create-principles-disciple 1.132.6 → 1.133.1

package/codex-adapter/dist/ingestion/ingestion.js

@@ -93,7 +93,7 @@ function ingestTranscriptDelta({ fallbackRootSessionId, canonicalPath, identity,
     if (offset > window.fileSize) {
         // The file shrank below the committed cursor: replaced or truncated —
         // never guess; hold the checkpoint and degrade explicitly.
-        return { status: 'degraded', reason: 'checkpoint_inconsistent', nextAction: 'the transcript is shorter than the committed checkpoint; run the audited recovery/quarantine path once available or re-ingest from a fresh rollout.', warnings: [] };
+        return { status: 'degraded', reason: 'checkpoint_inconsistent', nextAction: 'the transcript is shorter than the committed checkpoint; quarantine the stale rollout records via `pd codex ingest quarantine` or re-ingest from a fresh rollout.', warnings: [] };
     }
     const byteBoundReached = offset + window.bytes.length < window.fileSize;
     const decoded = decodeTranscriptWindow({
@@ -120,7 +120,7 @@ function ingestTranscriptDelta({ fallbackRootSessionId, canonicalPath, identity,
     }
     const degradations = [];
     if (decoded.stop.kind === 'malformed') {
-        degradations.push({ reason: 'transcript_record_malformed', ...(decoded.stop.ordinal !== null ? { ordinal: decoded.stop.ordinal } : {}), nextAction: 'the record is stable-invalid; run the audited quarantine command once available (Slice D). Later records remain as lag.' });
+        degradations.push({ reason: 'transcript_record_malformed', ...(decoded.stop.ordinal !== null ? { ordinal: decoded.stop.ordinal } : {}), nextAction: 'the record is stable-invalid; quarantine this record via `pd codex ingest quarantine` (dry-run default). Later records remain as lag.' });
     }
     else if (decoded.stop.kind === 'oversized_record') {
         degradations.push({ reason: 'transcript_record_too_large', nextAction: 'a single transcript record exceeds the bounded-read window; inspect the rollout file.' });
@@ -164,7 +164,7 @@ function ingestTranscriptDelta({ fallbackRootSessionId, canonicalPath, identity,
         return {
             status: 'degraded',
             reason: 'transcript_record_malformed',
-            nextAction: 'the record is stable-invalid; run the audited quarantine command once available (Slice D). Later records remain as lag.',
+            nextAction: 'the record is stable-invalid; quarantine this record via `pd codex ingest quarantine` (dry-run default). Later records remain as lag.',
             warnings,
         };
     }

package/codex-adapter/dist/ingestion/transcript-locate.d.ts

@@ -1,13 +1,8 @@
-export type CodexTranscriptLookup = {
-    ok: true;
-    transcriptPath: string;
-} | {
-    ok: false;
-    reason: 'catch_up_rollout_identity_invalid' | 'catch_up_sessions_root_missing' | 'catch_up_transcript_missing' | 'catch_up_transcript_ambiguous' | 'catch_up_lookup_exhausted';
-    nextAction: string;
-};
 /**
- * Resolve one previously-authenticated rollout identity to its transcript
- * path by exact-uuid filename match under `<codexHome>/sessions`.
+ * Codex transcript locator — Slice D (PRI-625) moved the implementation to
+ * @principles/host-runtime (codex-transcript-locate) so the §15 health
+ * service computes per-rollout lag with the SAME locator the catch-up path
+ * uses. This module re-exports it for compatibility with existing importers.
  */
-export declare function locateCodexTranscriptByRolloutIdentity(codexHome: string, rolloutIdentity: string): CodexTranscriptLookup;
+export { locateCodexTranscriptByRolloutIdentity, parseRolloutFileName } from '@principles/host-runtime';
+export type { CodexTranscriptLookup } from '@principles/host-runtime';

