create-principles-disciple 1.134.7 → 1.134.9

package/console/dist/server/routes/update-history.d.ts

@@ -1,4 +1,19 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
+/**
+ * PRI-702 (ADR-0024 D-7): which authority actually performed the mutation.
+ *
+ * The vocabulary is REUSED from the MutationController — the one place that
+ * already names mutation authorities — so the history stream can never drift
+ * into a second authority vocabulary. `legacy-migration` is deliberately not
+ * listed: it writes the separate SPEC §12 stream (`<pdHome>/logs/history.jsonl`)
+ * and must not be conflated with this Owner-facing one.
+ *
+ * The field is additive and optional. Records written before PRI-702 have no
+ * `authority`; they are kept verbatim (no migration) and the reader never
+ * fabricates a value for them.
+ */
+export declare const UPDATE_HISTORY_AUTHORITIES: readonly ["release-manager", "legacy-console-updater"];
+export type UpdateHistoryAuthority = (typeof UPDATE_HISTORY_AUTHORITIES)[number];
 export declare const UPDATE_HISTORY_KINDS: readonly ['update', 'reinstall', 'legacy_migration', 'rollback', 'refusal', 'failure', 'recovery', 'unknown'];
 export type UpdateHistoryKind = (typeof UPDATE_HISTORY_KINDS)[number];
 interface UpdateHistoryEntry {
@@ -11,7 +26,29 @@ interface UpdateHistoryEntry {
     backupPath?: string;
     reason?: string;
     nextAction?: string;
+    /** PRI-702: authority that performed the mutation. Absent on pre-PRI-702 records. */
+    authority?: UpdateHistoryAuthority;
+    /**
+     * PRI-702: the transaction journal id of the update, when one exists.
+     * Correlates the Owner-facing event with the machine-recovery stream
+     * (`~/.pd/transactions/<transactionId>.jsonl`) — the two stay separate
+     * structures (ADR-0024 §2.5-2); this is a pointer, not a copy.
+     */
+    transactionId?: string;
 }
+/**
+ * PRI-702 (ADR-0024 D-7): the ONE Owner-facing update-history writer.
+ *
+ * Both mutation authorities append through this function — the legacy console
+ * updater (every existing call site in `routes/update.ts`) and the
+ * ReleaseManager-served apply-full dispatch. There is no second writer and no
+ * authority-specific schema: callers differ only in the `authority` they pass.
+ *
+ * `authority` defaults to `legacy-console-updater` because that is the writer
+ * that has owned this stream since before PRI-702; a caller that omits it is
+ * by definition the legacy path. Every entry written from now on carries the
+ * field explicitly, so PRI-701's legacy-usage census can read it directly.
+ */
 export declare function appendUpdateHistory(workspaceDir: string, entry: Omit<UpdateHistoryEntry, 'id' | 'timestamp'>): void;
 export declare function handleUpdateHistoryRoute(req: IncomingMessage, res: ServerResponse, workspaceDir: string, _subPath: string): Promise<void>;
 export {};

