create-principles-disciple 1.130.2 → 1.131.0

package/console/dist/server/models/ActivationsConsoleModel.js

@@ -1,5 +1,5 @@
 import { SqliteConnection, SqliteActivationStateStore, SqlitePIArtifactStore, extractPrincipleId, extractEvidenceRefs, PromotionReadinessReader, RuleHostWriter, createProductionGateDeps, SqliteActivationSafetyStore, isFeatureEnabled, RuleCodeOwnerDecisionService, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, buildPromotionEvidenceSnapshot, } from '@principles/core/runtime-v2';
-import { OPENCLAW_HOST_LIVENESS_CONTRACT } from '@principles/host-runtime';
+import { OPENCLAW_HOST_LIVENESS_CONTRACT, resolveWorkspaceHostToolSemantics } from '@principles/host-runtime';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -355,7 +355,21 @@ export class ActivationsConsoleModel {
             const decisions = await safetyStore.listDecisions(activationId);
             const telemetry = readRuleCodeTelemetry(this.workspaceDir, activationId, decisions);
             const flags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
-            const writer = new RuleHostWriter({ gateDeps: createProductionGateDeps(), featureFlagProbe: id => isFeatureEnabled(flags, id) });
+            // PRI-634-F R3 (SPEC P1-1): promotion readiness evaluates through the
+            // SAME workspace host-declaration resolver as CLI/Approvals — the bare
+            // baseline must never serve as an existence proof here. Unresolvable
+            // provenance degrades to the legacy readiness behavior (read-model
+            // probe, not a mutation), consistent with the CLI readiness writer.
+            const toolSemantics = resolveWorkspaceHostToolSemantics(this.workspaceDir);
+            const writer = new RuleHostWriter({
+                gateDeps: createProductionGateDeps({
+                    projectDir: this.workspaceDir,
+                    ...(toolSemantics.ok ? { toolSemantics: toolSemantics.registry } : {}),
+                }),
+                featureFlagProbe: id => isFeatureEnabled(flags, id),
+                projectDir: this.workspaceDir,
+                ...(toolSemantics.ok ? { toolSemantics: toolSemantics.registry } : {}),
+            });
             const reader = new PromotionReadinessReader({
                 listCodeToolHookActivations: () => activationStore.listCodeToolHookActivations(true),
                 getArtifactById: id => artifactStore.getArtifactById(id),

package/console/dist/server/models/ApprovalsConsoleModel.js

@@ -2,6 +2,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { SqliteConnection, SqliteApprovalQueueStore, SqliteActivationStateStore, SqlitePIArtifactStore, ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, createProductionGateDeps, ApprovalCompletionService, ApprovalQueue, mapConfidenceToLabel, isArtifactRevisionOf, extractPrincipleId, PrincipleTreeLedgerAdapter, MVP_CHANNELS, } from '@principles/core/runtime-v2';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
+import { resolveWorkspaceHostToolSemantics } from '@principles/host-runtime';
 const MVP_PROVEN_CHANNELS = new Set(MVP_CHANNELS);
 const EMPTY_STATS = { pending: 0, approved: 0, rejected: 0, cancelled: 0 };
 function isMissingTableError(err) {
@@ -338,14 +339,37 @@ export class ApprovalsConsoleModel {
             };
             const activationStateStore = new SqliteActivationStateStore(connection);
             const approvalQueueStore = new SqliteApprovalQueueStore(connection);
+            // PRI-634-F R3 (SPEC P1-1): the Console resolves tool semantics through
+            // the SAME workspace host-declaration resolver as the CLI — never guess
+            // a host, never validate against the bare baseline. A code_tool_hook
+            // approval whose provenance is unresolvable refuses BEFORE dispatch
+            // (fail loud, same reason string as the CLI); e2e seed environments
+            // must persist a host declaration like any real host would.
+            const toolSemantics = resolveWorkspaceHostToolSemantics(this.workspaceDir);
+            if (existing.channel === 'code_tool_hook' && !toolSemantics.ok) {
+                return {
+                    decision: 'refused',
+                    reason: toolSemantics.reason,
+                    nextAction: toolSemantics.nextAction,
+                    channel: existing.channel,
+                };
+            }
             // Wire all three MVP-Core writers, including RuleHostWriter for code_tool_hook.
