create-principles-disciple 1.144.12 → 1.144.14

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
   "productVersion": "2.2.0",
-  "sourceCommit": "332de78574839e4970145fc34617ed4b8abf743a"
+  "sourceCommit": "f3ae780daf77b0c88d1c979603e83ddd9046b2b2"
 }

package/codex-adapter/dist/pd-hook.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { readFileSync, realpathSync } from 'node:fs';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import { pathToFileURL, fileURLToPath } from 'node:url';
@@ -195,11 +196,27 @@ export async function processHookInvocation(rawStdin, _env = process.env, cwd =
         const nextAction = error instanceof CodexDecoderError ? error.nextAction : 'Inspect the Codex 0.147 hook payload.';
         return { stdout: {}, exitCode: 0, stderr: [diagnostic(reason, nextAction)] };
     }
-    // Codex 0.147 supplies the invocation cwd. It is the authoritative starting
-    // point; a process-global environment variable can otherwise route one
-    // Workspace's hook into another Workspace's business state.
+    // Initializing the user workspace explicitly opts Codex into shared
+    // governance. Otherwise preserve the existing per-project resolution.
     const requestedCwd = event.context.workspaceDir || cwd;
-    const resolution = resolveNearestPdWorkspace(requestedCwd);
+    if (!path.isAbsolute(requestedCwd))
+        return { stdout: {}, exitCode: 0, stderr: [diagnostic('cwd_not_absolute', 'Provide the absolute Codex project directory.')] };
+    // Resolve like pd-locate.cjs does: a relative CODEX_HOME must yield the same
+    // absolute workspace for hooks and owner scripts, or resolveNearestPdWorkspace
+    // rejects it after the config check already accepted it.
+    const userWorkspace = path.join(path.resolve(_env.CODEX_HOME || path.join(os.homedir(), '.codex')), 'pd-workspace');
+    let userWorkspaceInitialized = false;
+    try {
+        userWorkspaceInitialized = statSync(path.join(userWorkspace, '.pd', 'config.yaml')).isFile();
+        if (!userWorkspaceInitialized)
+            return { stdout: {}, exitCode: 0, stderr: [diagnostic('user_workspace_config_invalid', 'Repair the user workspace .pd/config.yaml; project configuration was not used.')] };
+    }
+    catch (error) {
+        if (!(error instanceof Error && Object.hasOwn(error, 'code') && Reflect.get(error, 'code') === 'ENOENT')) {
+            return { stdout: {}, exitCode: 0, stderr: [diagnostic('user_workspace_config_unreadable', 'Restore access to the user workspace .pd/config.yaml; project configuration was not used.')] };
+        }
+    }
+    const resolution = resolveNearestPdWorkspace(userWorkspaceInitialized ? userWorkspace : requestedCwd);
     if (!resolution.ok)
         return { stdout: {}, exitCode: 0, stderr: [diagnostic(resolution.reason, resolution.nextAction)] };
     event = { ...event, context: { ...event.context, workspaceDir: resolution.workspaceDir } };
@@ -242,6 +259,7 @@ export async function processHookInvocation(rawStdin, _env = process.env, cwd =
         // the Codex adapter stays independent of the OpenClaw plugin). The line
         // writer appends synchronously — no flush/dispose needed for the subprocess.
         const result = await createProductionHostRuntime({
+            projectDir: requestedCwd,
             hostKind: 'codex',
             toolSemantics: CODEX_TOOL_SEMANTICS,
             events: codexEventEmitter(path.join(resolution.workspaceDir, '.state')),

package/codex-adapter/dist/worker/workspace-worker.d.ts

@@ -13,6 +13,12 @@ export interface CodexWorkerCycleStepReport {
         readonly errorCategory?: string;
         /** PRI-638 P1-C: recovery action for capability-disabled pauses. */
         readonly nextAction?: string;
+        /**
+         * PRI-917 v0.3.3 review fix (P2-2): candidates parked by the Reuse Review
+         * Gate (suspected duplicates awaiting the Owner). Forwarded per-candidate
+         * so the report shows WHAT awaits the Owner, not just a degraded status.
+         */
+        readonly reuseReviewRequiredCandidateIds?: readonly string[];
     } | null;
     readonly downstream: InternalizationConsumerCycleOutcome | null;
 }