package/console/dist/server/routes/update-history.js

@@ -1,6 +1,24 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { sendSuccess, sendMethodNotAllowed } from '../utils/response.js';
+import { LEGACY_MUTATION_AUTHORITY, RELEASE_MANAGER_AUTHORITY, } from '../update/mutation-controller.js';
+/**
+ * PRI-702 (ADR-0024 D-7): which authority actually performed the mutation.
+ *
+ * The vocabulary is REUSED from the MutationController — the one place that
+ * already names mutation authorities — so the history stream can never drift
+ * into a second authority vocabulary. `legacy-migration` is deliberately not
+ * listed: it writes the separate SPEC §12 stream (`<pdHome>/logs/history.jsonl`)
+ * and must not be conflated with this Owner-facing one.
+ *
+ * The field is additive and optional. Records written before PRI-702 have no
+ * `authority`; they are kept verbatim (no migration) and the reader never
+ * fabricates a value for them.
+ */
+export const UPDATE_HISTORY_AUTHORITIES = [
+    RELEASE_MANAGER_AUTHORITY,
+    LEGACY_MUTATION_AUTHORITY,
+];
 export const UPDATE_HISTORY_KINDS = [
     'update',
     'reinstall',
@@ -14,6 +32,9 @@ export const UPDATE_HISTORY_KINDS = [
 function isHistoryKind(value) {
     return typeof value === 'string' && UPDATE_HISTORY_KINDS.includes(value);
 }
+function isHistoryAuthority(value) {
+    return typeof value === 'string' && UPDATE_HISTORY_AUTHORITIES.includes(value);
+}
 function parseHistoryEntry(value) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         return undefined;
@@ -32,6 +53,8 @@ function parseHistoryEntry(value) {
         return undefined;
     if (raw.backupPath !== undefined && typeof raw.backupPath !== 'string')
         return undefined;
+    if (raw.transactionId !== undefined && typeof raw.transactionId !== 'string')
+        return undefined;
     return {
         id: raw.id,
         timestamp: raw.timestamp,
@@ -45,6 +68,11 @@ function parseHistoryEntry(value) {
         ...(typeof raw.backupPath === 'string' ? { backupPath: raw.backupPath } : {}),
         ...(typeof raw.reason === 'string' ? { reason: raw.reason } : {}),
         ...(typeof raw.nextAction === 'string' ? { nextAction: raw.nextAction } : {}),
+        // An authority outside the closed vocabulary is dropped rather than
+        // failing the whole entry: this stream is an Owner read model, and one
+        // unknown writer must not hide every other record (rc-3).
+        ...(isHistoryAuthority(raw.authority) ? { authority: raw.authority } : {}),
+        ...(typeof raw.transactionId === 'string' ? { transactionId: raw.transactionId } : {}),
     };
 }
 function getHistoryPath(workspaceDir) {
@@ -68,11 +96,25 @@ function loadHistory(historyPath) {
     }
     return [];
 }
+/**
+ * PRI-702 (ADR-0024 D-7): the ONE Owner-facing update-history writer.
+ *
+ * Both mutation authorities append through this function — the legacy console
+ * updater (every existing call site in `routes/update.ts`) and the
+ * ReleaseManager-served apply-full dispatch. There is no second writer and no
+ * authority-specific schema: callers differ only in the `authority` they pass.
+ *
+ * `authority` defaults to `legacy-console-updater` because that is the writer
+ * that has owned this stream since before PRI-702; a caller that omits it is
+ * by definition the legacy path. Every entry written from now on carries the
+ * field explicitly, so PRI-701's legacy-usage census can read it directly.
+ */
 export function appendUpdateHistory(workspaceDir, entry) {
     const historyPath = getHistoryPath(workspaceDir);
     const history = loadHistory(historyPath);
     history.push({
         ...entry,
+        authority: entry.authority ?? LEGACY_MUTATION_AUTHORITY,
         id: `update-${Date.now()}`,
         timestamp: new Date().toISOString(),
     });