             // This fixes the P0 breakpoint where code_tool_hook approvals could not activate.
             const dispatcher = new ActivationDispatcher(artifactReadModel, activationStateStore, {
                 writers: [
                     new PromptWriter(),
                     new RuleHostWriter({
-                        gateDeps: createProductionGateDeps(),
+                        gateDeps: createProductionGateDeps({
+                            projectDir: this.workspaceDir,
+                            ...(toolSemantics.ok ? { toolSemantics: toolSemantics.registry } : {}),
+                        }),
                         featureFlagProbe: (flagId) => pdFlags.flags[flagId]?.enabled === true,
+                        projectDir: this.workspaceDir,
+                        ...(toolSemantics.ok ? { toolSemantics: toolSemantics.registry } : {}),
+                        // Provenance unresolvable → writer refuses at canActivate with
+                        // the resolver reason (dispatcher maps it to a refused
+                        // decision). Ordering note above: artifact-schema reasons win.
                     }),
                     new DeferArchiveWriter(),
                 ],

package/console/dist/server/routes/update.js

@@ -10,6 +10,7 @@ import { migrateLegacyExtensionBackups, reservePdBackupDestination, resolvePdBac
 import { resolveExtensionsDir, resolveUpdateLayout, resolvePluginDir, readCurrentVersion, } from '../utils/installed-layout.js';
 import { ActivationCompatibilityReadModel } from '@principles/core/runtime-v2';
 import { collectFileDepLinkSpecs } from '../utils/update-links.js';
+import { updateMutationController, LEGACY_MUTATION_AUTHORITY, } from '../update/mutation-controller.js';
 /**
  * Legacy rule contract preflight (2026-08-19): refuse to swap the runtime
  * while an ACTIVE owner-approved rule still depends on a RuleHost contract
@@ -1081,10 +1082,19 @@ async function doInlineFullUpdate(workspaceDir) {
 // ---------------------------------------------------------------------------
 // Route handler
 // ---------------------------------------------------------------------------
-export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
-    const pluginDir = resolvePluginDir(workspaceDir);
-    // GET /check
-    if (subPath === '/check') {
+/**
+ * PRI-659: the four mutation kinds below are the legacy console updater's
+ * implementations, registered into the MutationController (ADR-0023/0024
+ * migration boundary). handleUpdateRoute is now a thin dispatcher: it maps
+ * the URL subPath to a mutation kind and lets the controller resolve the
+ * authority. The implementation stays here verbatim (replace-then-delete —
+ * no third updater, no logic duplication); when ReleaseManager matures it
+ * registers under `release-manager` for the same kinds and this route layer
+ * needs no further change.
+ */
+function legacyCheckMutation(req, res, ctx) {
+    return (async () => {
+        const pluginDir = resolvePluginDir(ctx.workspaceDir);
         if (req.method !== 'GET') {
             sendMethodNotAllowed(res);
             return;
@@ -1111,10 +1121,11 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
         catch (err) {
             sendError(res, 500, 'update_check_error', err instanceof Error ? err.message : 'Unknown error');
         }
-        return;
-    }
-    // POST /apply
-    if (subPath === '/apply') {
+    })();
+}
+function legacyApplyMutation(req, res, ctx) {
+    return (async () => {
+        const pluginDir = resolvePluginDir(ctx.workspaceDir);
         if (req.method !== 'POST') {
             sendMethodNotAllowed(res);
             return;
@@ -1146,7 +1157,7 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
                 return;
             }
             // Path traversal validation
-            if (!validatePathInWorkspace(targetDir, workspaceDir)) {
+            if (!validatePathInWorkspace(targetDir, ctx.workspaceDir)) {
                 sendBadRequest(res, 'targetDir must be within workspace or extensions directory');
                 return;
             }
@@ -1154,7 +1165,7 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
                 targetDir,
                 mergeStrategy,
                 createBackup,
-            }, workspaceDir);
+            }, ctx.workspaceDir);
             sendSuccess(res, result);
         }
         catch (err) {
@@ -1164,10 +1175,11 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
             }
             sendError(res, 500, 'update_apply_error', err instanceof Error ? err.message : 'Unknown error');
         }
-        return;
-    }
-    // POST /rollback
-    if (subPath === '/rollback') {
+    })();
+}
+function legacyRollbackMutation(req, res, ctx) {
+    return (async () => {
+        const pluginDir = resolvePluginDir(ctx.workspaceDir);
         if (req.method !== 'POST') {
             sendMethodNotAllowed(res);
             return;
@@ -1189,15 +1201,15 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
                 return;
             }
             // Path traversal validation
-            if (!validatePathInWorkspace(targetDir, workspaceDir)) {
+            if (!validatePathInWorkspace(targetDir, ctx.workspaceDir)) {
                 sendBadRequest(res, 'targetDir must be within workspace or extensions directory');
                 return;
             }
-            if (!validatePathInWorkspace(backupDir, workspaceDir)) {
+            if (!validatePathInWorkspace(backupDir, ctx.workspaceDir)) {
                 sendBadRequest(res, 'backupDir must be within the workspace, extensions directory, or PD backups directory');
                 return;
             }
-            const result = await doRollbackUpdate({ targetDir, backupDir }, workspaceDir);
+            const result = await doRollbackUpdate({ targetDir, backupDir }, ctx.workspaceDir);
             sendSuccess(res, result);
         }
         catch (err) {
@@ -1207,22 +1219,42 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
             }
             sendError(res, 500, 'update_rollback_error', err instanceof Error ? err.message : 'Unknown error');
         }
-        return;
-    }
-    // POST /apply-full — inline tarball download + file copy (no external installer)
-    if (subPath === '/apply-full') {
+    })();
+}
+function legacyApplyFullMutation(req, res, ctx) {
+    return (async () => {
         if (req.method !== 'POST') {
             sendMethodNotAllowed(res);
             return;
         }
         try {
-            const result = await doInlineFullUpdate(workspaceDir);
+            const result = await doInlineFullUpdate(ctx.workspaceDir);
             sendSuccess(res, result);
         }
         catch (err) {
             sendError(res, 500, 'update_apply_full_error', err instanceof Error ? err.message : 'Unknown error');
         }
+    })();
+}
+// PRI-659: register the legacy authority (ADR-0024 D-1 fallback authority)
+// for every mutation kind. Registration is the ONLY coupling between this
+// implementation and the controller — no other module needs to know where
+// the legacy implementation lives.
+updateMutationController.register('check', { name: LEGACY_MUTATION_AUTHORITY, handler: legacyCheckMutation });
+updateMutationController.register('apply', { name: LEGACY_MUTATION_AUTHORITY, handler: legacyApplyMutation });
+updateMutationController.register('apply-full', { name: LEGACY_MUTATION_AUTHORITY, handler: legacyApplyFullMutation });
+updateMutationController.register('rollback', { name: LEGACY_MUTATION_AUTHORITY, handler: legacyRollbackMutation });
+const UPDATE_MUTATION_KINDS = new Map([
+    ['/check', 'check'],
+    ['/apply', 'apply'],
+    ['/apply-full', 'apply-full'],
+    ['/rollback', 'rollback'],
+]);
+export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
+    const kind = UPDATE_MUTATION_KINDS.get(subPath);
+    if (kind === undefined) {
+        sendNotFound(res, `Update route not found: ${subPath}`);
         return;
     }
-    sendNotFound(res, `Update route not found: ${subPath}`);
+    await updateMutationController.dispatch(req, res, { workspaceDir }, kind);
 }

package/console/dist/server/update/mutation-controller.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Mutation Controller — PRI-659 migration boundary.
+ *
+ * Governed by:
+ * - ADR-0023 (PD Installation Architecture Decisions) — runtime is written
+ *   only by sanctioned authorities.
+ * - ADR-0024 (PD Runtime Mutation Governance, D-1) — the Console Web updater
+ *   must converge into a trigger/presentation layer over ReleaseManager; it
+ *   must not remain an independent mutation authority long-term.
+ *
+ * Role:
+ *   The controller is the SINGLE routing point between the HTTP surface
+ *   (`/api/update/*`) and whichever authority actually performs the mutation.
+ *   It owns:
+ *     - the mutation-kind registry (check / apply / apply-full / rollback),
+ *     - authority resolution with an explicit preferred authority
+ *       (`release-manager`, ADR-0024 D-1) and a safe fallback
+ *       (`legacy-console-updater`) until ReleaseManager leaves shadow mode,
+ *     - observability: every dispatched response carries the
+ *       `X-PD-Mutation-Authority` header so operators can see which
+ *       authority served a mutation.
+ *
+ * Non-goals (deliberate):
+ *   - The controller performs NO file mutation itself. It only routes. It is
+ *     therefore not a new mutation authority (asserted by migration tests).
+ *   - It does not wrap, copy, or replace the legacy updater implementation.
+ *     The legacy implementation stays in `routes/update.ts` and registers
+ *     itself here. When ReleaseManager matures, it registers under
+ *     `RELEASE_MANAGER_AUTHORITY` for the same kinds and the route layer
+ *     needs no further change.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Authority that exists today: the inline console updater (routes/update.ts). */
+export declare const LEGACY_MUTATION_AUTHORITY: 'legacy-console-updater';
+/** Authority designated by ADR-0024 D-1 as the long-term mutation authority. */
+export declare const RELEASE_MANAGER_AUTHORITY: 'release-manager';
+/**
+ * Preferred authority for every mutation kind. Until ReleaseManager exits
+ * shadow mode (its apply()/rollback() still refuse with
+ * `shadow_mode_read_only`) nothing registers under this name and resolution
+ * falls back to the legacy authority — preserving current capability
+ * (replace-then-delete, not delete-then-rebuild).
+ */
+export declare const PREFERRED_MUTATION_AUTHORITY: "release-manager";
+export type MutationKind = 'check' | 'apply' | 'apply-full' | 'rollback';
+export declare const MUTATION_KINDS: readonly MutationKind[];
+export interface MutationContext {
+    readonly workspaceDir: string;
+}
+export type MutationHandler = (req: IncomingMessage, res: ServerResponse, ctx: MutationContext) => Promise<void>;
+export interface MutationAuthority {
+    readonly name: string;
+    readonly handler: MutationHandler;
+}
+export interface MutationGovernanceInfo {
+    readonly active: string;
+    readonly preferred: string;
+    readonly fallback: boolean;
+    readonly available: readonly string[];
+}
+export interface ResolvedAuthority {
+    readonly authority: MutationAuthority;
+    readonly fallback: boolean;
+}
+export declare class MutationController {
+    private readonly authorities;
+    register(kind: MutationKind, authority: MutationAuthority): void;
+    unregister(kind: MutationKind, name: string): boolean;
+    hasAuthority(kind: MutationKind, name: string): boolean;
+    /**
+     * Resolve which authority serves `kind`: the preferred authority when
+     * registered, otherwise the legacy authority as an explicit fallback.
+     * Throws when nothing is registered — an unregistered kind must fail loud,
+     * not silently mutate.
+     */
+    resolveAuthority(kind: MutationKind): ResolvedAuthority;
+    /**
+     * Route one mutation request. Response body contract is owned by the
+     * authority handler; the controller only annotates the response with the
+     * resolved authority so governance state is observable per request.
+     */
+    dispatch(req: IncomingMessage, res: ServerResponse, ctx: MutationContext, kind: MutationKind): Promise<void>;
+    /** Governance snapshot for observability and migration tests. */
+    describeGovernance(): Record<MutationKind, MutationGovernanceInfo>;
+}
+/**
+ * Process-wide controller for the `/api/update/*` surface. The legacy
+ * updater registers its handlers at module load of `routes/update.ts`.
+ */
+export declare const updateMutationController: MutationController;

package/console/dist/server/update/mutation-controller.js

@@ -0,0 +1,89 @@
+/** Authority that exists today: the inline console updater (routes/update.ts). */
+export const LEGACY_MUTATION_AUTHORITY = 'legacy-console-updater';
+/** Authority designated by ADR-0024 D-1 as the long-term mutation authority. */
+export const RELEASE_MANAGER_AUTHORITY = 'release-manager';
+/**
+ * Preferred authority for every mutation kind. Until ReleaseManager exits
+ * shadow mode (its apply()/rollback() still refuse with
+ * `shadow_mode_read_only`) nothing registers under this name and resolution
+ * falls back to the legacy authority — preserving current capability
+ * (replace-then-delete, not delete-then-rebuild).
+ */
+export const PREFERRED_MUTATION_AUTHORITY = RELEASE_MANAGER_AUTHORITY;
+export const MUTATION_KINDS = ['check', 'apply', 'apply-full', 'rollback'];
+export class MutationController {
+    authorities = new Map();
+    register(kind, authority) {
+        let table = this.authorities.get(kind);
+        if (table === undefined) {
+            table = new Map();
+            this.authorities.set(kind, table);
+        }
+        table.set(authority.name, authority);
+    }
+    unregister(kind, name) {
+        return this.authorities.get(kind)?.delete(name) ?? false;
+    }
+    hasAuthority(kind, name) {
+        return this.authorities.get(kind)?.has(name) ?? false;
+    }
+    /**
+     * Resolve which authority serves `kind`: the preferred authority when
+     * registered, otherwise the legacy authority as an explicit fallback.
+     * Throws when nothing is registered — an unregistered kind must fail loud,
+     * not silently mutate.
+     */
+    resolveAuthority(kind) {
+        const table = this.authorities.get(kind);
+        if (table === undefined || table.size === 0) {
+            throw new Error(`No mutation authority registered for kind: ${kind}`);
+        }
+        const preferred = table.get(PREFERRED_MUTATION_AUTHORITY);
+        if (preferred !== undefined) {
+            return { authority: preferred, fallback: false };
+        }
+        const legacy = table.get(LEGACY_MUTATION_AUTHORITY);
+        if (legacy !== undefined) {
+            return { authority: legacy, fallback: true };
+        }
+        // Multiple non-preferred, non-legacy authorities: refuse to guess.
+        throw new Error(`No preferred (${PREFERRED_MUTATION_AUTHORITY}) or legacy (${LEGACY_MUTATION_AUTHORITY}) authority registered for kind: ${kind}`);
+    }
+    /**
+     * Route one mutation request. Response body contract is owned by the
+     * authority handler; the controller only annotates the response with the
+     * resolved authority so governance state is observable per request.
+     */
+    // eslint-disable-next-line @typescript-eslint/max-params -- (req, res) mirrors the Node handler shape used across this server
+    async dispatch(req, res, ctx, kind) {
+        const { authority, fallback } = this.resolveAuthority(kind);
+        const headerValue = fallback
+            ? `${authority.name} (preferred: ${PREFERRED_MUTATION_AUTHORITY} not yet available)`
+            : authority.name;
+        res.setHeader('X-PD-Mutation-Authority', headerValue);
+        await authority.handler(req, res, ctx);
+    }
+    /** Governance snapshot for observability and migration tests. */
+    describeGovernance() {
+        const snapshot = {};
+        for (const kind of MUTATION_KINDS) {
+            const table = this.authorities.get(kind);
+            const available = table !== undefined ? [...table.keys()] : [];
+            let info;
+            if (table === undefined || table.size === 0) {
+                info = { active: 'none', preferred: PREFERRED_MUTATION_AUTHORITY, fallback: false, available };
+            }
+            else {
+                const { authority, fallback } = this.resolveAuthority(kind);
+                info = { active: authority.name, preferred: PREFERRED_MUTATION_AUTHORITY, fallback, available };
+            }
+            snapshot[kind] = info;
+        }
+        return snapshot;
+    }
+}
+/**
+ * Process-wide controller for the `/api/update/*` surface. The legacy
+ * updater registers its handlers at module load of `routes/update.ts`.
+ */
+export const updateMutationController = new MutationController();

package/core/dist/runtime-v2/__tests__/replay-production-parity.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Replay / Production Input Parity tests — PRI-634-F Phase 2
+ *
+ * SPEC §12 Phase 2 acceptance: for the same {tool, params, workspace}, the
+ * replay input builder and the production action builder produce identical
+ * canonicalKind / normalizedPath / paramsSummary.
+ *
+ * Baseline defect this file pins (see docs/pri-634-f-baseline-report.md §1.3):
+ * replay builders never passed isBashTool/isWriteTool hints, so bash command
+ * extraction and write-tool synthetic paths never fired on the replay side.
+ */
+export {};
+//# sourceMappingURL=replay-production-parity.test.d.ts.map

package/core/dist/runtime-v2/__tests__/replay-production-parity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-production-parity.test.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/__tests__/replay-production-parity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/core/dist/runtime-v2/__tests__/replay-production-parity.test.js

@@ -0,0 +1,133 @@
+/**
+ * Replay / Production Input Parity tests — PRI-634-F Phase 2
+ *
+ * SPEC §12 Phase 2 acceptance: for the same {tool, params, workspace}, the
+ * replay input builder and the production action builder produce identical
+ * canonicalKind / normalizedPath / paramsSummary.
+ *
+ * Baseline defect this file pins (see docs/pri-634-f-baseline-report.md §1.3):
+ * replay builders never passed isBashTool/isWriteTool hints, so bash command
+ * extraction and write-tool synthetic paths never fired on the replay side.
+ */
+import { describe, expect, it } from 'vitest';
+import { buildRuleHostAction } from '../internalization/rule-host-input-builder.js';
+import { createSyntheticRuleHostInput } from '../golden-trace.js';
+import { evaluateInRefinerSandbox } from '../internalization/refiner-sandbox-wrapper.js';
+import { buildToolSemanticRegistry } from '../internalization/tool-semantic-registry.js';
+const PROJECT_DIR = '/workspace/project';
+function registry() {
+    const built = buildToolSemanticRegistry([
+        { rawToolName: 'shell', canonicalKind: 'execute' },
+        { rawToolName: 'delete_file', canonicalKind: 'write' },
+    ]);
+    if (!built.ok)
+        throw new Error(built.errors.join('; '));
+    return built.registry;
+}
+const FIXTURES = [
+    { label: 'write tool with absolute path', toolName: 'write_file', params: { file_path: '/workspace/project/src/a.ts', content: 'x' } },
+    { label: 'write tool with relative path', toolName: 'edit', params: { path: 'src/a.ts', old_string: 'a', new_string: 'b' } },
+    { label: 'bash tool, mutation target', toolName: 'bash', params: { command: 'rm -rf /workspace/project/build' } },
+    { label: 'bash tool, no file target (full command)', toolName: 'bash', params: { command: 'npm test' } },
+    { label: 'generic LLM alias execute_command', toolName: 'execute_command', params: { command: 'python deploy.py' } },
+    { label: 'host alias shell (was other before host layer)', toolName: 'shell', params: { command: 'grep -r TODO .' } },
+    { label: 'write tool without any path (synthetic <tool:X>)', toolName: 'delete_file', params: {} },
+    { label: 'write tool with pathless write', toolName: 'insert', params: { content: 'data' } },
+    { label: 'read tool with path', toolName: 'read_file', params: { file_path: '/workspace/project/README.md' } },
+    { label: 'unknown tool (resolve other, no extraction)', toolName: 'mystery_tool', params: { path: '/workspace/project/x' } },
+];
+describe('replay/production input parity (SPEC §12 Phase 2)', () => {
+    for (const fixture of FIXTURES) {
+        it(`replay input === production action: ${fixture.label}`, () => {
+            const toolSemantics = registry();
+            const canonicalKind = toolSemantics.resolve(fixture.toolName);
+            // Production side: the gate resolves the kind from the registry, then
+            // hands it to the shared builder (hooks/gate.ts + production-rulehost-gate.ts).
+            const productionAction = buildRuleHostAction(fixture.toolName, fixture.params, PROJECT_DIR, { canonicalKind });
+            // Replay side: the synthetic input builder resolves through the SAME
+            // registry (refiner-sandbox-wrapper + golden-trace-replay-validator).
+            const replayInput = createSyntheticRuleHostInput({ toolName: fixture.toolName, params: fixture.params }, {}, { projectDir: PROJECT_DIR, toolSemantics });
+            expect(replayInput.action.toolName).toBe(productionAction.toolName);
+            expect(replayInput.action.canonicalKind).toBe(productionAction.canonicalKind);
+            expect(replayInput.action.normalizedPath).toBe(productionAction.normalizedPath);
+            expect(replayInput.action.paramsSummary).toEqual(productionAction.paramsSummary);
+        });
+    }
+    it('registry-driven replay now extracts bash command paths (baseline defect pinned)', () => {
+        const toolSemantics = registry();
+        const input = createSyntheticRuleHostInput({ toolName: 'bash', params: { command: 'rm -rf /workspace/project/build' } }, {}, { projectDir: PROJECT_DIR, toolSemantics });
+        // Baseline: hints absent → extraction skipped → normalizedPath null.
