create-principles-disciple 1.122.2 → 1.123.0

package/console/dist/server/index.js

@@ -425,13 +425,15 @@ function handleRequest(services) {
             if (urlPath === '/api/v1/governance/owner-decisions' || urlPath.startsWith('/api/v1/governance/owner-decisions/')) {
                 const subPath = urlPath.slice('/api/v1/governance/owner-decisions'.length);
                 const odIdentity = resolveOwnerIdentity(process.env, defaultOwnerIdentityHomeDir());
-                const authEnabledForOwner = services.authConfig.isEnabled() && odIdentity.ownerId && odIdentity.credentialId;
+                const { ownerId, credentialId } = odIdentity;
+                const authEnabledForOwner = services.authConfig.isEnabled()
+                    && ownerId !== null && credentialId !== null;
                 asyncHandler(() => handleOwnerDecisionsRoute(req, res, {
                     workspaceDir: services.workspaceDir,
                     subPath,
                     ownerIdentity: authEnabledForOwner
-                        ? { ownerId: odIdentity.ownerId ?? 'console_operator', credentialId: odIdentity.credentialId ?? undefined }
-                        : { ownerId: 'console_operator' },
+                        ? { ownerId, credentialId }
+                        : null,
                 }))(req, res);
                 return;
             }
@@ -461,7 +463,10 @@ function handleRequest(services) {
             }
             // GET /api/health
             if (urlPath === '/api/health') {
-                asyncHandler(() => handleHealthRoute(req, res, services.workspaceDir))(req, res);
+                asyncHandler(() => handleHealthRoute(req, res, {
+                    workspaceDir: services.workspaceDir,
+                    authenticationMode: services.authConfig.isEnabled() ? 'authenticated' : 'no_auth',
+                }))(req, res);
                 return;
             }
             // 404 fallback for API routes

package/console/dist/server/models/OwnerDecisionConsoleModel.d.ts

@@ -1,3 +1,4 @@
+import type { OwnerDecisionReviewSnapshot } from '@principles/core/runtime-v2';
 export type OwnerDecisionItemKind = 'evaluator_review' | 'rollout_review' | 'activation_approval' | 'rulecode_decision';
 export interface OwnerDecisionItem {
     readonly reviewKey: string;
@@ -16,6 +17,10 @@ export interface OwnerDecisionItem {
     readonly expectedSourceRunId: string;
     readonly expectedSourceArtifactId: string;
     readonly expectedSourceArtifactHash: string;
+    readonly expectedEvidenceDigest?: string;
+    readonly review?: OwnerDecisionReviewSnapshot;
+    /** Visible recovery state: the decision is still required, but evidence is unsafe to act on. */
+    readonly evidenceUnavailableReason?: string;
     readonly createdAt: string;
 }
 export interface OwnerDecisionListResult {