package/codex-adapter/dist/ingestion/transcript-locate.js

@@ -1,75 +1,7 @@
 /**
- * Codex transcript locator for catch-up (PRI-624 Slice C).
- *
- * The durable checkpoint stores only the rollout uuid (SPEC §18 scenario 9
- * forbids raw paths in the DB), so catch-up must resolve a checkpointed
- * rollout back to its transcript file. This is NOT session discovery: the
- * lookup searches for the EXACT rollout uuid of a rollout the authenticated
- * Workspace hook previously delivered (only hooks write checkpoints). It
- * never guesses a "latest session", never returns a partial match, and
- * refuses ambiguities (ADR-0020 §11.2 / SPEC §9).
+ * Codex transcript locator — Slice D (PRI-625) moved the implementation to
+ * @principles/host-runtime (codex-transcript-locate) so the §15 health
+ * service computes per-rollout lag with the SAME locator the catch-up path
+ * uses. This module re-exports it for compatibility with existing importers.
  */
-import fs from 'node:fs';
-import path from 'node:path';
-import { parseRolloutFileName } from './transcript-path.js';
-/** Bounded walk: hard cap on visited directory entries so a pathological sessions tree cannot stall the worker. */
-const MAX_LOOKUP_ENTRIES = 5000;
-const ROLLOUT_IDENTITY_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-/**
- * Resolve one previously-authenticated rollout identity to its transcript
- * path by exact-uuid filename match under `<codexHome>/sessions`.
- */
-export function locateCodexTranscriptByRolloutIdentity(codexHome, rolloutIdentity) {
-    if (!ROLLOUT_IDENTITY_PATTERN.test(rolloutIdentity)) {
-        return { ok: false, reason: 'catch_up_rollout_identity_invalid', nextAction: 'the checkpointed rollout identity is not a rollout uuid; inspect the workspace trajectory database.' };
-    }
-    const sessionsRoot = path.join(codexHome, 'sessions');
-    let rootStats;
-    try {
-        rootStats = fs.statSync(sessionsRoot);
-    }
-    catch {
-        return { ok: false, reason: 'catch_up_sessions_root_missing', nextAction: 'the configured CODEX_HOME has no sessions root; verify the Codex home used by the hook and by catch-up matches.' };
-    }
-    if (!rootStats.isDirectory()) {
-        return { ok: false, reason: 'catch_up_sessions_root_missing', nextAction: 'the configured CODEX_HOME sessions path is not a directory; verify the Codex home configuration.' };
-    }
-    const matches = [];
-    let visited = 0;
-    const stack = [sessionsRoot];
-    while (stack.length > 0 && matches.length < 2) {
-        const dir = stack.pop();
-        if (dir === undefined)
-            break;
-        let entries;
-        try {
-            entries = fs.readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            continue; // unreadable subtree — other subtrees may still hold the rollout
-        }
-        for (const entry of entries) {
-            visited += 1;
-            if (visited > MAX_LOOKUP_ENTRIES) {
-                return { ok: false, reason: 'catch_up_lookup_exhausted', nextAction: 'the sessions tree exceeded the bounded catch-up lookup; keep CODEX_HOME/sessions pruned or catch up rollouts manually.' };
-            }
-            if (entry.isDirectory()) {
-                stack.push(path.join(dir, entry.name));
-            }
-            else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
-                if (parseRolloutFileName(entry.name) === rolloutIdentity) {
-                    matches.push(path.join(dir, entry.name));
-                    if (matches.length >= 2)
-                        break;
-                }
-            }
-        }
-    }
-    if (matches.length === 0) {
-        return { ok: false, reason: 'catch_up_transcript_missing', nextAction: 'the checkpointed rollout has no transcript under the Codex sessions root (rotated or cleaned by Codex); its committed observations remain, the pending lag cannot be recovered.' };
-    }
-    if (matches.length > 1) {
-        return { ok: false, reason: 'catch_up_transcript_ambiguous', nextAction: 'multiple transcripts match the rollout identity; refuse to guess — inspect the Codex sessions tree.' };
-    }
-    return { ok: true, transcriptPath: matches[0] };
-}
+export { locateCodexTranscriptByRolloutIdentity, parseRolloutFileName } from '@principles/host-runtime';

package/codex-adapter/dist/ingestion/transcript-path.d.ts

@@ -20,6 +20,6 @@ export type TranscriptPathValidation = {
     reason: 'transcript_path_invalid' | 'transcript_path_outside_codex_home';
     nextAction: string;
 };
-/** rollout-<timestamp>-<uuid>.jsonl — returns the rollout uuid, or null when the name is off-contract. */
-export declare function parseRolloutFileName(fileName: string): string | null;
+import { parseRolloutFileName } from '@principles/host-runtime';
+export { parseRolloutFileName };
 export declare function validateCodexTranscriptPath(transcriptPath: string, codexHome: string): TranscriptPathValidation;

package/codex-adapter/dist/ingestion/transcript-path.js

@@ -16,27 +16,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { canonicalizePath } from './codex-home.js';
-const UUID_HEX = /^[0-9a-fA-F]+$/;
-function isHex(value) {
-    return UUID_HEX.test(value);
-}
-/** rollout-<timestamp>-<uuid>.jsonl — returns the rollout uuid, or null when the name is off-contract. */
-export function parseRolloutFileName(fileName) {
-    if (!fileName.startsWith('rollout-') || !fileName.endsWith('.jsonl'))
-        return null;
-    const stem = fileName.slice('rollout-'.length, -'.jsonl'.length);
-    const parts = stem.split('-');
-    if (parts.length < 6)
-        return null; // at least one timestamp segment + the five uuid groups
-    const [a, b, c, d, e] = parts.slice(-5);
-    if (a === undefined || b === undefined || c === undefined || d === undefined || e === undefined)
-        return null;
-    if (a.length !== 8 || b.length !== 4 || c.length !== 4 || d.length !== 4 || e.length !== 12)
-        return null;
-    if (!isHex(a) || !isHex(b) || !isHex(c) || !isHex(d) || !isHex(e))
-        return null;
-    return parts.slice(-5).join('-').toLowerCase();
-}
+// PRI-625 Slice D: the rollout filename contract has ONE implementation,
+// moved to @principles/host-runtime with the transcript locator.
+import { parseRolloutFileName } from '@principles/host-runtime';
+export { parseRolloutFileName };
 function isAbsolutePath(value) {
     return path.isAbsolute(value);
 }

package/codex-adapter/dist/worker/workspace-worker.d.ts

@@ -45,15 +45,4 @@ export interface CodexWorkerStatusEvaluation {
     readonly reason?: string;
     readonly nextAction?: string;
 }
-/**
- * SPEC §15 worker mode, evaluated WITHOUT executing anything (no lease, no
- * LLM, no transcript I/O). `manual_action_required` means no
- * Companion-registered worker serves this workspace — the manual CLI path
- * (catch-up / diagnose / run-once) is the recovery route. 'ready' here means
- * "an automatic worker would run and hold the workspace task leases";
- * live-worker liveness surfacing belongs to the Slice D health surface.
- */
-export declare function computeCodexWorkerStatusMode(input: {
-    workspaceDir: string;
-    registeredInInstallManifest: boolean;
-}): CodexWorkerStatusEvaluation;
+export { computeCodexWorkerStatusMode } from '@principles/host-runtime';

package/codex-adapter/dist/worker/workspace-worker.js

@@ -234,37 +234,7 @@ export async function runCodexWorkspaceWorkerCycle(options) {
         report: { catchUp, reconcile, diagnostician, downstream },
     };
 }
-/**
- * SPEC §15 worker mode, evaluated WITHOUT executing anything (no lease, no
- * LLM, no transcript I/O). `manual_action_required` means no
- * Companion-registered worker serves this workspace — the manual CLI path
- * (catch-up / diagnose / run-once) is the recovery route. 'ready' here means
- * "an automatic worker would run and hold the workspace task leases";
- * live-worker liveness surfacing belongs to the Slice D health surface.
- */
-export function computeCodexWorkerStatusMode(input) {
-    const workspaceDir = path.resolve(input.workspaceDir);
-    if (!directoryExists(workspaceDir)) {
-        return { mode: 'degraded', reason: 'workspace_missing', nextAction: 'The workspace directory does not exist; restore it or remove it from the install manifest.' };
-    }
-    const config = loadPdConfigForPlugin(workspaceDir);
-    if (!config.ok) {
-        const [first] = config.errors;
-        return { mode: 'degraded', reason: `pd_config_invalid:${first?.reason ?? 'unknown'}`, nextAction: first?.nextAction ?? 'Repair .pd/config.yaml.' };
-    }
-    const { flags } = computeFeatureFlagsFromConfig(config.effective);
-    if (flags['host.codex']?.enabled !== true) {
-        return { mode: 'paused', reason: 'host.codex_disabled', nextAction: 'Set features.host.codex.enabled=true in the Workspace .pd/config.yaml to enable Codex PD behavior.' };
-    }
-    if (flags.internalization_auto_consumer?.enabled !== true) {
-        return { mode: 'paused', reason: 'internalization_auto_consumer_disabled', nextAction: 'Automatic execution is paused; manual commands remain available: pd diagnose, pd runtime internalization run-once.' };
-    }
-    if (!input.registeredInInstallManifest) {
-        return {
-            mode: 'manual_action_required',
-            reason: 'workspace_not_in_install_manifest',
-            nextAction: `No Companion worker is registered for this workspace. Manual path: pd codex ingest catch-up --workspace "${workspaceDir}", then pd diagnose / pd runtime internalization run-once.`,
-        };
-    }
-    return { mode: 'ready' };
-}
+// Slice D (PRI-625): the mode authority moved to host-runtime so the CLI and
+// Console §15 health surfaces share ONE semantics with the worker. Re-exported
+// here for compatibility with every existing importer.
+export { computeCodexWorkerStatusMode } from '@principles/host-runtime';

package/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/codex-adapter",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Codex CLI host adapter for Principles Disciple — implements HostAdapter interface for OpenAI Codex CLI's stdin/stdout JSON hook model (ADR-0020).",
   "type": "module",
   "main": "./dist/index.js",

package/console/dist/server/models/CodexGovernanceHealthModel.d.ts

@@ -0,0 +1,97 @@
+/**
+ * CodexGovernanceHealthModel — Console adapter for the §15 Codex governance
+ * health block (Codex Governance Closure Slice D, PRI-625; review round 2
+ * authority convergence).
+ *
+ * The readiness computation has ONE authority: the production CLI
+ * `pd health --host codex --json` (packages/pd-cli health-codex.ts). This
+ * Console model executes that command in a fresh subprocess against the
+ * workspace and returns its report verbatim — the Console MUST NOT copy the
+ * readiness calculation, or CLI and Console could disagree about the same
+ * governance facts (P4: one source of truth).
+ *
+ * Failure is explicit (rc-9): if the CLI cannot run, the model returns
+ * `status: 'unknown'` with `ready: false` and a `health_collection_failed`
+ * blocker — "unable to determine health" is never rendered as healthy.
+ *
+ * This is a *verbatim* report passthrough, not a projection: no field is
+ * recomputed or filtered here.
+ */
+/**
+ * The report shape mirrors the CLI's CodexHealthReport exactly (the Console
+ * renders it read-only). Declared structurally so a CLI contract change
+ * surfaces as a Console compile-time review point, not a silent drift.
+ */
+export interface CodexGovernanceHealth {
+    /** 'ok' = the CLI authority produced a real report (verbatim passthrough). */
+    status: 'ok';
+    generatedAt: string;
+    host: 'codex';
+    workspace: string;
+    adapterVersion: string;
+    runtimeVersion: string;
+    codexIngestionMinVersion: string;
+    codexIngestionVerifiedVersion: string;
+    ingestionFlag: {
+        enabled: boolean;
+        source: string;
+    };
+    consent: {
+        state: string;
+        disclosureStale?: boolean;
+        failureReason?: string;
+        nextAction?: string;
+    };
+    workspaceInit: {
+        initialized: boolean;
+        reason?: string;
+    };
+    hooksTrust: {
+        detectable: boolean;
+        trusted?: boolean;
+        reason?: string;
+    };
+    dualRegistration: {
+        detected: boolean;
+        legacyAsyncPostToolUse?: boolean;
+        nextAction?: string;
+    };
+    worker: {
+        mode: string;
+        registeredInInstallManifest: boolean;
+        reason?: string;
+        nextAction?: string;
+    };
+    rollouts: {
+        checkpoints?: {
+            rolloutIdentity: string;
+            lagBytes: number | null;
+            incompleteTail: boolean;
+            updatedAt: string;
+        }[];
+        reason?: string;
+    };
+    observations: Record<string, unknown>;
+    admissions: Record<string, unknown>;
+    diagnosticianTasks: Record<string, unknown>;
+    ready: boolean;
+    readyBlockers: string[];
+    warnings: string[];
+}
+export type CodexGovernanceHealthResult = {
+    status: 'ok';
+    health: CodexGovernanceHealth;
+} | {
+    status: 'unknown';
+    ready: false;
+    readyBlockers: string[];
+    reason: string;
+    nextAction: string;
+    productClaim: 'degraded';
+};
+export declare class CodexGovernanceHealthModel {
+    private readonly workspaceDir;
+    private readonly cliEntryOverride;
+    constructor(workspaceDir: string, cliEntryOverride?: string);
+    collect(): Promise<CodexGovernanceHealthResult>;
+}

package/console/dist/server/models/CodexGovernanceHealthModel.js

@@ -0,0 +1,81 @@
+/**
+ * CodexGovernanceHealthModel — Console adapter for the §15 Codex governance
+ * health block (Codex Governance Closure Slice D, PRI-625; review round 2
+ * authority convergence).
+ *
+ * The readiness computation has ONE authority: the production CLI
+ * `pd health --host codex --json` (packages/pd-cli health-codex.ts). This
+ * Console model executes that command in a fresh subprocess against the
+ * workspace and returns its report verbatim — the Console MUST NOT copy the
+ * readiness calculation, or CLI and Console could disagree about the same
+ * governance facts (P4: one source of truth).
+ *
+ * Failure is explicit (rc-9): if the CLI cannot run, the model returns
+ * `status: 'unknown'` with `ready: false` and a `health_collection_failed`
+ * blocker — "unable to determine health" is never rendered as healthy.
+ *
+ * This is a *verbatim* report passthrough, not a projection: no field is
+ * recomputed or filtered here.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import * as fs from 'node:fs';
+const execFileAsync = promisify(execFile);
+const require = createRequire(import.meta.url);
+function resolvePdCliEntry() {
+    // pd-cli dist entry, resolvable through the workspace node_modules links.
+    try {
+        const pkgJsonPath = require.resolve('@principles/pd-cli/package.json');
+        const packageRoot = path.dirname(pkgJsonPath);
+        const entry = path.join(packageRoot, 'dist', 'index.js');
+        const packageRootDir = path.resolve(packageRoot);
+        if (!path.resolve(entry).startsWith(packageRootDir + path.sep))
+            return null;
+        return fs.existsSync(entry) ? entry : null;
+    }
+    catch {
+        return null;
+    }
+}
+export class CodexGovernanceHealthModel {
+    workspaceDir;
+    cliEntryOverride;
+    constructor(workspaceDir, cliEntryOverride) {
+        this.workspaceDir = workspaceDir;
+        this.cliEntryOverride = cliEntryOverride ?? null;
+    }
+    async collect() {
+        const entry = this.cliEntryOverride ?? resolvePdCliEntry();
+        if (entry === null) {
+            return {
+                status: 'unknown',
+                ready: false,
+                readyBlockers: ['health_collection_failed: pd_cli_unavailable'],
+                reason: 'pd_cli_unavailable',
+                nextAction: 'Install or build @principles/pd-cli (npm i -g @principles/pd-cli) so the Console can run `pd health --host codex`.',
+                productClaim: 'degraded',
+            };
+        }
+        try {
+            const { stdout } = await execFileAsync(process.execPath, [entry, 'health', '--host', 'codex', '--workspace', this.workspaceDir, '--json'], { encoding: 'utf8', timeout: 30_000, windowsHide: true });
+            // cli-1: the CLI's --json mode prints exactly one (pretty-printed) JSON
+            // object on stdout — parse the whole stdout, not just the first `{` line.
+            // runtime-contract-exempt: ERR-001 verbatim passthrough of our own CLI's documented JSON contract — single authority, see PRI-625 review round 2.
+            const health = JSON.parse(stdout);
+            return { status: 'ok', health };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message.slice(0, 200) : String(error);
+            return {
+                status: 'unknown',
+                ready: false,
+                readyBlockers: [`health_collection_failed: ${message}`],
+                reason: 'health_collection_failed',
+                nextAction: 'Run `pd health --host codex --workspace <dir>` manually to see the structured reason.',
+                productClaim: 'degraded',
+            };
+        }
+    }
+}