+        expect(input.action.normalizedPath).toBe('build');
+        expect(input.action.canonicalKind).toBe('execute');
+    });
+    it('legacy replay behavior is unchanged without a registry (back-compat)', () => {
+        const input = createSyntheticRuleHostInput({ toolName: 'bash', params: { command: 'rm -rf /workspace/project/build' } }, {}, { projectDir: PROJECT_DIR });
+        // PRI-439 legacy semantics: projectDir present but no hints → bash command
+        // extraction never fires; normalizePathPure(null) === '' (not a path).
+        expect(input.action.normalizedPath).toBe('');
+        expect(input.action.canonicalKind).toBeUndefined();
+    });
+});
+describe('activation-gate sandbox parity (refiner-sandbox-wrapper)', () => {
+    it('a rule reading input.action sees the bash command path when toolSemantics is provided', () => {
+        const toolSemantics = registry();
+        const trace = {
+            traceId: 'trace-bash-parity',
+            version: 1,
+            createdAt: '2026-09-03T00:00:00.000Z',
+            cases: [
+                {
+                    caseId: 'negative-1',
+                    kind: 'negative',
+                    toolName: 'bash',
+                    params: { command: 'rm -rf /workspace/project/build' },
+                    expectedDecision: 'block',
+                },
+                {
+                    caseId: 'positive-1',
+                    kind: 'positive',
+                    toolName: 'bash',
+                    params: { command: 'echo ok' },
+                    expectedDecision: 'allow',
+                },
+            ],
+        };
+        // The rule matches on the extracted normalizedPath — under the baseline
+        // (registry absent) it would never match because normalizedPath was null.
+        // evaluateCode is a plain closure: the wrapper uses `code` only for static
+        // checks, so the behavioral contract under test is the INPUT it receives.
+        const code = [
+            'const evaluate = (input) => {',
+            '  if (input.action.normalizedPath === "build") {',
+            '    return { decision: "block", matched: true, reason: "destructive build wipe" };',
+            '  }',
+            '  return { decision: "allow", matched: false, reason: "not the protected path" };',
+            '};',
+        ].join('\n');
+        const result = evaluateInRefinerSandbox(code, trace, {
+            evaluateCode: (input) => {
+                if (input.action.normalizedPath === 'build') {
+                    return { decision: 'block', matched: true, reason: 'destructive build wipe' };
+                }
+                return { decision: 'allow', matched: false, reason: 'not the protected path' };
+            },
+            toolSemantics,
+            projectDir: PROJECT_DIR,
+        });
+        expect(result.success).toBe(true);
+        expect(result.failedCases).toHaveLength(0);
+        // Negative control: without the registry+root the same closure cannot
+        // match — pinning WHY the parity plumbing is required on the replay side.
+        const baselineResult = evaluateInRefinerSandbox(code, trace, {
+            evaluateCode: (input) => {
+                if (input.action.normalizedPath === 'build') {
+                    return { decision: 'block', matched: true, reason: 'destructive build wipe' };
+                }
+                return { decision: 'allow', matched: false, reason: 'not the protected path' };
+            },
+        });
+        expect(baselineResult.success).toBe(false);
+        expect(baselineResult.failedCases[0]?.caseId).toBe('negative-1');
+    });
+});
+//# sourceMappingURL=replay-production-parity.test.js.map

package/core/dist/runtime-v2/__tests__/replay-production-parity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-production-parity.test.js","sourceRoot":"","sources":["../../../src/runtime-v2/__tests__/replay-production-parity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AAGzF,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC,SAAS,QAAQ;IACf,MAAM,KAAK,GAAG,yBAAyB,CAAC;QACtC,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE;QAClD,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE;KACvD,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,QAAQ,CAAC;AACxB,CAAC;AAQD,MAAM,QAAQ,GAA6B;IACzC,EAAE,KAAK,EAAE,+BAA+B,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,6BAA6B,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACtI,EAAE,KAAK,EAAE,+BAA+B,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;IAC5H,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE;IACjH,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;IACxG,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE;IACpH,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE;IACrH,EAAE,KAAK,EAAE,kDAAkD,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,EAAG,EAAE;IACnG,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;IAC5F,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,8BAA8B,EAAE,EAAE;IAC9G,EAAE,KAAK,EAAE,6CAA6C