still emits `events_*.jsonl` under
+ * `.state/logs`. No production code ever created `.pd/logs`, so scanning only
+ * that path made every activation's shadow metrics report "unavailable" in the
+ * console while real evaluations accumulated unread in `.state/logs`. Readers
+ * scan both candidates until the writer migrates (ERR-031: both readers derive
+ * from this same list).
+ */
+export declare const RULECODE_EVENT_LOG_CANDIDATE_DIRS: readonly string[];
+export interface CollectedRuleCodeEventEntries {
+    entries: unknown[];
+    /** Number of candidate directories that actually exist on disk. */
+    sourceDirsFound: number;
+}
+/**
+ * Collect rulehost telemetry entries from all candidate log directories.
+ * Malformed lines are excluded individually. A directory counts as a source
+ * only after it can be enumerated, so an unreadable path cannot be mistaken
+ * for a healthy channel with zero events (ERR-002).
+ *
+ * Exact lines copied between candidate directories are deduplicated by
+ * priority. Different events in same-named daily files are retained.
+ */
+export declare function collectRuleCodeEventEntries(workspaceDir: string): CollectedRuleCodeEventEntries;
 export declare class ActivationsConsoleModel {
     private readonly workspaceDir;
     private readonly governanceAuditWriter;
     constructor(workspaceDir: string, governanceAuditWriter?: GovernanceAuditWriter);
     getActivations(): Promise<ActivationsResponse>;
-    getOwnerReview(activationId: string, ownerIdentityConfigured?: boolean): Promise<RuleCodeOwnerReview>;
+    getOwnerReview(activationId: string, ownerIdentityConfigured?: boolean, ownerActor?: OwnerPromotionActor): Promise<RuleCodeOwnerReview>;
     continueObserving(activationId: string, input: OwnerMutationInput): Promise<{
         decisionId: string;
     }>;

package/console/dist/server/models/ActivationsConsoleModel.js

@@ -1,4 +1,4 @@
-import { SqliteConnection, SqliteActivationStateStore, SqlitePIArtifactStore, extractPrincipleId, extractEvidenceRefs, PromotionReadinessReader, RuleHostWriter, createProductionGateDeps, SqliteActivationSafetyStore, isFeatureEnabled, RuleCodeOwnerDecisionService, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, } from '@principles/core/runtime-v2';
+import { SqliteConnection, SqliteActivationStateStore, SqlitePIArtifactStore, extractPrincipleId, extractEvidenceRefs, PromotionReadinessReader, RuleHostWriter, createProductionGateDeps, SqliteActivationSafetyStore, isFeatureEnabled, RuleCodeOwnerDecisionService, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, buildPromotionEvidenceSnapshot, } from '@principles/core/runtime-v2';
 import { OPENCLAW_HOST_LIVENESS_CONTRACT } from '@principles/host-runtime';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
 import * as fs from 'node:fs';
@@ -54,27 +54,69 @@ function unavailableShadowSummary() {
         firstObservedAt: null, lastObservedAt: null,
     };
 }
-function readRuleCodeTelemetry(workspaceDir, activationId, decisions) {
-    const logsDir = path.join(workspaceDir, '.pd', 'logs');
-    const countCircuitTrips = (minimumTime) => decisions.filter(decision => decision.decision === 'safety_isolate' && Date.parse(decision.decidedAt) >= minimumTime).length;
-    const now = Date.now();
-    const unavailableWindow = (minimumTime) => ({ eligible: null, matched: null, blocked: null, unhealthy: null, circuitTrips: countCircuitTrips(minimumTime), toolDistribution: null });
-    if (!fs.existsSync(logsDir))
-        return { shadowSummary: unavailableShadowSummary(), metrics: { last24Hours: unavailableWindow(now - 24 * 60 * 60 * 1000), last7Days: unavailableWindow(now - 7 * 24 * 60 * 60 * 1000), representativeSamples: [] } };
+/**
+ * PRI-577: RuleCode event telemetry candidate directories, in priority order.
+ *
+ * Runtime V2 convention is `.pd/logs`, but the v1 EventLog writer
+ * (openclaw-plugin `src/core/event-log.ts`) still emits `events_*.jsonl` under
+ * `.state/logs`. No production code ever created `.pd/logs`, so scanning only
+ * that path made every activation's shadow metrics report "unavailable" in the
+ * console while real evaluations accumulated unread in `.state/logs`. Readers
+ * scan both candidates until the writer migrates (ERR-031: both readers derive
+ * from this same list).
+ */
+export const RULECODE_EVENT_LOG_CANDIDATE_DIRS = ['.pd/logs', '.state/logs'];
+/**
+ * Collect rulehost telemetry entries from all candidate log directories.
+ * Malformed lines are excluded individually. A directory counts as a source
+ * only after it can be enumerated, so an unreadable path cannot be mistaken
+ * for a healthy channel with zero events (ERR-002).
+ *
+ * Exact lines copied between candidate directories are deduplicated by
+ * priority. Different events in same-named daily files are retained.
+ */
+export function collectRuleCodeEventEntries(workspaceDir) {
     const entries = [];
-    try {
-        for (const file of fs.readdirSync(logsDir).filter(name => /^events_.*\.jsonl$/.test(name)).sort().slice(-7)) {
-            for (const line of fs.readFileSync(path.join(logsDir, file), 'utf8').split('\n').filter(Boolean)) {
-                try {
-                    entries.push(JSON.parse(line));
+    let sourceDirsFound = 0;
+    const higherPriorityLines = new Set();
+    for (const candidate of RULECODE_EVENT_LOG_CANDIDATE_DIRS) {
+        const logsDir = path.join(workspaceDir, ...candidate.split('/'));
+        if (!fs.existsSync(logsDir))
+            continue;
+        try {
+            const files = fs.readdirSync(logsDir)
+                .filter(name => /^events_.*\.jsonl$/.test(name))
+                .sort()
+                .slice(-7);
+            sourceDirsFound += 1;
+            const currentSourceLines = [];
+            for (const file of files) {
+                const lines = fs.readFileSync(path.join(logsDir, file), 'utf8').split('\n').filter(Boolean);
+                for (const line of lines) {
+                    currentSourceLines.push(line);
+                    if (higherPriorityLines.has(line))
+                        continue;
+                    try {
+                        entries.push(JSON.parse(line));
+                    }
+                    catch { /* exclude malformed telemetry */ }
                 }
-                catch { /* malformed telemetry is excluded, readiness remains bounded */ }
             }
+            for (const line of currentSourceLines)
+                higherPriorityLines.add(line);
         }
+        catch { /* unreadable directory contributes no entries */ }
     }
-    catch {
+    return { entries, sourceDirsFound };
+}
+function readRuleCodeTelemetry(workspaceDir, activationId, decisions) {
+    const countCircuitTrips = (minimumTime) => decisions.filter(decision => decision.decision === 'safety_isolate' && Date.parse(decision.decidedAt) >= minimumTime).length;
+    const now = Date.now();
+    const unavailableWindow = (minimumTime) => ({ eligible: null, matched: null, blocked: null, unhealthy: null, circuitTrips: countCircuitTrips(minimumTime), toolDistribution: null });
+    const collected = collectRuleCodeEventEntries(workspaceDir);
+    if (collected.sourceDirsFound === 0)
         return { shadowSummary: unavailableShadowSummary(), metrics: { last24Hours: unavailableWindow(now - 24 * 60 * 60 * 1000), last7Days: unavailableWindow(now - 7 * 24 * 60 * 60 * 1000), representativeSamples: [] } };
-    }
+    const { entries } = collected;
     const summarizeWindow = (minimumTime) => {
         let eligible = 0;
         let matched = 0;
@@ -293,7 +335,7 @@ export class ActivationsConsoleModel {
             catch { /* best-effort */ }
         }
     }
-    async getOwnerReview(activationId, ownerIdentityConfigured = false) {
+    async getOwnerReview(activationId, ownerIdentityConfigured = false, ownerActor) {
         const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: true });
         try {
             const activationStore = new SqliteActivationStateStore(conn);
@@ -336,19 +378,19 @@ export class ActivationsConsoleModel {