package/console/dist/server/models/EvidenceChainConsoleModel.js

@@ -143,12 +143,26 @@ export class EvidenceChainConsoleModel {
             try {
                 trajDb = new Database(trajectoryDbPath, { readonly: true });
                 try {
-                    painEvents = trajDb.prepare('SELECT id, session_id, source, score, reason, severity, origin, confidence, text, created_at, canonical_pain_id, runtime_task_id FROM pain_events ORDER BY created_at DESC LIMIT 100').all();
+                    painEvents = trajDb.prepare('SELECT id, session_id, source, score, reason, severity, origin, confidence, text, created_at, canonical_pain_id, runtime_task_id, host_kind FROM pain_events ORDER BY created_at DESC LIMIT 100').all();
                 }
                 catch (colErr) {
                     const colMessage = colErr instanceof Error ? colErr.message : String(colErr);
                     if (colMessage.includes('no such column')) {
-                        painEvents = trajDb.prepare('SELECT id, session_id, source, score, reason, severity, origin, confidence, text, created_at FROM pain_events ORDER BY created_at DESC LIMIT 100').all();
+                        // Degrade per missing column (review round 3): a missing host_kind
+                        // must not drop canonical_pain_id / runtime_task_id — the task join
+                        // runs through those, and losing them orphans evidence records.
+                        try {
+                            painEvents = trajDb.prepare('SELECT id, session_id, source, score, reason, severity, origin, confidence, text, created_at, canonical_pain_id, runtime_task_id, NULL AS host_kind FROM pain_events ORDER BY created_at DESC LIMIT 100').all();
+                        }
+                        catch (colErr2) {
+                            const colMessage2 = colErr2 instanceof Error ? colErr2.message : String(colErr2);
+                            if (colMessage2.includes('no such column')) {
+                                painEvents = trajDb.prepare('SELECT id, session_id, source, score, reason, severity, origin, confidence, text, created_at FROM pain_events ORDER BY created_at DESC LIMIT 100').all();
+                            }
+                            else {
+                                throw colErr2;
+                            }
+                        }
                     }
                     else {
                         throw colErr;