package/console/dist/server/models/OwnerDecisionConsoleModel.js

@@ -11,7 +11,7 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { SqliteConnection, SqlitePIArtifactStore, SqliteApprovalQueueStore, collectOwnerDecisionFacts, deriveOwnerDecisionCapability, } from '@principles/core/runtime-v2';
+import { SqliteConnection, SqlitePIArtifactStore, SqliteApprovalQueueStore, collectOwnerDecisionFacts, deriveOwnerDecisionCapability, buildOwnerDecisionReview, } from '@principles/core/runtime-v2';
 const GOVERNANCE_TASK_KINDS = new Set(['evaluator', 'rollout_reviewer']);
 /** tasks.status 合法值（PDTaskStatus）运行时守卫。 */
 const TASK_STATUSES = new Set(['pending', 'leased', 'succeeded', 'retry_wait', 'failed', 'needs_human_review']);
@@ -50,9 +50,8 @@ function makeRowReader(db) {
         return row ? rowToTaskRecord(row) : null;
     };
 }
-/** 行 → TaskRecord 的窄映射（tasks 表全部列；diagnostic_json 键名转换）。 */
 /** 单任务 capability → 决策条目（不 eligible → null，INV-01）。 */
-async function deriveTaskDecisionItem(task, artifactStore, readTaskRow) {
+async function deriveTaskDecisionItem(task, dependencies) {
     if (!GOVERNANCE_TASK_KINDS.has(task.taskKind))
         return null;
     const factStore = {
@@ -60,48 +59,119 @@ async function deriveTaskDecisionItem(task, artifactStore, readTaskRow) {
             if (taskId === task.taskId)
                 return task;
             try {
-                return readTaskRow(taskId);
+                return dependencies.readTaskRow(taskId);
             }
             catch {
                 return null;
             }
         },
         listArtifactsBySourceTask: async (taskId) => {
-            const list = await artifactStore.listBySourceTaskId(taskId).catch(() => []);
+            const list = await dependencies.artifactStore.listBySourceTaskId(taskId).catch(() => []);
             return list.map((a) => ({
                 artifactId: a.artifactId,
                 artifactKind: a.artifactKind,
                 validationStatus: a.validationStatus,
                 contentJson: a.contentJson,
+                sourceTaskId: a.sourceTaskId,
+                lineageArtifactIds: a.lineageArtifactIds,
+                createdAt: a.createdAt,
             }));
         },
+        getArtifactById: async (artifactId) => {
+            const artifact = await dependencies.artifactStore.getArtifactById(artifactId).catch(() => null);
+            return artifact ? {
+                artifactId: artifact.artifactId,
+                artifactKind: artifact.artifactKind,
+                validationStatus: artifact.validationStatus,
+                contentJson: artifact.contentJson,
+                sourceTaskId: artifact.sourceTaskId,
+                lineageArtifactIds: artifact.lineageArtifactIds,
+                createdAt: artifact.createdAt,
+            } : null;
+        },
     };
     const facts = await collectOwnerDecisionFacts(factStore, task.taskId);
     if (!facts)
         return null;
     const capability = deriveOwnerDecisionCapability(facts);
-    if (!capability.eligible || !capability.reviewKey)
-        return null;
+    const evidenceBlockers = capability.blockers.filter((blocker) => blocker === 'decision_artifact_missing' || blocker === 'lineage_unresolvable');
+    const kind = task.taskKind === 'rollout_reviewer' ? 'rollout_review' : 'evaluator_review';
+    if (!capability.eligible || !capability.reviewKey) {
+        if (evidenceBlockers.length === 0)
+            return null;
+        return {
+            reviewKey: `unavailable:${task.taskId}`,
+            kind,
+            taskId: task.taskId,
+            title: task.taskKind === 'rollout_reviewer'
+                ? 'Rollout 评审仍需要你的判断'
+                : '自动改进仍需要你的判断',
+            summary: '决策证据当前不完整，PD 已停止提供裁决动作以避免你批准错误版本。',
+            reasonCode: capability.reasonCode,
+            legacy: capability.legacy,
+            allowedActions: [],
+            expectedRevisionEpoch: facts.task.revisionCount ?? 0,
+            expectedSourceRunId: facts.task.humanReviewContext?.sourceRunId
+                ?? facts.task.completionIntent?.sourceRunId ?? '',
+            expectedSourceArtifactId: '',
+            expectedSourceArtifactHash: '',
+            evidenceUnavailableReason: evidenceBlockers.join(','),
+            createdAt: task.updatedAt,
+        };
+    }
+    const review = await buildOwnerDecisionReview(factStore, task.taskId);
+    if (!review) {
+        return {
+            reviewKey: `unavailable:${task.taskId}`,
+            kind,
+            taskId: task.taskId,
+            title: '自动改进仍需要你的判断',
+            summary: '决策证据无法安全读取，PD 已停止提供裁决动作。',
+            reasonCode: capability.reasonCode,
+            legacy: capability.legacy,
+            allowedActions: [],
+            expectedRevisionEpoch: facts.task.revisionCount ?? 0,