                         validateProductionArtifact: candidate => writer.canActivate(candidate),
                     });
                 },
-                buildEvidenceSnapshot: (checks, value) => {
-                    const createdAt = new Date().toISOString();
-                    const artifactDigest = value
-                        ? `sha256:${createHash('sha256').update(JSON.stringify(value), 'utf8').digest('hex')}` : digest;
-                    const body = JSON.stringify({ artifactDigest, checks, createdAt });
-                    return {
-                        snapshotId: `snapshot-${randomUUID()}`,
-                        snapshotDigest: `sha256:${createHash('sha256').update(body, 'utf8').digest('hex')}`,
-                        artifactDigest, lineageRefs: value ? [value.sourceTaskId, ...value.lineageArtifactIds] : [],
-                        hostRuntimeVersion: 'openclaw-legacy@1', safetyGateResults: checks,
+                buildEvidenceSnapshot: (checks, value, evaluationId) => {
+                    return buildPromotionEvidenceSnapshot({
+                        activationId,
+                        evaluationId,
+                        checks,
+                        artifact: value,
+                        expectedArtifactDigest: digest,
+                        // Bind the real authenticated actor; null (not a placeholder) when
+                        // the review is read without an Owner session.
+                        ownerIdentity: ownerActor ?? null,
+                        hostRuntimeVersion: 'openclaw-legacy@1',
                         shadowSummary: telemetry.shadowSummary,
-                        configurationVersion: 'pd-config-current', redaction: { version: 'v1', rawParametersStored: false }, createdAt,
-                    };
+                    });
                 },
                 newEvaluationId: () => `readiness-${randomUUID()}`,
             });
@@ -476,7 +518,7 @@ export class ActivationsConsoleModel {
         }
     }
     async promoteRuleCode(activationId, expected, input) {
-        const review = await this.getOwnerReview(activationId, input.actor.principal.kind === 'configured_owner' && input.actor.authentication.method === 'console_token');
+        const review = await this.getOwnerReview(activationId, input.actor.principal.kind === 'configured_owner' && input.actor.authentication.method === 'console_token', input.actor);
         const flags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
         const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
         try {

package/console/dist/server/models/GovernanceExperienceCollector.d.ts

@@ -0,0 +1,28 @@
+import type { GovernanceExperienceInputs, GovernanceExperienceSnapshot, OwnerConfigSnapshot } from '@principles/core/runtime-v2';
+import { type GovernanceProjectionTables } from './GovernanceProjectionCollector.js';
+/**
+ * Stable, path-safe workspace hash for snapshotId (SPEC §13): never exposes the
+ * raw path and is never persisted. Windows normalization: backslashes become
+ * forward slashes and the drive letter is case-folded, so `D:\a\b`, `d:/a/b/`
+ * and `D:/a/b` hash identically. POSIX path case is intentionally preserved.
+ */
+export declare function hashWorkspacePath(workspaceDir: string): string;
+export interface GovernanceExperienceCollectOptions {
+    ownerConfig: OwnerConfigSnapshot;
+    /** ISO-8601 UTC timestamp; defaults to now. Injected by tests for determinism. */
+    asOf?: string;
+    /** Test seam for the query-budget contract; production always reads via GovernanceProjectionCollector.readTables. */
+    tableReader?: (workspaceDir: string) => GovernanceProjectionTables;
+}
+export declare class GovernanceExperienceCollector {
+    private readonly workspaceDir;
+    constructor(workspaceDir: string);
+    collectSnapshot(options: GovernanceExperienceCollectOptions): GovernanceExperienceSnapshot;
+    buildInputs(options: GovernanceExperienceCollectOptions): GovernanceExperienceInputs;
+    /**
+     * Reads the principle ledger once and validates every entry. A readable file
+     * with a malformed tree counts as an unavailable ledger source (no views can
+     * be built); individual invalid entries degrade to data-quality groups.
+     */
+    private scanLedger;
+}