package/console/dist/server/routes/health.js

@@ -1,4 +1,5 @@
 import { HealthCheckModel } from '../models/HealthCheckModel.js';
+import { CodexGovernanceHealthModel } from '../models/CodexGovernanceHealthModel.js';
 import { sendSuccess, sendError } from '../utils/response.js';
 const MODEL_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
 const models = new Map();
@@ -11,6 +12,23 @@ function getModel(workspaceDir) {
     models.set(workspaceDir, { model, cachedAt: Date.now() });
     return model;
 }
+// PRI-625 Slice D (SPEC §15): Codex governance health comes from the ONE
+// authority — `pd health --host codex --json` — executed by the Console
+// model as a subprocess. Cached per workspace with the same TTL discipline
+// as the system health model. Keyed by workspace: the route can serve
+// multiple workspaces.
+const CODEX_WORKSPACE_CACHE_TTL_MS = MODEL_CACHE_TTL_MS;
+const codexModels = new Map();
+const codexCache = new Map();
+function getCodexModel(workspaceDir) {
+    const cached = codexModels.get(workspaceDir);
+    if (cached && Date.now() - cached.cachedAt < CODEX_WORKSPACE_CACHE_TTL_MS) {
+        return cached.model;
+    }
+    const model = new CodexGovernanceHealthModel(workspaceDir);
+    codexModels.set(workspaceDir, { model, cachedAt: Date.now() });
+    return model;
+}
 export async function handleHealthRoute(req, res, options) {
     if (req.method !== 'GET') {
         sendError(res, 405, 'method_not_allowed', 'Only GET method is allowed');
@@ -19,10 +37,46 @@ export async function handleHealthRoute(req, res, options) {
     const model = getModel(options.workspaceDir);
     try {
         const health = await model.checkSystemHealth();
-        sendSuccess(res, { ...health, authenticationMode: options.authenticationMode });
+        // Governance consistency (review round 2 + round 3): a codexGovernance
+        // collection failure is reported as status:'unknown' + ready:false +
+        // blockers — never omitted and never rendered as healthy (rc-9). The
+        // collect call has its OWN catch so a throwing model converts to the
+        // unknown block here instead of escaping to the system-health 500 path.
+        let codexGovernance;
+        const cached = codexCache.get(options.workspaceDir);
+        if (cached !== undefined && Date.now() - cached.cachedAt < CODEX_WORKSPACE_CACHE_TTL_MS) {
+            codexGovernance = cached.result;
+        }
+        else {
+            try {
+                const collected = await getCodexModel(options.workspaceDir).collect();
+                codexGovernance = collected.status === 'ok' ? collected.health : collected;
+                codexCache.set(options.workspaceDir, { result: codexGovernance, cachedAt: Date.now() });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message.slice(0, 200) : String(error);
+                codexGovernance = {
+                    status: 'unknown',
+                    ready: false,
+                    readyBlockers: [`health_collection_failed: ${message}`],
+                    reason: 'health_collection_failed',
+                    nextAction: 'Run `pd health --host codex --workspace <dir>` manually to see the structured reason.',
+                    productClaim: 'degraded',
+                };
+            }
+        }
+        sendSuccess(res, {
+            ...health,
+            authenticationMode: options.authenticationMode,
+            codexGovernance,
+        });
     }
-    catch (err) {
-        sendError(res, 500, 'health_check_error', err.message);
+    catch (error) {
+        // A SYSTEM-health failure (checkSystemHealth threw) is a different fact
+        // from a codexGovernance-block failure: it must keep the 500
+        // health_check_error contract so status-code-based probes and monitors do
+        // not read a broken system health as success (review round 3).
+        sendError(res, 500, 'health_check_error', error.message);
     }
 }
 export function disposeHealthModels() {
@@ -30,4 +84,6 @@ export function disposeHealthModels() {
         cached.model.dispose();
     }
     models.clear();
+    codexModels.clear();
+    codexCache.clear();
 }