package/codex-adapter/dist/worker/workspace-worker.js

@@ -156,11 +156,18 @@ export async function runCodexWorkspaceWorkerCycle(options) {
                         getEnvVar: (name) => process.env[name],
                     });
                     const executed = await bridge.executePendingDiagnosis({ taskId: candidate.taskId });
+                    // PRI-917 v0.3.3 review fix (P2-2): forward the parked-candidate
+                    // dispositions so the Owner sees the pending items instead of a bare
+                    // degraded status with no subject.
+                    const reuseReviewRequired = (executed.candidateOutcomes ?? [])
+                        .filter((outcome) => outcome.reason === 'reuse_review_required')
+                        .map((outcome) => outcome.candidateId);
                     diagnostician = {
                         taskId: candidate.taskId,
                         status: executed.status,
                         ...(executed.message !== undefined ? { message: executed.message.slice(0, 200) } : {}),
                         ...(executed.errorCategory !== undefined ? { errorCategory: executed.errorCategory } : {}),
+                        ...(reuseReviewRequired.length > 0 ? { reuseReviewRequiredCandidateIds: reuseReviewRequired } : {}),
                     };
                     // The bridge stays cached per workspace (bounded: one per workspace
                     // per worker process, exactly like the OpenClaw plugin host) — no

package/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/codex-adapter",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "Codex CLI host adapter for Principles Disciple — implements HostAdapter interface for OpenAI Codex CLI's stdin/stdout JSON hook model (ADR-0020).",
   "type": "module",
   "main": "./dist/index.js",

package/console/dist/server/models/ApprovalsGroupedConsoleModel.d.ts

@@ -15,6 +15,15 @@ export interface ApprovalGroup {
      * (the client has no access to the escaped, serialized size).
      */
     fitsPromptBudget?: boolean;
+    /**
+     * PRI-940: the pinned artifact no longer exists in pi_artifacts (typically
+     * superseded by a newer scribe revision). There is no contentJson, so
+     * `candidateDescription` is unavailable and `principleTitle` degrades to the
+     * synthesized `unlinked:<artifactId>` grouping key — a machine id that must
+     * never be rendered as a title. Absent when the artifact is readable. rc-9:
+     * the UI shows a visible degradation note instead of going silently blank.
+     */
+    artifactUnavailable?: boolean;
     records: {
         id: string;
         artifactId: string;

package/console/dist/server/models/ApprovalsGroupedConsoleModel.js

@@ -170,6 +170,10 @@ export class ApprovalsGroupedConsoleModel {
             // the pre-approval badge never promises rotation for an entry that is
             // oversized (rotation cannot rescue a per-entry overflow).
             const artifactFitsBudgetMap = new Map();
+            // PRI-940: which approval artifacts are MISSING from the store (superseded
+            // or pruned) — those cards have no contentJson, so the UI must degrade
+            // visibly instead of rendering the `unlinked:` machine id as a title.
+            const artifactUnavailableMap = new Map();
             const stateDir = path.join(this.workspaceDir, '.state');
             const resolutionDeps = createArtifactPrincipleResolutionDeps(conn, artifactStore, this.workspaceDir);
             for (const approval of allApprovals) {
@@ -185,12 +189,14 @@ export class ApprovalsGroupedConsoleModel {
                             artifactDescriptionMap.set(approval.artifactId, null);
                         }
                         artifactFitsBudgetMap.set(approval.artifactId, candidateFitsPromptBudget(artifact));
+                        artifactUnavailableMap.set(approval.artifactId, artifact === null);
                     }
                     catch (err) {
                         if (isMissingTableError(err)) {
                             artifactPrincipleMap.set(approval.artifactId, null);
                             artifactDescriptionMap.set(approval.artifactId, null);
                             artifactFitsBudgetMap.set(approval.artifactId, false);
+                            artifactUnavailableMap.set(approval.artifactId, true);
                         }
                         else {
                             throw err;
@@ -258,6 +264,12 @@ export class ApprovalsGroupedConsoleModel {
                     ...(firstArtifactId !== undefined && artifactFitsBudgetMap.has(firstArtifactId)
                         ? { fitsPromptBudget: artifactFitsBudgetMap.get(firstArtifactId) === true }
                         : {}),
+                    // PRI-940: absent when the pinned artifact is readable — same
+                    // spread style as fitsPromptBudget so the wire contract stays
+                    // unchanged for healthy cards.
+                    ...(firstArtifactId !== undefined && artifactUnavailableMap.get(firstArtifactId) === true
+                        ? { artifactUnavailable: true }
+                        : {}),
                     records,
                 });
             }

package/console/dist/ui/i18n/en.json

@@ -96,6 +96,7 @@
             "deviationCount": "deviation(s)",
             "evidenceSummary": "Evidence: {{count}} record(s)",
             "untitledCandidate": "Untitled candidate principle",
+            "artifactUnavailableNote": "The draft artifact this approval points to is no longer in the artifact store (likely superseded by a newer revision), so its content cannot be shown. If in doubt, reject it; the raw artifact ID is shown in the edit section's current-artifact field.",
             "approveAction": "Approve",
             "rejectAction": "Reject",
             "editAction": "Edit",

package/console/dist/ui/i18n/zh-CN.json

@@ -96,6 +96,7 @@
             "deviationCount": "条偏差",
             "evidenceSummary": "证据：{{count}} 条记录",
             "untitledCandidate": "待命名候选原则",
+            "artifactUnavailableNote": "该审批指向的草稿原件已不在工件库中（可能已被新版本取代），内容无法显示。如无法判断，可选择拒绝；原始工件编号可点「编辑」后在「当前工件」一栏查看。",
             "approveAction": "批准",
             "rejectAction": "拒绝",
             "editAction": "编辑",

package/console/dist/ui/pages/focus/FocusPage.js

@@ -9,7 +9,7 @@ import { SectionTitle } from "../../components/layout/section-title.js";
 import { DailyThoughtCard } from "../../components/focus/daily-thought-card.js";
 import { ShinyText } from "../../components/ui/shiny-text.js";
 import { fetchGovernanceQueue, fetchApprovalsGrouped, approveApproval, rejectApproval, editApproval, fetchAllActivations, fetchOwnerDecisions, } from "../../api.js";
-import { validateApprovalsGroupedData } from "./focus-validation.js";
+import { selectApprovalGroupDisplayTitle, validateApprovalsGroupedData } from "./focus-validation.js";
 import { OwnerDecisionCard } from "./OwnerDecisionCard.js";
 import { localizeApprovalWarning, splitApprovalWarnings } from "../../utils/approval-warning-localization.js";
 /** PRI-908: how long the decided card stays visible before the pending list refresh removes it. */
@@ -178,8 +178,11 @@ function PendingReviewCard({ group, actionsLockedReason, onDecisionApplied, prom
     }
     // Display title: prefer candidateDescription (human-readable) over principleTitle
     // (which falls back to a fabricated principleId when the principle isn't in ledger).
-    const displayTitle = group.candidateDescription
-        ?? group.principleTitle
+    // PRI-940: the selection rule lives in focus-validation (contract-tested) —
+    // when the pinned artifact is missing, principleTitle IS the machine id
+    // (`unlinked:<artifactId>`) and must fall through to the untitled copy; the
+    // degradation note below explains why there is no content.
+    const displayTitle = selectApprovalGroupDisplayTitle(group)
         ?? t("pages.focus.untitledCandidate", { defaultValue: "待命名候选原则" });
     async function applyDecisionToAllRecords(action, reason) {
         // Only process pending records — skip already-approved/rejected to avoid
@@ -306,7 +309,7 @@ function PendingReviewCard({ group, actionsLockedReason, onDecisionApplied, prom
                     ? "border-green/40 bg-green/10 text-green"
                     : "border-line bg-surface/80 text-ink-3"}`, role: "status", "data-testid": `decided-banner-${group.principleId}`, children: decidedOutcome === "approved"
                     ? t("pages.focus.decidedApproved", { defaultValue: "已批准 ✓ 正在写入生效记录…" })
-                    : t("pages.focus.decidedRejected", { defaultValue: "已拒绝" }) })), _jsxs("div", { className: "flex items-center gap-2 flex-wrap", children: [_jsx("span", { className: "inline-flex items-center border border-line rounded-[2px] px-[7px] py-1 font-mono text-[11px] text-ink-3 bg-surface/80 uppercase", children: channelLabel }), isReversible && (_jsx("span", { className: "inline-flex items-center border border-amber/35 text-amber rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: primaryChannel === "prompt" ? t("pages.focus.tagReversible") : t("pages.focus.tagLowRisk") }))] }), _jsx("div", { className: "mt-[14px] mb-2 font-semibold text-ink leading-snug", children: displayTitle }), _jsx("div", { className: "mt-2 px-3 py-2 bg-surface/60 border-l-2 border-gov text-ink-3 text-[13px] leading-snug", children: t("pages.focus.evidenceSummary", { count: group.records.length }) }), actionsLocked && (_jsxs("div", { className: "mt-3 rounded-[3px] border border-amber/40 bg-amber/5 p-3", "data-testid": `pending-actions-locked-${group.principleId}`, children: [_jsx("p", { className: "text-ink-2 text-[12.5px] leading-relaxed", children: actionsLockedReason }), _jsx(Link, { to: "/settings", "data-testid": `pending-actions-locked-settings-${group.principleId}`, className: "mt-2 inline-flex items-center border border-line text-ink bg-surface rounded-[3px] px-[14px] py-[6px] text-[12.5px] hover:border-line-2 transition-colors", children: t("pages.focus.ownerDecision.goSettingsCta") })] })), decidedOutcome === null && primaryChannel === "prompt" && promptInjection?.truncated === true && (_jsx("div", { className: "mt-3 rounded-[3px] border border-amber/40 bg-amber/5 px-3 py-2 text-[12.5px] text-amber", "data-testid": `approve-queue-badge-${group.principleId}`, children: promptInjection.productionRotates === true && group.fitsPromptBudget === true
+                    : t("pages.focus.decidedRejected", { defaultValue: "已拒绝" }) })), _jsxs("div", { className: "flex items-center gap-2 flex-wrap", children: [_jsx("span", { className: "inline-flex items-center border border-line rounded-[2px] px-[7px] py-1 font-mono text-[11px] text-ink-3 bg-surface/80 uppercase", children: channelLabel }), isReversible && (_jsx("span", { className: "inline-flex items-center border border-amber/35 text-amber rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: primaryChannel === "prompt" ? t("pages.focus.tagReversible") : t("pages.focus.tagLowRisk") }))] }), _jsx("div", { className: "mt-[14px] mb-2 font-semibold text-ink leading-snug", children: displayTitle }), group.artifactUnavailable === true && (_jsx("div", { className: "mb-2 text-[12.5px] leading-relaxed text-amber", "data-testid": `artifact-unavailable-${group.principleId}`, children: t("pages.focus.artifactUnavailableNote") })), _jsx("div", { className: "mt-2 px-3 py-2 bg-surface/60 border-l-2 border-gov text-ink-3 text-[13px] leading-snug", children: t("pages.focus.evidenceSummary", { count: group.records.length }) }), actionsLocked && (_jsxs("div", { className: "mt-3 rounded-[3px] border border-amber/40 bg-amber/5 p-3", "data-testid": `pending-actions-locked-${group.principleId}`, children: [_jsx("p", { className: "text-ink-2 text-[12.5px] leading-relaxed", children: actionsLockedReason }), _jsx(Link, { to: "/settings", "data-testid": `pending-actions-locked-settings-${group.principleId}`, className: "mt-2 inline-flex items-center border border-line text-ink bg-surface rounded-[3px] px-[14px] py-[6px] text-[12.5px] hover:border-line-2 transition-colors", children: t("pages.focus.ownerDecision.goSettingsCta") })] })), decidedOutcome === null && primaryChannel === "prompt" && promptInjection?.truncated === true && (_jsx("div", { className: "mt-3 rounded-[3px] border border-amber/40 bg-amber/5 px-3 py-2 text-[12.5px] text-amber", "data-testid": `approve-queue-badge-${group.principleId}`, children: promptInjection.productionRotates === true && group.fitsPromptBudget === true
                     ? t("pages.focus.approveQueueBadgeRotation", {
                         defaultValue: "批准后可能排队：提示词注入位已满（{{used}}/{{budget}} 字符）。当前按公平轮转选取，新原则会在后续轮次自行轮到，无需停用旧原则。",
                         used: promptInjection.usedChars,

package/console/dist/ui/pages/focus/focus-validation.d.ts

@@ -4,5 +4,16 @@
  * kept separate from ui/utils/validators.ts because the page additionally
  * enforces the pending/approved/rejected status whitelist it renders on.
  */
-import type { ApprovalsGroupedData } from "../../api.js";
+import type { ApprovalsGroupedData, ApprovalGroup } from "../../api.js";
 export declare function validateApprovalsGroupedData(raw: unknown): ApprovalsGroupedData | null;
+/**
+ * PRI-940: which string may the pending-review card render as its title.
+ *
+ * `principleTitle` degrades to the synthesized `unlinked:<artifactId>` grouping
+ * key when the pinned artifact is missing — a machine id that must never reach
+ * the Owner as a title (real case: an approval pinned to a superseded scribe
+ * revision rendered `unlinked:pi-art-scribe-…` on the card). Returns undefined
+ * for that case so the caller falls back to the localized untitled copy; the
+ * degradation itself is explained by the artifactUnavailable note, not here.
+ */
+export declare function selectApprovalGroupDisplayTitle(group: Pick<ApprovalGroup, "candidateDescription" | "principleTitle" | "artifactUnavailable">): string | undefined;

package/console/dist/ui/pages/focus/focus-validation.js

@@ -64,12 +64,23 @@ function validateApprovalGroup(raw) {
             return null;
         fitsPromptBudget = fits;
     }
+    // PRI-940: artifactUnavailable is optional. ERR-009 discipline — present but
+    // wrong type fails loud (return null); absent stays undefined, which keeps
+    // the card title rendering exactly as before.
+    let artifactUnavailable;
+    if (Object.hasOwn(raw, "artifactUnavailable")) {
+        const { artifactUnavailable: unavailable } = raw;
+        if (typeof unavailable !== "boolean")
+            return null;
+        artifactUnavailable = unavailable;
+    }
     return {
         principleId,
         principleTitle,
         candidateDescription,
         status,
         fitsPromptBudget,
+        artifactUnavailable,
         records: validRecords,
     };
 }
@@ -101,3 +112,21 @@ export function validateApprovalsGroupedData(raw) {
         promptInjection: validatePromptInjectionBudgetStatus(raw.promptInjection) ?? undefined,
     };
 }
+/**
+ * PRI-940: which string may the pending-review card render as its title.
+ *
+ * `principleTitle` degrades to the synthesized `unlinked:<artifactId>` grouping
+ * key when the pinned artifact is missing — a machine id that must never reach
+ * the Owner as a title (real case: an approval pinned to a superseded scribe
+ * revision rendered `unlinked:pi-art-scribe-…` on the card). Returns undefined
+ * for that case so the caller falls back to the localized untitled copy; the
+ * degradation itself is explained by the artifactUnavailable note, not here.
+ */
+export function selectApprovalGroupDisplayTitle(group) {
+    if (group.candidateDescription !== undefined && group.candidateDescription !== "") {
+        return group.candidateDescription;
+    }
+    if (group.artifactUnavailable === true)
+        return undefined;
+    return group.principleTitle;
+}

package/console/dist/ui/utils/validators.d.ts

@@ -642,6 +642,12 @@ export interface ApprovalGroupData {
      * "do not promise rotation".
      */
     fitsPromptBudget?: boolean;
+    /**
+     * PRI-940: the pinned artifact is missing from the store, so the card has no
+     * human-readable payload and `principleTitle` carries the synthesized
+     * `unlinked:<artifactId>` machine id, which must never render as a title.
+     */
+    artifactUnavailable?: boolean;
     status: string;
     records: ApprovalGroupRecordData[];
 }

package/console/dist/ui/utils/validators.js

@@ -1652,6 +1652,12 @@ function validateApprovalGroup(v) {
     if (Object.hasOwn(v, 'fitsPromptBudget') && typeof v.fitsPromptBudget === 'boolean') {
         result.fitsPromptBudget = v.fitsPromptBudget;
     }
+    // PRI-940: optional artifactUnavailable. Only a real boolean is propagated; a
+    // present-but-wrong value is dropped so the card keeps its plain untitled
+    // fallback rather than rendering an unverified claim.
+    if (Object.hasOwn(v, 'artifactUnavailable') && typeof v.artifactUnavailable === 'boolean') {
+        result.artifactUnavailable = v.artifactUnavailable;
+    }
     return result;
 }
 export function validatePromptInjectionBudgetStatus(v) {