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE;CAC7H,CAAC;AAEF,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,EAAE,CAAC,uCAAuC,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE;YAC9D,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE9D,sEAAsE;YACtE,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAE/G,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,WAAW,GAAG,4BAA4B,CAC9C,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EACtD,EAAE,EACF,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,CAC3C,CAAC;YAEF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACpE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC9E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAChF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,4BAA4B,CACxC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EAC5E,EAAE,EACF,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,CAC3C,CAAC;QACF,qEAAqE;QACrE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,KAAK,GAAG,4BAA4B,CACxC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EAC5E,EAAE,EACF,EAAE,UAAU,EAAE,WAAW,EAAE,CAC5B,CAAC;QACF,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACxE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC;QACjC,MAAM,KAAK,GAAgB;YACzB,OAAO,EAAE,mBAAmB;YAC5B,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,0BAA0B;YACrC,KAAK,EAAE;gBACL;oBACE,MAAM,EAAE,YAAY;oBACpB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE;oBACtD,gBAAgB,EAAE,OAAO;iBAC1B;gBACD;oBACE,MAAM,EAAE,YAAY;oBACpB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;oBAC9B,gBAAgB,EAAE,OAAO;iBAC1B;aACF;SACF,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,IAAI,GAAG;YACX,+BAA+B;YAC/B,kDAAkD;YAClD,oFAAoF;YACpF,KAAK;YACL,mFAAmF;YACnF,IAAI;SACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,KAAK,EAAE;YACnD,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;gBACtB,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;oBAC5C,OAAO,EAAE,QAAQ,EAAE,OAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;gBACzF,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,OAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YAC1F,CAAC;YACD,aAAa;YACb,UAAU,EAAE,WAAW;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE3C,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,EAAE,KAAK,EAAE;YAC3D,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;gBACtB,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;oBAC5C,OAAO,EAAE,QAAQ,EAAE,OAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;gBACzF,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,OAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YAC1F,CAAC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/core/dist/runtime-v2/activation/__tests__/activation-dispatcher.test.js

@@ -673,4 +673,40 @@ describe('activation type helpers', () => {
         expect(HIGH_RISK_CHANNEL_MAP.code_tool_hook).toBe('high');
     });
 });
+// ── PRI-634-F R2: structured failure passthrough (review P2) ────────────────
+describe('ActivationDispatcher — structured reliability failure passthrough', () => {
+    it('a refused canActivate with a structured failure surfaces it on the refused decision', async () => {
+        const artifactStore = new MemoryArtifactReadModel();
+        artifactStore.addArtifact(makePrincipleArtifact());
+        const failingWriter = {
+            channel: 'code_tool_hook',
+            canActivate: async () => ({
+                ok: false,
+                reason: 'rule_reliability_tool_not_host_dispatchable:adapter — execute_command…',
+                riskLevel: 'high',
+                failure: {
+                    layer: 'adapter',
+                    reasonCode: 'tool_not_host_dispatchable',
+                    evidence: 'affectedTools semantically classifiable but NOT dispatched by this host: execute_command',
+                    nextAction: 'regenerate the rule against host-declared tool names',
+                },
+            }),
+            activate: async () => { throw new Error('must not be reached'); },
+        };
+        const dispatcher = new ActivationDispatcher(artifactStore, new MemoryActivationStateStore(), {
+            writers: [failingWriter],
+            // code_tool_hook is high-risk: the approval store must exist so the
+            // flow reaches the writer's canActivate (the refusal under test)
+            // instead of the earlier requires_approval refusal.
+            approvalQueueStore: { enqueue: async () => ({ approvalId: 'apr-1', requestedAt: '2026-05-17T00:00:00.000Z' }) },
+        });
+        const decision = await dispatcher.dispatch(makeDispatchInput({ channel: 'code_tool_hook', confirm: true }));
+        expect(decision.decision).toBe('refused');
+        if (decision.decision !== 'refused')
+            return;
+        expect(decision.failure?.layer).toBe('adapter');
+        expect(decision.failure?.reasonCode).toBe('tool_not_host_dispatchable');
+        expect(decision.failure?.nextAction).toContain('host-declared');
+    });
+});
 //# sourceMappingURL=activation-dispatcher.test.js.map