package/console/dist/server/routes/update.js

@@ -1921,7 +1921,31 @@ async function runReleaseManagerCheckDispatch(mod, req, res, ctx) {
  * layer maps the outcome into the legacy doInlineFullUpdate response contract
  * ({success, message, reason?, nextAction?, newVersion?, requiresRestart}) —
  * wire contract unchanged. It performs NO runtime mutation itself.
+ *
+ * PRI-702 (ADR-0024 D-7): this boundary is also where the Owner-facing update
+ * history is appended for an RM-served update, through the SAME
+ * `appendUpdateHistory` writer the legacy updater uses. It is the only layer
+ * that knows all three of the workspace (where the history lives), the
+ * authority that served the mutation, and the final outcome — the installer
+ * writes the transaction journal only, and a pre-transaction refusal writes
+ * NO history event (the fallback's legacy event is the single record, see
+ * `X-PD-Mutation-Fallback-Reason`).
+ */
+/**
+ * A history-write failure must never misreport a mutation that already
+ * happened: the response still carries the true outcome (same policy as
+ * `logLegacyJournalGap` above — blocking the Owner's update would be worse
+ * than an unaudited one) but the audit gap is logged loud (rc-9).
  */
+function appendGovernedUpdateHistory(workspaceDir, entry) {
+    try {
+        appendUpdateHistory(workspaceDir, entry);
+    }
+    catch (error) {
+        console.error(`[update] ReleaseManager-served mutation completed WITHOUT an update-history record (${error instanceof Error ? error.message : String(error)}). `
+            + 'ADR-0024 D-7 requires every update to be auditable; the response still reports the real outcome.');
+    }
+}
 async function runReleaseManagerApplyFullDispatch(mod, req, res, ctx) {
     if (req.method !== 'POST') {
         sendMethodNotAllowed(res);
@@ -1951,9 +1975,26 @@ async function runReleaseManagerApplyFullDispatch(mod, req, res, ctx) {
         await legacyApplyFullMutation(req, res, ctx);
         return;
     }
+    // PRI-702 (ADR-0024 D-7): the pre-apply version, read from the SAME install
+    // state the ReleaseManager used to decide the update (active.json) — never
+    // from a second version source.
+    const fromVersion = authority.installStatus?.productVersion ?? 'unknown';
     try {
         const outcome = await authority.manager.apply({ workspaceDir: ctx.workspaceDir });
         if (outcome.kind === 'applied') {
+            // One update → one Owner-visible history event. The Console boundary is
+            // the only layer that owns workspaceDir + authority + outcome together,
+            // so the canonical writer is called here; the installer and the
+            // ReleaseManager keep writing the transaction journal only (journal =
+            // machine recovery, history = Owner audit, ADR-0024 §2.5-2).
+            appendGovernedUpdateHistory(ctx.workspaceDir, {
+                fromVersion,
+                toVersion: outcome.productVersion,
+                success: true,
+                kind: 'update',
+                authority: RELEASE_MANAGER_AUTHORITY,
+                transactionId: outcome.transactionId,
+            });
             sendSuccess(res, {
                 success: true,
                 message: `Updated to ${outcome.productVersion}. Transaction ${outcome.transactionId} confirmed in the journal.`,
@@ -1963,6 +2004,19 @@ async function runReleaseManagerApplyFullDispatch(mod, req, res, ctx) {
             });
         }
         else {
+            // Legacy parity: the legacy updater records a `refusal` event when the
+            // source does not advance the installation, so an RM-served "no update"
+            // leaves the same trace instead of silence. No runtime byte changed —
+            // toVersion stays at the installed version.
+            appendGovernedUpdateHistory(ctx.workspaceDir, {
+                fromVersion,
+                toVersion: fromVersion,
+                success: false,
+                kind: 'refusal',
+                reason: outcome.note,
+                nextAction: 'No runtime change was made. Retry when a newer signed release is published.',
+                authority: RELEASE_MANAGER_AUTHORITY,
+            });
             sendSuccess(res, {
                 success: true,
                 message: `No update applied: ${outcome.note}`,
@@ -1986,6 +2040,19 @@ async function runReleaseManagerApplyFullDispatch(mod, req, res, ctx) {
             await legacyApplyFullMutation(req, res, ctx);
             return;
         }
+        // PRI-702: a post-transaction failure is a real, terminal update attempt,
+        // so it gets exactly one failure event under the ReleaseManager authority.
+        // There is no legacy fallback on this path, hence no second event — the
+        // runtime is left on the previous release (installer backup/restore).
+        appendGovernedUpdateHistory(ctx.workspaceDir, {
+            fromVersion,
+            toVersion: 'failed',
+            success: false,
+            kind: 'failure',
+            reason: mapped.reason,
+            nextAction: mapped.nextAction ?? 'The runtime is unchanged. Retry the update after resolving the cause.',
+            authority: RELEASE_MANAGER_AUTHORITY,
+        });
         sendSuccess(res, {
             success: false,
             message: mapped.message,

