create-principles-disciple 1.121.9 → 1.122.0

package/console/dist/server/routes/owner-decisions.js

@@ -0,0 +1,186 @@
+import { createRuntimeStateHandle, applyOwnerResolution, } from '@principles/core/runtime-v2';
+import { OwnerDecisionConsoleModel } from '../models/OwnerDecisionConsoleModel.js';
+import { sendSuccess, sendError, sendMethodNotAllowed, sendBadRequest } from '../utils/response.js';
+import { readBody } from '../utils/request.js';
+const models = new Map();
+function getModel(workspaceDir) {
+    let model = models.get(workspaceDir);
+    if (!model) {
+        model = new OwnerDecisionConsoleModel(workspaceDir);
+        models.set(workspaceDir, model);
+    }
+    return model;
+}
+const RESOLVE_ACTIONS = new Set(['accept_current', 'revise_once', 'reject_current']);
+/** rc-1/rc-2/rc-3: body 按未知值逐字段校验，非法即 400 fail-loud。 */
+function parseResolveBody(raw) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        return { ok: false, error: 'Request body must be a JSON object.' };
+    }
+    const b = raw;
+    if (typeof b.action !== 'string' || !RESOLVE_ACTIONS.has(b.action)) {
+        return { ok: false, error: `action must be one of accept_current/revise_once/reject_current, got ${String(b.action)}` };
+    }
+    for (const field of ['reviewKey', 'expectedSourceRunId', 'expectedSourceArtifactId', 'expectedSourceArtifactHash']) {
+        const v = b[field];
+        if (typeof v !== 'string' || v.trim() === '') {
+            return { ok: false, error: `${field} must be a non-empty string.` };
+        }
+    }
+    if (typeof b.expectedRevisionEpoch !== 'number' || !Number.isInteger(b.expectedRevisionEpoch) || b.expectedRevisionEpoch < 0) {
+        return { ok: false, error: 'expectedRevisionEpoch must be a non-negative integer.' };
+    }
+    if (b.ownerInstruction !== undefined && b.ownerInstruction !== null
+        && (typeof b.ownerInstruction !== 'string' || b.ownerInstruction.length > 600)) {
+        return { ok: false, error: 'ownerInstruction must be a string of at most 600 characters (or null).' };
+    }
+    const { reviewKey } = b;
+    const { expectedSourceRunId } = b;
+    const { expectedSourceArtifactId } = b;
+    const { expectedSourceArtifactHash } = b;
+    if (typeof reviewKey !== 'string' || typeof expectedSourceRunId !== 'string'
+        || typeof expectedSourceArtifactId !== 'string' || typeof expectedSourceArtifactHash !== 'string') {
+        return { ok: false, error: 'unreachable: string fields validated above' };
+    }
+    return {
+        ok: true,
+        body: {
+            action: b.action,
+            reviewKey,
+            expectedRevisionEpoch: b.expectedRevisionEpoch,
+            expectedSourceRunId,
+            expectedSourceArtifactId,
+            expectedSourceArtifactHash,
+            ...(typeof b.ownerInstruction === 'string' ? { ownerInstruction: b.ownerInstruction } : {}),
+        },
+    };
+}
+/** OwnerResolutionOutcome → HTTP 响应映射（cli-6: 结构化 reason + nextAction）。 */
+function sendOutcome(res, outcome) {
+    switch (outcome.status) {
+        case 'resolved':
+            sendSuccess(res, {
+                status: 'resolved',
+                resolutionId: outcome.resolutionId,
+                reviewKey: outcome.reviewKey,
+                action: outcome.action,
+                applied: outcome.applied,
+                ...(outcome.effectiveDecision !== undefined ? { effectiveDecision: outcome.effectiveDecision } : {}),
+                ...(outcome.targetTaskId !== undefined ? { targetTaskId: outcome.targetTaskId } : {}),
+                runnerWillApply: outcome.runnerWillApply,
+                nextAction: outcome.applied
+                    ? 'Resolution applied. Refresh the governance focus.'
+                    : 'Resolution recorded durably; the pipeline runner will apply it without re-invoking the LLM. Refresh the governance focus.',
+            });
+            return;
+        case 'not_found':
+            sendError(res, 404, 'task_not_found', 'Owner decision task not found.');
+            return;
+        case 'metadata_invalid':
+            sendError(res, 409, 'metadata_invalid', 'Task metadata failed PI hydration; refusing to resolve.', {
+                nextAction: 'Inspect the task metadata: pd runtime internalization integrity --json',
+            });
+            return;
+        case 'not_decision_capable':
+            sendError(res, 409, 'not_decision_capable', 'This task is not currently decision-capable.', {
+                nextAction: 'Refresh the governance focus — the decision facts may have changed.',
+                blockers: outcome.blockers,
+            });
+            return;
+        case 'stale_owner_decision':
+            sendError(res, 409, 'stale_owner_decision', 'The durable decision facts changed since this item was rendered. The decision was NOT applied.', {
+                nextAction: 'Refresh the governance focus and decide again on the current version.',
+            });
+            return;
+        case 'already_resolved':
+            sendError(res, 409, 'already_resolved', `This decision was already resolved with action '${outcome.existingAction}'.`, {
+                nextAction: 'Refresh the governance focus.',
+                existingAction: outcome.existingAction,
+            });
+            return;
+        case 'revise_target_unresolved':
+            sendError(res, 409, 'revise_target_unresolved', 'The revision target task could not be resolved from the lineage.', {
+                nextAction: 'Inspect the task lineage; this is a recovery-class failure.',
+            });
+            return;
+        case 'revise_reopen_failed':
+            sendError(res, 409, 'revise_reopen_failed', `Reopening the revision target failed: ${outcome.reason}`, {
+                nextAction: 'Retry after the target task is no longer in flight, or inspect the task states.',
+                reason: outcome.reason,
+            });
+            return;
+        case 'cas_conflict':
+            sendError(res, 409, 'cas_conflict', 'Concurrent write detected while recording the resolution.', {
+                nextAction: 'Retry the request — the operation is idempotent.',
+            });
+            return;
+        default: {
+            // exhaustive guard
+            const exhaustive = outcome;
+            sendError(res, 500, 'owner_resolution_error', `Unhandled outcome: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+export async function handleOwnerDecisionsRoute(req, res, ctx) {
+    const { workspaceDir, subPath, ownerIdentity } = ctx;
+    const method = req.method ?? 'GET';
+    // GET /api/v1/governance/owner-decisions — list
+    if (subPath === '' || subPath === '/') {
+        if (method !== 'GET') {
+            sendMethodNotAllowed(res);
+            return;
+        }
+        try {
+            const result = await getModel(workspaceDir).listOwnerDecisionItems();
+            sendSuccess(res, result);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            sendError(res, 500, 'owner_decisions_list_error', message, {
+                nextAction: 'Inspect the workspace state (.pd/state.db) and retry.',
+            });
+        }
+        return;
+    }
+    // POST /api/v1/governance/owner-decisions/:taskId/resolve
+    const resolveMatch = /^\/([^/]+)\/resolve$/.exec(subPath);
+    if (resolveMatch) {
+        if (method !== 'POST') {
+            sendMethodNotAllowed(res);
+            return;
+        }
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- match group is always present
+        const taskId = decodeURIComponent(resolveMatch[1]);
+        let body;
+        try {
+            const raw = await readBody(req);
+            body = raw.trim() === '' ? {} : JSON.parse(raw);
+        }
+        catch {
+            sendBadRequest(res, 'Request body must be valid JSON.');
+            return;
+        }
+        const parsed = parseResolveBody(body);
+        if (!parsed.ok) {
+            sendBadRequest(res, parsed.error);
+            return;
+        }
+        // 应用走 core 单一服务（writable RuntimeStateManager handle）
+        const handle = await createRuntimeStateHandle({ workspaceDir });
+        try {
+            const outcome = await applyOwnerResolution({ stateManager: handle.stateManager }, { taskId, request: parsed.body, identity: ownerIdentity });
+            sendOutcome(res, outcome);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            sendError(res, 500, 'owner_resolution_error', message, {
+                nextAction: 'Inspect the workspace state (.pd/state.db) and retry.',
+            });
+        }
+        finally {
+            await handle.close();
+        }
+        return;
+    }
+    sendError(res, 404, 'not_found', `Route /api/v1/governance/owner-decisions${subPath} not found`);
+}

package/console/dist/server/routes/principles.js

@@ -42,7 +42,7 @@ async function getDecidedPrincipleIds(workspaceDir) {
     // Runtime V2 uses <workspace>/.pd/state.db (NOT .state/state.db)
     const dbPath = path.join(workspaceDir, '.pd', 'state.db');
     if (!fs.existsSync(dbPath)) {
-        return { ids: new Set(), unavailableReason: 'approval_db_not_found' };
+        return { ids: new Set(), pendingIds: new Set(), unavailableReason: 'approval_db_not_found' };
     }
     let closeFn = null;
     try {
@@ -51,25 +51,33 @@ async function getDecidedPrincipleIds(workspaceDir) {
         closeFn = () => conn.close();
         const db = conn.getDb();
         // Join approvals with pi_artifacts to find decided principle IDs
-        const rows = db.prepare("SELECT DISTINCT a.source_principle_id " +
+        // PRI-629: also resolve PENDING approvals — a pending approval is a real
+        // Owner decision (owner_actionable), unlike candidate lifecycle (in_pipeline).
+        const rows = db.prepare("SELECT DISTINCT a.source_principle_id, ap.status " +
             "FROM approvals ap " +
             "JOIN pi_artifacts a ON a.artifact_id = ap.artifact_id " +
-            "WHERE ap.status IN ('approved', 'rejected') " +
+            "WHERE ap.status IN ('approved', 'rejected', 'pending') " +
             "AND a.source_principle_id IS NOT NULL").all();
         // EP-01 Rule 1: treat DB rows as unknown; validate before use
         // EP-01 Rule 2: no `as` cast — use getOwnStringField instead
         const ids = new Set();
+        const pendingIds = new Set();
         for (const row of rows) {
             const val = getOwnStringField(row, 'source_principle_id');
-            if (val !== undefined) {
+            if (val === undefined)
+                continue;
+            if (getOwnStringField(row, 'status') === 'pending') {
+                pendingIds.add(val);
+            }
+            else {
                 ids.add(val);
             }
         }
-        return { ids };
+        return { ids, pendingIds };
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        return { ids: new Set(), unavailableReason: `approval_query_failed: ${message}` };
+        return { ids: new Set(), pendingIds: new Set(), unavailableReason: `approval_query_failed: ${message}` };
     }
     finally {
         closeFn?.();
@@ -197,7 +205,7 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, f
             const VALID_FILTERS = new Set(['all', 'actionable']);
             const filter = (filterRaw !== null && VALID_FILTERS.has(filterRaw) ? filterRaw : 'actionable');
             const decidedResult = await getDecidedPrincipleIds(workspaceDir);
-            const result = await model.listPrinciples(filter, decidedResult.ids);
+            const result = await model.listPrinciples(filter, decidedResult.ids, decidedResult.pendingIds);
             // Surface approval cross-check unavailability to the UI (ERR-002)
             if (decidedResult.unavailableReason) {
                 result.approvalCrossCheckUnavailable = decidedResult.unavailableReason;

package/console/dist/server/routes/update.js

@@ -9,6 +9,7 @@ import { checkOpenClawGateway, stopOpenClawGateway, restartOpenClawGateway, } fr
 import { migrateLegacyExtensionBackups, reservePdBackupDestination, resolvePdBackupsRoot, } from '../utils/pd-backups.js';
 import { ActivationCompatibilityReadModel } from '@principles/core/runtime-v2';
 import { getInstallLayoutPaths, resolveInstallLayout } from '@principles/install-layout';
+import { collectFileDepLinkSpecs } from '../utils/update-links.js';
 /**
  * Legacy rule contract preflight (2026-08-19): refuse to swap the runtime
  * while an ACTIVE owner-approved rule still depends on a RuleHost contract
@@ -724,22 +725,35 @@ function depsMeaningfullyChanged(oldDeps, newDeps) {
     return aKeys.some((k, i) => bKeys[i] !== k || a[k] !== b[k]);
 }
 /**
- * Create the node_modules/@principles/host-runtime resolution links for the
- * installed console and pd-cli packages, if missing.
+ * Create the node_modules resolution links for the installed components, if
+ * missing.
  *
  * Mirrors installer.ts syncPdCli: junction on Windows (no elevation needed),
  * relative symlink elsewhere. Fresh installs get these links via npm install
- * (the bundled package.json rewrites the dep to file:../host-runtime); the
- * full update deliberately skips npm install, so it must create them itself.
- * Without the link, the updated console dist — which statically imports
- * @principles/host-runtime since 2026-08-21 (41cf97ee5) — crashes at startup
- * with ERR_MODULE_NOT_FOUND on installs created before the installer bundled
- * host-runtime (PRI-561).
+ * (the bundled package.json rewrites internal deps to file:../<component>);
+ * the full update deliberately skips npm install, so it must create them
+ * itself. Without a link, updated dists crash at startup with
+ * ERR_MODULE_NOT_FOUND (host-runtime: PRI-561, 2026-08-21).
+ *
+ * Two sources, both fail-closed on creation errors:
+ *   1. the explicit link list below (known-critical links: a missing one
+ *      means the updated console cannot start);
+ *   2. a data-driven pass that derives links from the STAGED manifests —
+ *      the freshly extracted release trees under tempDir. Their `file:`
+ *      declarations are the authoritative list of links the updated tree
+ *      needs. Reading the deployed (pre-update) manifests instead would
+ *      miss every dependency this release newly introduced: the running
+ *      console executes update logic from its own dist (one generation
+ *      behind the components it installs) — observed 2026-08-29 when the
+ *      1.221.2 console updated hosts to 1.222.5 but could not know about
+ *      the newly introduced install-layout component, leaving
+ *      host-runtime/node_modules/@principles/install-layout missing and
+ *      every pd-cli runtime command failing with ERR_MODULE_NOT_FOUND.
  *
  * Returns undefined on success, or an error message (rc-9: observable, never
  * silent — a missing link means the updated console cannot start).
  */
-function ensureRuntimeResolutionLinks(layout) {
+function ensureRuntimeResolutionLinks(layout, tempDir) {
     const links = [
         { linkPath: path.join(layout.consoleDir, 'node_modules', '@principles', 'host-runtime'), target: layout.hostRuntimeDir },
         { linkPath: path.join(layout.pdCliDir, 'node_modules', '@principles', 'host-runtime'), target: layout.hostRuntimeDir },
@@ -750,11 +764,43 @@ function ensureRuntimeResolutionLinks(layout) {
         { linkPath: path.join(layout.hostRuntimeDir, 'node_modules', '@principles', 'install-layout'), target: layout.installLayoutDir },
         { linkPath: path.join(layout.consoleDir, 'node_modules', 'principles-disciple'), target: layout.pluginDir },
     ];
-    for (const { linkPath, target } of links) {
-        if (!fs.existsSync(target))
-            continue;
+    // Data-driven pass: derive links from the STAGED component manifests (see
+    // the comment above — staged, never the deployed pre-update manifests).
+    const stagedComponents = [
+        { manifestDir: path.join(tempDir, 'console'), deployedDir: layout.consoleDir },
+        { manifestDir: path.join(tempDir, 'pd-cli'), deployedDir: layout.pdCliDir },
+        { manifestDir: path.join(tempDir, 'host-runtime'), deployedDir: layout.hostRuntimeDir },
+        { manifestDir: path.join(tempDir, 'install-layout'), deployedDir: layout.installLayoutDir },
+        { manifestDir: path.join(tempDir, 'core'), deployedDir: layout.coreDir },
+        { manifestDir: path.join(tempDir, 'plugin'), deployedDir: layout.pluginDir },
+    ];
+    const readStagedDependencies = (manifestDir) => {
+        try {
+            const pkgPath = path.join(manifestDir, 'package.json');
+            if (!fs.existsSync(pkgPath))
+                return {};
+            const parsed = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            if (!isRecord(parsed) || !isRecord(parsed.dependencies))
+                return {};
+            const out = {};
+            for (const [name, ref] of Object.entries(parsed.dependencies)) {
+                if (typeof ref === 'string')
+                    out[name] = ref;
+            }
+            return out;
+        }
+        catch {
+            // rc-9: an unreadable staged manifest degrades to "no derived links" —
+            // the explicit list above still covers the known-critical links.
+            return {};
+        }
+    };
+    const fileDepSpecs = collectFileDepLinkSpecs(stagedComponents, readStagedDependencies);
+    const createResolutionLink = (linkPath, target) => {
+        // Idempotent: never overwrite an existing link or directory (fresh
+        // installs have npm-created real dirs in these slots).
         if (fs.existsSync(linkPath))
-            continue;
+            return undefined;
         try {
             fs.mkdirSync(path.dirname(linkPath), { recursive: true });
             if (process.platform === 'win32') {
@@ -763,10 +809,32 @@ function ensureRuntimeResolutionLinks(layout) {
             else {
                 fs.symlinkSync(path.relative(path.dirname(linkPath), target), linkPath, 'dir');
             }
+            return undefined;
         }
         catch (error) {
             return `Failed to create runtime resolution link at ${linkPath}: ${error instanceof Error ? error.message : String(error)}`;
         }
+    };
+    // Pass 1 — explicit known-critical links, fail-closed BEFORE any byte is
+    // swapped (a link-creation failure aborts with the installed packages
+    // untouched: the PRI-561 ordering contract).
+    for (const { linkPath, target } of links) {
+        if (!fs.existsSync(target))
+            continue;
+        const error = createResolutionLink(linkPath, target);
+        if (error)
+            return error;
+    }
+    // Pass 2 — data-driven derived links. Their deployed target dir may be
+    // created by the copy steps that follow (a brand-new component's dir does
+    // not exist yet); each staged target's existence was already proven by the
+    // extraction, and the copies below run unconditionally.
+    for (const spec of fileDepSpecs) {
+        if (fs.existsSync(spec.linkPath))
+            continue;
+        const error = createResolutionLink(spec.linkPath, spec.target);
+        if (error)
+            return error;
     }
     return undefined;
 }
@@ -935,7 +1003,7 @@ async function doInlineFullUpdate(workspaceDir) {
             if (fs.existsSync(path.join(installLayoutSrc, 'package.json')) && fs.existsSync(path.join(installLayoutSrc, 'dist'))) {
                 copyDirRecursive(installLayoutSrc, layout.installLayoutDir, SKIP_DIRS);
             }
-            const linkError = ensureRuntimeResolutionLinks(layout);
+            const linkError = ensureRuntimeResolutionLinks(layout, tempDir);
             if (linkError) {
                 appendUpdateHistory(workspaceDir, {
                     fromVersion,

package/console/dist/server/utils/update-links.d.ts

@@ -0,0 +1,38 @@
+export type FileDepLinkSpec = {
+    linkPath: string;
+    /** Deployed layout dir the link points at; may be created by the copy
+     *  steps that run after derivation (see stagedTargetExists). */
+    target: string;
+    /** The staged sibling dir proving this component ships in this release. */
+    stagedTarget: string;
+};
+export type StagedComponent = {
+    /** Freshly extracted component dir under the update temp dir. */
+    manifestDir: string;
+    /** Deployed layout dir this component is (or will be) installed into. */
+    deployedDir: string;
+};
+/**
+ * Derive the node_modules link specs implied by each staged component's
+ * declared `file:` dependencies.
+ *
+ * - `readDependencies(manifestDir)` returns the component's dependency map
+ *   (name -> version-or-ref); return {} for unreadable/missing manifests.
+ * - A `file:` ref is resolved against its staged manifest dir to find the
+ *   staged sibling target; the deployed link target is taken from the same
+ *   staged->deployed pairing the caller provides — component identity is
+ *   the staged directory itself (normalized absolute path), NOT the
+ *   deployed directory's basename. In the legacy layout the deployed
+ *   plugin dir is named `principles-disciple` while the staged one is
+ *   `plugin`, so a basename lookup would silently drop the derived link
+ *   (review P1, PR #1457).
+ * - Deps whose staged target is not one of the layout components (e.g.
+ *   @principles/codex-adapter — a separate host install, not part of this
+ *   layout) are skipped.
+ *
+ * Note: `target` (the deployed dir) may not exist yet at derivation time —
+ * for components whose copy step runs after this call, the caller creates
+ * the directory right after deriving and creating these links. Use
+ * `stagedTarget` to verify the component actually ships in this release.
+ */
+export declare function collectFileDepLinkSpecs(stagedComponents: readonly StagedComponent[], readDependencies: (manifestDir: string) => Record<string, string>): FileDepLinkSpec[];

package/console/dist/server/utils/update-links.js

@@ -0,0 +1,71 @@
+/**
+ * Data-driven resolution-link derivation for the full-update pipeline.
+ *
+ * The deployed console performs full updates with the update logic baked
+ * into its own dist — one generation behind the components it installs. A
+ * hardcoded link list therefore goes stale the moment a release introduces
+ * a new internal `file:` dependency (observed 2026-08-29: the 1.221.2
+ * console could not know about the newly introduced install-layout
+ * component, so the 1.222.5 update left
+ * host-runtime/node_modules/@principles/install-layout missing and every
+ * pd-cli runtime command failed with ERR_MODULE_NOT_FOUND).
+ *
+ * The authoritative source for "which links does the UPDATED tree need" is
+ * the STAGED manifests under the update's temp dir (the freshly extracted
+ * release trees) — NOT the deployed pre-update manifests, which by
+ * definition do not declare newly added dependencies.
+ *
+ * Each staged component's `file:` refs resolve to a sibling staged
+ * component directory; the deployed link target is that sibling's entry in
+ * the same staged->deployed pairing.
+ */
+import * as path from 'node:path';
+/**
+ * Derive the node_modules link specs implied by each staged component's
+ * declared `file:` dependencies.
+ *
+ * - `readDependencies(manifestDir)` returns the component's dependency map
+ *   (name -> version-or-ref); return {} for unreadable/missing manifests.
+ * - A `file:` ref is resolved against its staged manifest dir to find the
+ *   staged sibling target; the deployed link target is taken from the same
+ *   staged->deployed pairing the caller provides — component identity is
+ *   the staged directory itself (normalized absolute path), NOT the
+ *   deployed directory's basename. In the legacy layout the deployed
+ *   plugin dir is named `principles-disciple` while the staged one is
+ *   `plugin`, so a basename lookup would silently drop the derived link
+ *   (review P1, PR #1457).
+ * - Deps whose staged target is not one of the layout components (e.g.
+ *   @principles/codex-adapter — a separate host install, not part of this
+ *   layout) are skipped.
+ *
+ * Note: `target` (the deployed dir) may not exist yet at derivation time —
+ * for components whose copy step runs after this call, the caller creates
+ * the directory right after deriving and creating these links. Use
+ * `stagedTarget` to verify the component actually ships in this release.
+ */
+export function collectFileDepLinkSpecs(stagedComponents, readDependencies) {
+    const deployedDirByStagedDir = new Map();
+    for (const component of stagedComponents) {
+        deployedDirByStagedDir.set(path.resolve(component.manifestDir), component.deployedDir);
+    }
+    const specs = [];
+    const seen = new Set();
+    for (const component of stagedComponents) {
+        for (const [name, ref] of Object.entries(readDependencies(component.manifestDir))) {
+            if (typeof ref !== 'string' || !ref.startsWith('file:'))
+                continue;
+            const stagedTarget = path.resolve(component.manifestDir, ref.slice('file:'.length));
+            const deployedTarget = deployedDirByStagedDir.get(stagedTarget);
+            if (deployedTarget === undefined)
+                continue;
+            // The link lives in the DEPLOYED component dir (what the updated dist
+            // resolves against) — never inside the throwaway temp dir.
+            const linkPath = path.join(component.deployedDir, 'node_modules', name);
+            if (seen.has(linkPath))
+                continue;
+            seen.add(linkPath);
+            specs.push({ linkPath, target: deployedTarget, stagedTarget });
+        }
+    }
+    return specs;
+}

package/console/dist/ui/api.d.ts

@@ -1,4 +1,5 @@
 import type { ApiResponse } from "../types.js";
+import type { OwnerDecisionsData, OwnerResolutionResultData } from "./utils/validators.js";
 import { listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm } from "./utils/signal-keywords-api.js";
 import type { GovernanceExperienceSnapshot, OwnerGovernanceView } from '@principles/core/runtime-v2';
 import type { OwnerIdentityViewData, OwnerIdentityRegisterData, OwnerIdentityUnregisterData } from "./utils/validators.js";
@@ -148,6 +149,16 @@ declare function updateOutputLanguage(outputLanguage: string): Promise<ApiRespon
 declare function fetchGovernanceQueue(): Promise<ApiResponse<GovernanceQueueData>>;
 declare function fetchGovernanceExperience(): Promise<ApiResponse<GovernanceExperienceSnapshot>>;
 declare function recoverFailedTask(taskId: string, reason?: string, force?: boolean): Promise<ApiResponse<RecoveryResultData>>;
+declare function fetchOwnerDecisions(): Promise<ApiResponse<OwnerDecisionsData>>;
+declare function resolveOwnerDecision(taskId: string, body: {
+    action: 'accept_current' | 'revise_once' | 'reject_current';
+    reviewKey: string;
+    expectedRevisionEpoch: number;
+    expectedSourceRunId: string;
+    expectedSourceArtifactId: string;
+    expectedSourceArtifactHash: string;
+    ownerInstruction?: string | null;
+}): Promise<ApiResponse<OwnerResolutionResultData>>;
 declare function fetchApprovalsGrouped(): Promise<ApiResponse<ApprovalsGroupedData>>;
 declare function fetchAllActivations(): Promise<ApiResponse<ActivationsData>>;
 declare function disableActivation(activationId: string): Promise<ApiResponse<DisableActivationData>>;
@@ -214,7 +225,7 @@ export interface FollowUpPayload {
     candidateId?: string;
 }
 declare function dispatchFollowUp(decisionId: string, payload: FollowUpPayload): Promise<ApiResponse<FollowUpResponseData>>;
-export { request, listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm, getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchGovernanceExperience, recoverFailedTask, fetchApprovalsGrouped, fetchAllActivations, disableActivation, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyUpdate, applyFullUpdate, rollbackUpdate, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };
+export { request, listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm, getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchGovernanceExperience, recoverFailedTask, fetchOwnerDecisions, resolveOwnerDecision, fetchApprovalsGrouped, fetchAllActivations, disableActivation, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyUpdate, applyFullUpdate, rollbackUpdate, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };
 export type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, RecoveryResultData, ActivationsData, DisableActivationData, RuleCodeOwnerReviewData, RuleCodeMutationData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, RollbackResultData, ApprovalRecordData, PrinciplesListData, ApprovalsGroupedData, EvidenceChainData, EvidenceChainRecordData, EvidenceChainStateData, TrajectoryData, TrajectoryStageData, IntentSummaryData, IntentSectionsData, IntentDocWarningData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, LinkCandidateFollowUpData, GuideRulehostFollowUpData, GeneratePatchProposalFollowUpData, IntentVersionEntry, IntentVersionData, } from "./utils/validators.js";
 export type { SignalKeyword, PendingSignalTerm } from "./utils/signal-keywords-types.js";
 export type { ActivationRecordData as ActivationRecord } from "./utils/validators.js";

package/console/dist/ui/api.js

@@ -1,5 +1,5 @@
 import { listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm, } from "./utils/signal-keywords-api.js";
-import { validateErrorResponse, validateHeaders, validateFeedbackReport, validateFeedbackDraftsList, validateFeedbackDraftEnvelope, validateFeedbackChannels, validateFeedbackSubmitResult, validateDeleteEnvelope, validateWorkspaceEntry, validateWorkspaceList, validateRemovedEnvelope, validateSyncResult, validateConfigSummary, validateConfigCatalog, validateAgentBindingUpdate, validateDefaultRuntimeUpdate, validateRuntimeProfileMutation, validateReadinessCheck, validateFeatureFlagUpdate, validateOutputLanguage, validateGovernanceQueue, validateRecoveryResult, validateActivations, validateDisableActivation, validateLifecycleMetrics, validateUpdateStatus, validateUpdateHistory, validateApplyUpdateResult, validateRollbackResult, validateApprovalRecordDirect, validatePrinciplesList, validateApprovalsGrouped, validateEvidenceChain, validateTrajectoryData, validateIntentSummary, validateIntentDecisionList, validateIntentDecisionResult, validateIntentDecisionSummary, validateFollowUpResponse, validateIntentInitResult, validateIntentSaveResult, validateIntentRawContent, validateIntentVersions, validateOwnerGovernanceView, validateGovernanceExperienceSnapshot, validateRuleCodeOwnerReview, validateRuleCodeMutation, validateOwnerIdentityView, validateOwnerIdentityRegister, validateOwnerIdentityUnregister, } from "./utils/validators.js";
+import { validateErrorResponse, validateHeaders, validateFeedbackReport, validateFeedbackDraftsList, validateFeedbackDraftEnvelope, validateFeedbackChannels, validateFeedbackSubmitResult, validateDeleteEnvelope, validateWorkspaceEntry, validateWorkspaceList, validateRemovedEnvelope, validateSyncResult, validateConfigSummary, validateConfigCatalog, validateAgentBindingUpdate, validateDefaultRuntimeUpdate, validateRuntimeProfileMutation, validateReadinessCheck, validateFeatureFlagUpdate, validateOutputLanguage, validateGovernanceQueue, validateRecoveryResult, validateOwnerDecisionsData, validateOwnerResolutionResult, validateActivations, validateDisableActivation, validateLifecycleMetrics, validateUpdateStatus, validateUpdateHistory, validateApplyUpdateResult, validateRollbackResult, validateApprovalRecordDirect, validatePrinciplesList, validateApprovalsGrouped, validateEvidenceChain, validateTrajectoryData, validateIntentSummary, validateIntentDecisionList, validateIntentDecisionResult, validateIntentDecisionSummary, validateFollowUpResponse, validateIntentInitResult, validateIntentSaveResult, validateIntentRawContent, validateIntentVersions, validateOwnerGovernanceView, validateGovernanceExperienceSnapshot, validateRuleCodeOwnerReview, validateRuleCodeMutation, validateOwnerIdentityView, validateOwnerIdentityRegister, validateOwnerIdentityUnregister, } from "./utils/validators.js";
 // ── Auth ──────────────────────────────────────────────────────────────────────
 function getToken() {
     return sessionStorage.getItem("pd_token");
@@ -454,6 +454,13 @@ async function recoverFailedTask(taskId, reason, force) {
         body: JSON.stringify(body),
     }, validateRecoveryResult);
 }
+// PRI-629: unified Owner Decision inbox — read projection + resolution.
+async function fetchOwnerDecisions() {
+    return request('/api/v1/governance/owner-decisions', undefined, validateOwnerDecisionsData);
+}
+async function resolveOwnerDecision(taskId, body) {
+    return request('/api/v1/governance/owner-decisions/' + encodeURIComponent(taskId) + '/resolve', { method: 'POST', body: JSON.stringify(body) }, validateOwnerResolutionResult);
+}
 async function fetchApprovalsGrouped() {
     return request('/api/v1/approvals/grouped', undefined, validateApprovalsGrouped);
 }
@@ -570,4 +577,4 @@ listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendin
 // auth
 getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, 
 // Feedback submit ladder (Slice 3, spec §8)
-fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchGovernanceExperience, recoverFailedTask, fetchApprovalsGrouped, fetchAllActivations, disableActivation, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyUpdate, applyFullUpdate, rollbackUpdate, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };
+fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchGovernanceExperience, recoverFailedTask, fetchOwnerDecisions, resolveOwnerDecision, fetchApprovalsGrouped, fetchAllActivations, disableActivation, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyUpdate, applyFullUpdate, rollbackUpdate, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };

package/console/dist/ui/components/notifications/NotificationProvider.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useCallback, useEffect, useRef, useState, } from 'react';
-import { fetchGovernanceQueue } from '../../api.js';
+import { fetchGovernanceQueue, fetchOwnerDecisions } from '../../api.js';
 import { useNotificationSound } from '../../hooks/useNotificationSound.js';
 import { diffNotificationCounts } from './notification-reducer.js';
 import { loadSoundEnabled, saveSoundEnabled } from './sound-storage.js';
@@ -33,8 +33,14 @@ export function NotificationProvider({ children }) {
                 console.warn('Notification poll failed:', result.error);
                 return;
             }
-            const pendingCount = result.data.pendingReviewCount;
             const degradedCount = result.data.degradedSignals?.length ?? 0;
+            // PRI-629 (SPEC §27): 侧边栏徽标 N = 真实可执行 Owner 决策数
+            // (OwnerDecisionItem.length) — 不是 approvals pending / candidate /
+            // needs_human_review 计数。投影失败时回退 approvals pending (保守)。
+            const decisionsResult = await fetchOwnerDecisions();
+            const pendingCount = decisionsResult.success
+                ? decisionsResult.data.total
+                : result.data.pendingReviewCount;
             hasSuccessfulPollRef.current = true;
             setState((prev) => ({
                 ...prev,