+            expectedSourceRunId: facts.task.humanReviewContext?.sourceRunId
+                ?? facts.task.completionIntent?.sourceRunId ?? '',
+            expectedSourceArtifactId: facts.decisionArtifact?.artifactId ?? '',
+            expectedSourceArtifactHash: facts.decisionArtifact?.contentHash ?? '',
+            evidenceUnavailableReason: 'owner_review_evidence_unavailable',
+            createdAt: task.updatedAt,
+        };
+    }
     const sourceRunId = facts.task.humanReviewContext?.sourceRunId
         ?? facts.task.completionIntent?.sourceRunId ?? '';
     const artifact = facts.decisionArtifact;
-    const kind = task.taskKind === 'rollout_reviewer' ? 'rollout_review' : 'evaluator_review';
+    const title = review.brief.kind === 'evaluator'
+        ? review.brief.principle.title
+            ?? review.brief.principle.statement
+            ?? review.brief.implementation.summary
+            ?? '自动改进需要你的判断'
+        : review.brief.summary ?? 'Rollout 评审需要你的判断';
+    const summary = review.brief.kind === 'evaluator'
+        ? review.brief.implementation.summary
+            ?? (review.brief.concerns.length > 0
+                ? `仍有 ${String(review.brief.concerns.length)} 项自动评审异议。`
+                : '查看当前实现、证据与动作后果。')
+        : review.brief.summary ?? '查看 rollout 证据与动作后果。';
     return {
         reviewKey: capability.reviewKey,
         kind,
         taskId: task.taskId,
-        title: kind === 'rollout_review'
-            ? 'Rollout 评审无法收敛'
-            : '自动改进已达到本轮上限',
-        summary: `机器建议继续修改（${capability.reasonCode}${capability.legacy ? '，由历史数据安全推断' : ''}）。需要你的判断：接受当前版本、再修改一次，或拒绝。`,
-        machineRecommendation: 'needs_revision（继续修改）',
+        title,
+        summary,
+        ...(review.brief.kind === 'evaluator' && review.brief.score !== undefined
+            ? { score: review.brief.score }
+            : {}),
         reasonCode: capability.reasonCode,
         legacy: capability.legacy,
-        allowedActions: [...capability.allowedActions],
+        allowedActions: [...review.capability.finalOfferedActions],
         expectedRevisionEpoch: facts.task.revisionCount ?? 0,
         expectedSourceRunId: sourceRunId,
         expectedSourceArtifactId: artifact?.artifactId ?? '',
         expectedSourceArtifactHash: artifact?.contentHash ?? '',
+        expectedEvidenceDigest: review.evidence.digest,
+        review,
         createdAt: task.updatedAt,
     };
 }
@@ -136,7 +206,10 @@ export class OwnerDecisionConsoleModel {
                 const task = rowToTaskRecord(row);
                 if (!task)
                     continue;
-                const item = await deriveTaskDecisionItem(task, artifactStore, makeRowReader(db));
+                const item = await deriveTaskDecisionItem(task, {
+                    artifactStore,
+                    readTaskRow: makeRowReader(db),
+                });
                 if (item)
                     items.push(item);
             }
@@ -166,10 +239,11 @@ export class OwnerDecisionConsoleModel {
             }
             // ── 3. RuleCode shadow 待决（promote / reject — 独立 authority，动作走既有 API）──
             try {
-                const shadowRows = db.prepare(`SELECT activation_id, channel, activated_at FROM activations
+                const shadowRows = db.prepare(`SELECT activation_id, artifact_id, channel, activated_at FROM activations
            WHERE action = 'code_tool_hook_shadow_activate'
              AND promoted_at IS NULL AND deactivated_at IS NULL`).all().filter(isRecordRow);
                 for (const row of shadowRows) {
+                    const artifactId = typeof row.artifact_id === 'string' ? row.artifact_id : '';
                     items.push({
                         reviewKey: `rulecode:${String(row.activation_id ?? '')}`,
                         kind: 'rulecode_decision',
@@ -181,7 +255,7 @@ export class OwnerDecisionConsoleModel {
                         allowedActions: ['promote', 'reject_after_shadow'],
                         expectedRevisionEpoch: 0,
                         expectedSourceRunId: '',
-                        expectedSourceArtifactId: String(row.activation_id ?? ''),
+                        expectedSourceArtifactId: artifactId,
                         expectedSourceArtifactHash: '',
                         createdAt: typeof row.activated_at === 'string' ? row.activated_at : '',
                     });
@@ -220,7 +294,7 @@ export class OwnerDecisionConsoleModel {
                 const task = rowToTaskRecord(row);
                 if (!task)
                     continue;
-                const item = await deriveTaskDecisionItem(task, artifactStore, makeRowReader(db));
+                const item = await deriveTaskDecisionItem(task, { artifactStore, readTaskRow: makeRowReader(db) });
                 if (item)
                     ids.add(task.taskId);
             }

package/console/dist/server/routes/governance.js

@@ -27,9 +27,14 @@ function getExperienceCollector(workspaceDir) {
  */
 export function resolveOwnerConfigSnapshot(authConfig, identity) {
     const authEnabled = authConfig.isEnabled();
+    const ownerIdentityConfiguration = identity.source === 'invalid_env' || identity.error !== undefined
+        ? 'invalid'
+        : (identity.source === 'env' || identity.source === 'file') && identity.ownerId && identity.credentialId
+            ? 'configured'
+            : 'missing';
     return {
         authenticationMode: authEnabled ? 'authenticated' : 'no_auth',
-        ownerIdentityConfiguration: authEnabled && identity.ownerId && identity.credentialId ? 'configured' : 'missing',
+        ownerIdentityConfiguration,
     };
 }
 /**

package/console/dist/server/routes/health.d.ts

@@ -1,3 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-export declare function handleHealthRoute(req: IncomingMessage, res: ServerResponse, workspaceDir: string): Promise<void>;
+export declare function handleHealthRoute(req: IncomingMessage, res: ServerResponse, options: {
+    workspaceDir: string;
+    authenticationMode: 'authenticated' | 'no_auth';
+}): Promise<void>;
 export declare function disposeHealthModels(): void;

package/console/dist/server/routes/health.js

@@ -11,15 +11,15 @@ function getModel(workspaceDir) {
     models.set(workspaceDir, { model, cachedAt: Date.now() });
     return model;
 }
-export async function handleHealthRoute(req, res, workspaceDir) {
+export async function handleHealthRoute(req, res, options) {
     if (req.method !== 'GET') {
         sendError(res, 405, 'method_not_allowed', 'Only GET method is allowed');
         return;
     }
-    const model = getModel(workspaceDir);
+    const model = getModel(options.workspaceDir);
     try {
         const health = await model.checkSystemHealth();
-        sendSuccess(res, health);
+        sendSuccess(res, { ...health, authenticationMode: options.authenticationMode });
     }
     catch (err) {
         sendError(res, 500, 'health_check_error', err.message);

package/console/dist/server/routes/owner-decisions.d.ts

@@ -14,11 +14,11 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 export interface OwnerDecisionRouteContext {
     workspaceDir: string;
-    /** server-side auth context 推导的身份（SPEC §29 — 不信任 body） */
+    /** Only present after both Console authentication and Owner identity verification. */
     ownerIdentity: {
         ownerId: string;
-        credentialId?: string;
-    };
+        credentialId: string;
+    } | null;
 }
 export declare function handleOwnerDecisionsRoute(req: IncomingMessage, res: ServerResponse, ctx: OwnerDecisionRouteContext & {
     subPath: string;

package/console/dist/server/routes/owner-decisions.js

@@ -12,16 +12,19 @@ function getModel(workspaceDir) {
     return model;
 }
 const RESOLVE_ACTIONS = new Set(['accept_current', 'revise_once', 'reject_current']);
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 /** rc-1/rc-2/rc-3: body 按未知值逐字段校验，非法即 400 fail-loud。 */
 function parseResolveBody(raw) {
-    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+    if (!isRecord(raw)) {
         return { ok: false, error: 'Request body must be a JSON object.' };
     }
     const b = raw;
     if (typeof b.action !== 'string' || !RESOLVE_ACTIONS.has(b.action)) {
         return { ok: false, error: `action must be one of accept_current/revise_once/reject_current, got ${String(b.action)}` };
     }
-    for (const field of ['reviewKey', 'expectedSourceRunId', 'expectedSourceArtifactId', 'expectedSourceArtifactHash']) {
+    for (const field of ['reviewKey', 'expectedSourceRunId', 'expectedSourceArtifactId', 'expectedSourceArtifactHash', 'expectedEvidenceDigest']) {
         const v = b[field];
         if (typeof v !== 'string' || v.trim() === '') {
             return { ok: false, error: `${field} must be a non-empty string.` };
@@ -34,12 +37,34 @@ function parseResolveBody(raw) {
         && (typeof b.ownerInstruction !== 'string' || b.ownerInstruction.length > 600)) {
         return { ok: false, error: 'ownerInstruction must be a string of at most 600 characters (or null).' };
     }
+    let acknowledgement;
+    if (b.acknowledgement !== undefined) {
+        if (!isRecord(b.acknowledgement)) {
+            return { ok: false, error: 'acknowledgement must be an object.' };
+        }
+        const rawAcknowledgement = b.acknowledgement;
+        if (rawAcknowledgement.kind !== 'partial_evidence' || rawAcknowledgement.acknowledged !== true) {
+            return { ok: false, error: 'acknowledgement must explicitly acknowledge partial_evidence.' };
+        }
+        if (rawAcknowledgement.note !== undefined
+            && (typeof rawAcknowledgement.note !== 'string' || rawAcknowledgement.note.length > 600)) {
+            return { ok: false, error: 'acknowledgement.note must be at most 600 characters.' };
+        }
+        const note = typeof rawAcknowledgement.note === 'string' ? rawAcknowledgement.note.trim() : '';
+        acknowledgement = {
+            kind: 'partial_evidence',
+            acknowledged: true,
+            ...(note !== '' ? { note } : {}),
+        };
+    }
     const { reviewKey } = b;
     const { expectedSourceRunId } = b;
     const { expectedSourceArtifactId } = b;
     const { expectedSourceArtifactHash } = b;
+    const { expectedEvidenceDigest } = b;
     if (typeof reviewKey !== 'string' || typeof expectedSourceRunId !== 'string'
-        || typeof expectedSourceArtifactId !== 'string' || typeof expectedSourceArtifactHash !== 'string') {
+        || typeof expectedSourceArtifactId !== 'string' || typeof expectedSourceArtifactHash !== 'string'
+        || typeof expectedEvidenceDigest !== 'string') {
         return { ok: false, error: 'unreachable: string fields validated above' };
     }
     return {
@@ -51,6 +76,8 @@ function parseResolveBody(raw) {
             expectedSourceRunId,
             expectedSourceArtifactId,
             expectedSourceArtifactHash,
+            expectedEvidenceDigest,
+            ...(acknowledgement !== undefined ? { acknowledgement } : {}),
             ...(typeof b.ownerInstruction === 'string' ? { ownerInstruction: b.ownerInstruction } : {}),
         },
     };
@@ -92,6 +119,11 @@ function sendOutcome(res, outcome) {
                 nextAction: 'Refresh the governance focus and decide again on the current version.',
             });
             return;
+        case 'evidence_acknowledgement_required':
+            sendError(res, 409, 'evidence_acknowledgement_required', 'Accepting partial evidence requires explicit acknowledgement.', {
+                nextAction: 'Review the missing evidence, acknowledge it explicitly, then submit again.',
+            });
+            return;
         case 'already_resolved':
             sendError(res, 409, 'already_resolved', `This decision was already resolved with action '${outcome.existingAction}'.`, {
                 nextAction: 'Refresh the governance focus.',
@@ -149,6 +181,12 @@ export async function handleOwnerDecisionsRoute(req, res, ctx) {
             sendMethodNotAllowed(res);
             return;
         }
+        if (!ownerIdentity) {
+            sendError(res, 403, 'owner_authentication_required', 'Owner decisions require an authenticated Console and a configured Owner identity.', {
+                nextAction: 'Configure the Console token and Owner identity, then retry from Governance Focus.',
+            });
+            return;
+        }
         // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- match group is always present
         const taskId = decodeURIComponent(resolveMatch[1]);
         let body;

package/console/dist/ui/api.d.ts

@@ -157,6 +157,11 @@ declare function resolveOwnerDecision(taskId: string, body: {
     expectedSourceRunId: string;
     expectedSourceArtifactId: string;
     expectedSourceArtifactHash: string;
+    expectedEvidenceDigest: string;
+    acknowledgement?: {
+        kind: 'partial_evidence';
+        acknowledged: true;
+    };
     ownerInstruction?: string | null;
 }): Promise<ApiResponse<OwnerResolutionResultData>>;
 declare function fetchApprovalsGrouped(): Promise<ApiResponse<ApprovalsGroupedData>>;

package/console/dist/ui/i18n/en.json

@@ -147,6 +147,8 @@
                 },
                 "reason": {
                     "ownerIdentityMissing": "The Owner identity is not configured. RuleCode governance decisions are blocked until PD_OWNER_ID and PD_OWNER_CREDENTIAL_ID are set and the console token auth is enabled.",
+                    "ownerIdentityInvalid": "The Owner identity configuration is invalid, so governance actions are safely blocked.",
+                    "ownerAuthenticationMissing": "The identity is registered, but Console token authentication is not enabled.",
                     "approvalPending": "Principle approvals are waiting for your decision.",
                     "rulecodeOwnerDecision": "RuleCode shadow activations are waiting for your promotion decision.",
                     "noPendingDecision": "No principle approval is waiting right now.",
@@ -161,6 +163,7 @@
                 },
                 "next": {
                     "configureOwner": "Configure PD_OWNER_ID and PD_OWNER_CREDENTIAL_ID, then enable console token auth.",
+                    "authenticateConsole": "Enable Console token authentication, then retry.",
                     "reviewApprovals": "Review the pending decisions below.",
                     "inspectRecovery": "Open Failed Tasks and recover the stalled work.",
                     "inspectSources": "Inspect state.db and the principle ledger, then restart the console.",
@@ -178,6 +181,12 @@
                     "copied": "Copied",
                     "docLink": "Configuration guide and verification →"
                 },
+                "blocker": {
+                    "identityMissing": "Register the Owner identity to enable governance actions.",
+                    "identityInvalid": "The Owner identity configuration is invalid; fix it in Settings.",
+                    "authenticationMissing": "Identity registered; enable Console token authentication to use governance actions.",
+                    "goSettings": "Go to Settings"
+                },
                 "activity": {
                     "needsDecision": "{{count}} decision(s) waiting",
                     "needsRecovery": "{{count}} item(s) need recovery",
@@ -187,7 +196,8 @@
                 "readiness": {
                     "identity": {
                         "configured": "Owner identity: configured",
-                        "missing": "Owner identity: missing"
+                        "missing": "Owner identity: missing",
+                        "invalid": "Owner identity: invalid"
                     },
                     "principleApproval": "Principle approvals: operator entry",
                     "rulecode": {
@@ -262,6 +272,8 @@
             "zeroStateDbMissing": "PD has not run in this workspace yet. Once the state database is initialized, governance data will appear here.",
             "evidenceInProgress": "{{count}} behavior evidence item(s) recorded, being diagnosed and processed.",
             "ownerDecision": {
+                "evidenceUnavailable": "This decision still needs you, but its evidence chain is incomplete. PD has paused all decision actions so you cannot approve the wrong version.",
+                "goRecoverCta": "View recovery details",
                 "sectionTitle": "Needs your decision",
                 "empty": "Nothing needs your decision right now. Problems the machine can solve on its own will not disturb you.",
                 "unavailable": "(unavailable)",
@@ -272,6 +284,15 @@
                 "kindRulecode": "RuleCode decision",
                 "legacyBadge": "Inferred from history",
                 "machineRecommendationLabel": "Machine recommendation",
+                "principleLabel": "Principle",
+                "implementationLabel": "Implementation",
+                "concernLabel": "Primary concern",
+                "partialEvidenceAcknowledgement": "I understand the evidence is incomplete and still want to accept this version.",
+                "evidence": {
+                    "complete": "Evidence complete",
+                    "partial": "Evidence partial",
+                    "insufficient": "Evidence insufficient"
+                },
                 "rolloutSafetyNote": "Accept this review and continue. High-risk rules still require an independent deployment approval.",
                 "acceptCurrent": "Accept current version",
                 "reviseOnce": "Revise once more",

package/console/dist/ui/i18n/zh-CN.json

@@ -147,6 +147,8 @@
                 },
                 "reason": {
                     "ownerIdentityMissing": "尚未配置拥有者身份。RuleCode 治理决策入口被阻塞，需要设置 PD_OWNER_ID 与 PD_OWNER_CREDENTIAL_ID 并启用控制台令牌认证。",
+                    "ownerIdentityInvalid": "拥有者身份配置无效，治理动作已安全阻止。",
+                    "ownerAuthenticationMissing": "身份已登记，但控制台尚未启用令牌认证。",
                     "approvalPending": "有原则审批正在等待你的决策。",
                     "rulecodeOwnerDecision": "有 RuleCode 影子激活正在等待你的晋升决策。",
                     "noPendingDecision": "当前没有等待决策的原则审批。",
@@ -161,6 +163,7 @@
                 },
                 "next": {
                     "configureOwner": "配置 PD_OWNER_ID 与 PD_OWNER_CREDENTIAL_ID，并启用控制台令牌认证。",
+                    "authenticateConsole": "启用控制台令牌认证后重试。",
                     "reviewApprovals": "在下方处理待决策事项。",
                     "inspectRecovery": "打开失败任务页面并恢复停滞的工作。",
                     "inspectSources": "检查 state.db 与原则账本，然后重启控制台。",
@@ -178,6 +181,12 @@
                     "copied": "已复制",
                     "docLink": "查看配置说明与验证方法 →"
                 },
+                "blocker": {
+                    "identityMissing": "登记拥有者身份后即可执行治理动作。",
+                    "identityInvalid": "拥有者身份配置无效；请在设置中修正。",
+                    "authenticationMissing": "身份已登记；启用控制台令牌认证后治理动作即可执行。",
+                    "goSettings": "前往设置"
+                },
                 "activity": {
                     "needsDecision": "{{count}} 项决策待处理",
                     "needsRecovery": "{{count}} 项需要恢复",
@@ -187,7 +196,8 @@
                 "readiness": {
                     "identity": {
                         "configured": "拥有者身份：已配置",
-                        "missing": "拥有者身份：未配置"
+                        "missing": "拥有者身份：未配置",
+                        "invalid": "拥有者身份：配置无效"
                     },
                     "principleApproval": "原则审批：操作员入口",
                     "rulecode": {
@@ -262,6 +272,8 @@
             "zeroStateDbMissing": "PD 尚未在此工作空间中运行。状态数据库初始化后，治理数据将在这里呈现。",
             "evidenceInProgress": "{{count}} 条行为证据已记录，正在诊断和处理中。",
             "ownerDecision": {
+                "evidenceUnavailable": "这项裁决仍在等待你，但证据链目前不完整。PD 已暂停所有裁决动作，避免你在看不到正确版本时做决定。",
+                "goRecoverCta": "查看恢复详情",
                 "sectionTitle": "需要你决定",
                 "empty": "现在没有需要你决定的事项。机器能自己解决的问题不会打扰你。",
                 "unavailable": "（暂不可用）",
@@ -272,6 +284,15 @@
                 "kindRulecode": "RuleCode 决策",
                 "legacyBadge": "历史数据推断",
                 "machineRecommendationLabel": "机器建议",
+                "principleLabel": "原则",
+                "implementationLabel": "实现",
+                "concernLabel": "主要顾虑",
+                "partialEvidenceAcknowledgement": "我知道当前证据不完整，仍要接受当前版本。",
+                "evidence": {
+                    "complete": "证据完整",
+                    "partial": "证据不完整",
+                    "insufficient": "证据不足"
+                },
                 "rolloutSafetyNote": "接受当前评审并继续。高风险规则仍需经过独立部署审批。",
                 "acceptCurrent": "接受当前版本",
                 "reviseOnce": "再修改一次",