package/console/dist/server/utils/installed-layout.d.ts

@@ -10,10 +10,12 @@ export interface UpdateLayout {
     releaseManagerDir: string;
     /**
      * PRI-711: codex-adapter is a runtime-layout component pd-cli resolves
-     * eagerly. Undefined when the DEPLOYED @principles/install-layout is one
-     * generation old (this update runs inside the currently-running console,
-     * which resolves the layout helper installed by the PREVIOUS update) —
-     * consumers must degrade to skipping the adapter, never assume it.
+     * eagerly. Undefined only when the canonical runtime root itself cannot be
+     * resolved: a one-generation-old deployed install-layout (this update runs
+     * inside the currently-running console, which resolves the layout helper
+     * installed by the PREVIOUS update) lacks the codexAdapterDir field, but
+     * PRI-724 derives the destination from the stable runtimeDir instead of
+     * degrading to a silent skip.
      */
     codexAdapterDir: string | undefined;
     hosts: InstallHost[];

package/console/dist/server/utils/installed-layout.js

@@ -18,6 +18,29 @@ import { resolveOpenClawHome } from './pd-backups.js';
 export function resolveExtensionsDir() {
     return path.join(resolveOpenClawHome(), 'extensions');
 }
+/**
+ * Resolve where the codex-adapter component lives in a CANONICAL layout.
+ *
+ * PRI-724: a one-generation-old deployed install-layout does not export the
+ * codexAdapterDir field (introduced 2026-09-09, PRI-711). The full update
+ * runs inside the currently-running console, which resolves the layout
+ * helper installed by the PREVIOUS update — so during exactly one update
+ * generation the field is always missing. Derive the destination from the
+ * stable runtimeDir (the adapter has always been installed at
+ * <runtimeDir>/codex-adapter) instead of degrading the update to skipping
+ * the adapter copy, which left the deployed adapter one release behind
+ * while the update reported success (observed 2026-09-10).
+ */
+function resolveCanonicalCodexAdapterDir(paths) {
+    if (typeof paths.codexAdapterDir === 'string' && paths.codexAdapterDir.length > 0) {
+        return paths.codexAdapterDir;
+    }
+    // rc-1/rc-2: the deployed module's shape is not trusted — only derive from
+    // a runtimeDir that is actually a non-empty string.
+    return typeof paths.runtimeDir === 'string' && paths.runtimeDir.length > 0
+        ? path.join(paths.runtimeDir, 'codex-adapter')
+        : undefined;
+}
 export function resolveUpdateLayout() {
     const homeDir = os.homedir();
     const paths = getInstallLayoutPaths(homeDir);
@@ -46,9 +69,11 @@ export function resolveUpdateLayout() {
             pdCliDir: paths.pdCliDir,
             installLayoutDir: paths.installLayoutDir,
             releaseManagerDir: paths.releaseManagerDir,
-            // rc-1: the deployed install-layout may predate the codexAdapterDir
-            // field — guard instead of trusting the shape.
-            codexAdapterDir: typeof paths.codexAdapterDir === 'string' ? paths.codexAdapterDir : undefined,
+            // PRI-711: the deployed install-layout may predate the codexAdapterDir
+            // field — guard instead of trusting the shape. PRI-724: when the field
+            // is missing, derive the destination from runtimeDir so the update
+            // still swaps the adapter (see resolveCanonicalCodexAdapterDir).
+            codexAdapterDir: resolveCanonicalCodexAdapterDir(paths),
             hosts: resolution.manifest?.hosts ?? [],
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.134.7",
+  "version": "1.134.9",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {

package/release-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.134.7",
+  "version": "1.134.9",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {