create-principles-disciple 1.144.20 → 1.144.22

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
-  "productVersion": "2.2.2",
-  "sourceCommit": "7afed455e39d5062c2febcf0bc319db123453105"
+  "productVersion": "2.3.0",
+  "sourceCommit": "693e91ab726949844986dcbc2adaa27a5ef53a31"
 }

package/codex-adapter/dist/codex-evidence-recorder.d.ts

@@ -0,0 +1,56 @@
+import type { InterventionCapabilityDeclaration } from '@principles/core/runtime-v2';
+/** Evidence adapter surface version (major-series label; exact package version lives in package.json). */
+export declare const CODEX_EVIDENCE_ADAPTER_VERSION = "codex-adapter@2";
+export type EvidenceWarn = (diagnosticLine: string) => void;
+/**
+ * Codex capability matrix (SPEC §13.6) — declared, never inferred from
+ * record absence. 'supported' requires a proof note; Unknown is an honest
+ * state, not a failure (ADR-0027 §2.4).
+ */
+export declare function codexCapabilityDeclarations(): InterventionCapabilityDeclaration[];
+export interface CodexPromptDeliveryEvidenceInput {
+    workspaceDir: string;
+    sessionId: string;
+    /** Codex turn_id as carried by the injected-event runId (optional). */
+    turnId?: string;
+    /** Index-aligned per-principle injection facts from the injected event. */
+    injected: readonly {
+        principleId: string;
+        activationId: string;
+        artifactId?: string;
+    }[];
+    evidenceEnabled: boolean;
+    warn: EvidenceWarn;
+}
+/**
+ * Record one agent-context delivery attempt per injected principle after the
+ * raw injected-event line has been appended to the durable Codex event log —
+ * confirmation 'submitted', outcome 'attempted'.
+ */
+export declare function recordCodexPromptDeliveryEvidence(input: CodexPromptDeliveryEvidenceInput): void;
+export interface CodexDenyEvidenceInput {
+    workspaceDir: string;
+    sessionId?: string;
+    toolUseId?: string;
+    toolName: string;
+    activationId?: string;
+    principleId?: string;
+    ruleId?: string;
+    reason?: string;
+    evidenceEnabled: boolean;
+    warn: EvidenceWarn;
+}
+/**
+ * Record the enforcement chain for an ATTRIBUTED deny that was successfully
+ * encoded to the Codex stdout channel. The proof boundary is the encoded
+ * permissionDecision — PD does not claim the host executed anything broader.
+ * Currently dormant while v2 rule enforcement is suspended (PRI-780), but
+ * wired so an attributed deny is recorded honestly if one ever occurs.
+ *
+ * Episode identity requires the per-call toolUseId. Without it the chain is
+ * skipped: a hash fallback would mint an episode with NO native event key,
+ * which the normalizer rejects (episode_requires_native_event_key) and drops
+ * the WHOLE batch. (Codex deny episodes only ever carry toolCallId — unlike
+ * OpenClaw they never see a runId — so there is no legitimate fallback here.)
+ */
+export declare function recordCodexDenyEvidence(input: CodexDenyEvidenceInput): void;

package/codex-adapter/dist/codex-evidence-recorder.js

@@ -0,0 +1,235 @@
+/**
+ * Codex Evidence Recorder — the Codex source adapter for the PD v2 Phase 1
+ * evidence ledger (ADR-0027). Mirrors the OpenClaw recorder but keeps the
+ * Codex honesty boundaries: the subprocess stdout channel proves
+ * 'submitted', never host consumption; v2 rule enforcement stays suspended
+ * (PRI-780 — no context provider), so enforcement delivery and
+ * runtime_verified application are declared Unknown, not Supported; there
+ * is no self-report capture channel on Codex — Unsupported, not faked.
+ *
+ * All writes flow through the shared host-runtime ingress (SPEC §13.7 单一
+ * 入口). Best-effort: degradation produces a bounded stderr diagnostic and
+ * never changes the hook result.
+ */
+import { getInterventionEvidenceIngress } from '@principles/host-runtime';
+/** Evidence adapter surface version (major-series label; exact package version lives in package.json). */
+export const CODEX_EVIDENCE_ADAPTER_VERSION = 'codex-adapter@2';
+/**
+ * Codex capability matrix (SPEC §13.6) — declared, never inferred from
+ * record absence. 'supported' requires a proof note; Unknown is an honest
+ * state, not a failure (ADR-0027 §2.4).
+ */
+export function codexCapabilityDeclarations() {
+    return [
+        {
+            hostKind: 'codex', capability: 'agent_context_delivery', status: 'supported',
+            adapterVersion: CODEX_EVIDENCE_ADAPTER_VERSION, channel: 'pd-hook:UserPromptSubmit',
+            maxConfirmation: 'submitted',
+            note: 'additionalContext encoded into the hook stdout hookSpecificOutput; host consumption is not confirmable',
+        },
+        {
+            hostKind: 'codex', capability: 'enforcement_delivery', status: 'unknown',
+            adapterVersion: CODEX_EVIDENCE_ADAPTER_VERSION, channel: 'pd-hook:PreToolUse',
+            note: 'v2 rule context provider not injected (PRI-780); live rule enforcement stays suspended — no runtime_loaded claims',
+        },
+        {
+            hostKind: 'codex', capability: 'application_runtime_verified', status: 'unknown',
+            adapterVersion: CODEX_EVIDENCE_ADAPTER_VERSION, channel: 'pd-hook:PreToolUse',
+            note: 'an attributed deny would be recorded after successful stdout encoding; enforcement currently suspended (PRI-780)',
+        },
+        {
+            hostKind: 'codex', capability: 'application_self_report', status: 'unsupported',
+            adapterVersion: CODEX_EVIDENCE_ADAPTER_VERSION, channel: 'pd-hook',
+            note: 'no self-report capture channel exists on the Codex host; nothing is claimed',
+        },
+        {
+            hostKind: 'codex', capability: 'behavior_observation', status: 'unknown',
+            adapterVersion: CODEX_EVIDENCE_ADAPTER_VERSION, channel: 'pd-hook:PreToolUse',
+            note: 'tool episodes are recorded only on attributed gate interventions, which are currently suspended (PRI-780)',
+        },
+        {
+            hostKind: 'codex', capability: 'outcome_observation', status: 'unknown',
+            adapterVersion: CODEX_EVIDENCE_ADAPTER_VERSION, channel: 'console',
+            note: 'no automated outcome source; Phase 1 outcomes enter via Owner console input only',
+        },
+    ];
+}
+function appendCodexBatch(workspaceDir, observations, warn) {
+    if (observations.length === 0)
+        return;
+    const ingress = getInterventionEvidenceIngress();
+    const batch = {
+        evidenceScopeId: ingress.evidenceScopeIdFor(workspaceDir),
+        sourceKind: 'codex_pd_hook_event_log',
+        adapterVersion: CODEX_EVIDENCE_ADAPTER_VERSION,
+        recordedAt: new Date().toISOString(),
+        observations,
+        capabilityDeclarations: codexCapabilityDeclarations(),
+    };
+    const result = ingress.appendObservationBatch({ workspaceDir, batch });
+    if (!result.ok) {
+        warn(`[PD:Evidence] codex append degraded: ${result.reason ?? 'unknown'}; next: ${result.nextAction ?? 'replay from durable source'}`);
+    }
+}
+/**
+ * Record one agent-context delivery attempt per injected principle after the
+ * raw injected-event line has been appended to the durable Codex event log —
+ * confirmation 'submitted', outcome 'attempted'.
+ */
+export function recordCodexPromptDeliveryEvidence(input) {
+    if (!input.evidenceEnabled || input.injected.length === 0)
+        return;
+    const ingress = getInterventionEvidenceIngress();
+    const observations = [];
+    for (const entry of input.injected) {
+        const observationKey = `codex|delivery|agent_context|${input.sessionId}|${input.turnId ?? '-'}|${entry.activationId}`;
+        const sourceLocator = `codex-pd-hook-event-log:${input.sessionId}`;
+        const existing = ingress.existingObservationRefs(input.workspaceDir, {
+            sourceKind: 'codex_pd_hook_event_log', sourceLocator, observationKey,
+            principleId: entry.principleId, activationId: entry.activationId, ...(entry.artifactId ? { artifactId: entry.artifactId } : {}),
+        });
+        const activationRef = existing?.activationRef ?? ingress.resolveActivationOccurrenceRef(input.workspaceDir, entry.activationId);
+        if (!activationRef) {
+            input.warn(`[PD:Evidence] codex prompt delivery skipped for activation ${entry.activationId}: occurrence snapshot unresolvable`);
+            continue;
+        }
+        if (entry.artifactId !== undefined && activationRef.artifactId !== entry.artifactId) {
+            input.warn(`[PD:Evidence] codex prompt delivery skipped for activation ${entry.activationId}: source artifact does not match occurrence`);
+            continue;
+        }
+        const contentRef = existing?.contentRef ?? ingress.resolveInterventionContentRef(input.workspaceDir, activationRef, entry.principleId);
+        observations.push({
+            observationKey,
+            sourceLocator,
+            kind: 'delivery',
+            nativeRefs: {
+                hostKind: 'codex',
+                sessionId: input.sessionId,
+                ...(input.turnId ? { turnId: input.turnId } : {}),
+            },
+            principleId: entry.principleId,
+            contentRef: {
+                principleId: entry.principleId,
+                ...(activationRef.artifactId ? { artifactId: activationRef.artifactId } : {}),
+                ...(contentRef ? { payloadDigest: contentRef.payloadDigest } : {}),
+                resolution: contentRef ? 'resolved' : 'revision_reference_unresolved',
+            },
+            activationRef,
+            payload: { targetKind: 'agent_context', confirmation: 'submitted', outcome: 'attempted' },
+        });
+    }
+    appendCodexBatch(input.workspaceDir, observations, input.warn);
+}
+/**
+ * Record the enforcement chain for an ATTRIBUTED deny that was successfully
+ * encoded to the Codex stdout channel. The proof boundary is the encoded
+ * permissionDecision — PD does not claim the host executed anything broader.
+ * Currently dormant while v2 rule enforcement is suspended (PRI-780), but
+ * wired so an attributed deny is recorded honestly if one ever occurs.
+ *
+ * Episode identity requires the per-call toolUseId. Without it the chain is
+ * skipped: a hash fallback would mint an episode with NO native event key,
+ * which the normalizer rejects (episode_requires_native_event_key) and drops
+ * the WHOLE batch. (Codex deny episodes only ever carry toolCallId — unlike
+ * OpenClaw they never see a runId — so there is no legitimate fallback here.)
+ */
+export function recordCodexDenyEvidence(input) {
+    if (!input.activationId || !input.principleId)
+        return;
+    if (!input.toolUseId) {
+        input.warn('[PD:Evidence] codex deny chain skipped: no toolUseId — episode identity would lack a native event key');
+        return;
+    }
+    if (!input.evidenceEnabled)
+        return;
+    const ingress = getInterventionEvidenceIngress();
+    const toolKey = input.toolUseId;
+    const sessionPart = input.sessionId ?? '-';
+    const deliveryKey = `codex|delivery|enforcement|${sessionPart}|${toolKey}|${input.activationId}`;
+    const sourceLocator = `codex-pd-hook-event-log:${sessionPart}`;
+    const existing = ingress.existingObservationRefs(input.workspaceDir, {
+        sourceKind: 'codex_pd_hook_event_log', sourceLocator, observationKey: deliveryKey,
+        principleId: input.principleId, activationId: input.activationId,
+    });
+    const activationRef = existing?.activationRef ?? ingress.resolveActivationOccurrenceRef(input.workspaceDir, input.activationId);
+    if (!activationRef) {
+        input.warn(`[PD:Evidence] codex deny chain skipped for activation ${input.activationId}: occurrence snapshot unresolvable`);
+        return;
+    }
+    const episodeKey = `codex|episode|${sessionPart}|${toolKey}`;
+    const content = existing?.contentRef ?? ingress.resolveInterventionContentRef(input.workspaceDir, activationRef, input.principleId);
+    const contentRef = {
+        principleId: input.principleId,
+        ...(activationRef.artifactId ? { artifactId: activationRef.artifactId } : {}),
+        ...(content ? { payloadDigest: content.payloadDigest } : {}),
+        resolution: content ? 'resolved' : 'revision_reference_unresolved',
+    };
+    const observations = [
+        {
+            observationKey: deliveryKey,
+            sourceLocator,
+            kind: 'delivery',
+            nativeRefs: {
+                hostKind: 'codex',
+                ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+                ...(input.toolUseId ? { toolCallId: input.toolUseId } : {}),
+                toolName: input.toolName,
+            },
+            principleId: input.principleId,
+            contentRef,
+            activationRef,
+            payload: { targetKind: 'runtime_enforcement', confirmation: 'runtime_loaded', outcome: 'delivered' },
+        },
+        {
+            observationKey: `codex|application|runtime_verified|${sessionPart}|${toolKey}|${input.activationId}`,
+            sourceLocator: `codex-pd-hook-event-log:${sessionPart}`,
+            kind: 'application',
+            nativeRefs: {
+                hostKind: 'codex',
+                ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+                ...(input.toolUseId ? { toolCallId: input.toolUseId } : {}),
+                toolName: input.toolName,
+            },
+            principleId: input.principleId,
+            activationRef,
+            episodeKey,
+            payload: { proofMethod: 'runtime_verified', action: 'tool_blocked', enforcementBoundary: 'codex_permission_decision_encoded' },
+        },
+        {
+            observationKey: episodeKey,
+            sourceLocator: `codex-pd-hook-event-log:${sessionPart}`,
+            kind: 'behavior_episode',
+            nativeRefs: {
+                hostKind: 'codex',
+                ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+                ...(input.toolUseId ? { toolCallId: input.toolUseId } : {}),
+                toolName: input.toolName,
+            },
+            payload: {
+                status: 'closed',
+                actionSummary: `${input.toolName} denied by rule ${input.ruleId ?? 'unknown'}`,
+                resultSummary: 'deny encoded to Codex permission decision',
+            },
+        },
+        {
+            observationKey: `codex|effect|${sessionPart}|${toolKey}|${input.activationId}`,
+            sourceLocator: `codex-pd-hook-event-log:${sessionPart}`,
+            kind: 'effect',
+            nativeRefs: {
+                hostKind: 'codex',
+                ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+                ...(input.toolUseId ? { toolCallId: input.toolUseId } : {}),
+                toolName: input.toolName,
+            },
+            principleId: input.principleId,
+            episodeKey,
+            contentRef,
+            activationRef,
+            payload: {
+                status: 'observed',
+                observationSummary: `rule ${input.ruleId ?? 'unknown'} denied ${input.toolName}`,
+            },
+        },
+    ];
+    appendCodexBatch(input.workspaceDir, observations, input.warn);
+}

package/codex-adapter/dist/pd-hook.d.ts

@@ -5,6 +5,12 @@ export interface PdHookResult {
     exitCode: number;
     stderr: string[];
 }
+/** PD v2 Phase 1: evidence context the emitter needs (subprocess-local). */
+export interface CodexEvidenceContext {
+    workspaceDir: string;
+    evidenceEnabled: boolean;
+    warn: (diagnosticLine: string) => void;
+}
 export declare function annotateContextWarnings(warnings: readonly string[]): string[];
 export declare function processHookInvocation(rawStdin: string, _env?: EnvMap, cwd?: string): Promise<PdHookResult>;
 export {};

package/codex-adapter/dist/pd-hook.js

@@ -12,6 +12,16 @@ import { CodexHooksHostAdapter } from './host-adapter.js';
 import { CodexDecoderError, CodexEncoderError } from './codec/index.js';
 import { ingestCodexConversation } from './ingestion/ingestion.js';
 import { runGovernanceAdmission } from './ingestion/admission.js';
+import { recordCodexPromptDeliveryEvidence, recordCodexDenyEvidence } from './codex-evidence-recorder.js';
+const MAX_DIAGNOSTIC = 500;
+function diagnostic(reason, nextAction) {
+    const boundedReason = reason.replace(/\s+/g, ' ').trim().slice(0, MAX_DIAGNOSTIC);
+    const boundedNextAction = nextAction.replace(/\s+/g, ' ').trim().slice(0, MAX_DIAGNOSTIC);
+    return `[PD] status=degraded reason=${boundedReason} nextAction=${boundedNextAction}`;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message.slice(0, MAX_DIAGNOSTIC) : 'unknown_error';
+}
 function redactStringFields(data) {
     // rc-8: telemetry is redacted string-field by string field (same policy as
     // the OpenClaw EventLog redactEventData) — shared by every emitter here.
@@ -27,7 +37,7 @@ function redactStringFields(data) {
  * writer, so the Codex host path stays independent of the OpenClaw plugin
  * (codex-adapter must not depend on principles-disciple — bundle guard).
  */
-function codexEventEmitter(stateDir) {
+function codexEventEmitter(stateDir, evidence) {
     return {
         recordRuntimeV2ActivationsInjected(data) {
             appendEventLogLine(stateDir, {
@@ -37,6 +47,31 @@ function codexEventEmitter(stateDir) {
                 sessionId: data.sessionId,
                 data,
             });
+            // PD v2 Phase 1: the durable source line is appended — now record the
+            // normalized agent-context delivery attempts (submitted, not delivered).
+            // Degrades to a bounded diagnostic; never affects the hook result.
+            if (evidence) {
+                try {
+                    const injected = data.principleIds
+                        .map((principleId, index) => ({
+                        principleId,
+                        activationId: data.activationIds[index] ?? '',
+                        artifactId: data.artifactIds[index],
+                    }))
+                        .filter((entry) => entry.activationId.length > 0);
+                    recordCodexPromptDeliveryEvidence({
+                        workspaceDir: evidence.workspaceDir,
+                        sessionId: data.sessionId,
+                        ...(data.runId ? { turnId: data.runId } : {}),
+                        injected,
+                        evidenceEnabled: evidence.evidenceEnabled,
+                        warn: evidence.warn,
+                    });
+                }
+                catch (error) {
+                    evidence.warn(diagnostic(`codex_evidence_delivery_failed:${errorMessage(error)}`, 'The raw injected event is durable; replay is safe. The hook result is unaffected.'));
+                }
+            }
         },
         recordToolCall(sessionId, data) {
             appendEventLogLine(stateDir, {
@@ -49,15 +84,6 @@ function codexEventEmitter(stateDir) {
         },
     };
 }
-const MAX_DIAGNOSTIC = 500;
-function diagnostic(reason, nextAction) {
-    const boundedReason = reason.replace(/\s+/g, ' ').trim().slice(0, MAX_DIAGNOSTIC);
-    const boundedNextAction = nextAction.replace(/\s+/g, ' ').trim().slice(0, MAX_DIAGNOSTIC);
-    return `[PD] status=degraded reason=${boundedReason} nextAction=${boundedNextAction}`;
-}
-function errorMessage(error) {
-    return error instanceof Error ? error.message.slice(0, MAX_DIAGNOSTIC) : 'unknown_error';
-}
 /**
  * PRI-813: admissible evaluation entry = the CANONICAL core schema guard
  * (rc-1/rc-2, P4: no hand-rolled field copy that could drift from the
@@ -253,6 +279,15 @@ export async function processHookInvocation(rawStdin, _env = process.env, cwd =
         const ingestionDiagnostics = ingestionEnabled
             ? await runConversationIngestion({ rawPayload: parsed, kind: event.kind, workspaceDir: resolution.workspaceDir, env: _env })
             : [];
+        // PD v2 Phase 1: evidence context for this subprocess invocation. The
+        // ledger flag follows the OpenClaw convention (principle_receipt_ledger
+        // gates normalized evidence writes).
+        const evidenceDiagnostics = [];
+        const evidenceContext = {
+            workspaceDir: resolution.workspaceDir,
+            evidenceEnabled: flags.principle_receipt_ledger?.enabled === true,
+            warn: (line) => evidenceDiagnostics.push(diagnostic(line.replace(/^\[PD:Evidence\] /, 'codex_evidence:'), 'Inspect workspace state.db evidence ledger; the durable raw source allows safe replay.')),
+        };
         // PRI-750: emit shared-path injection/tool events with the host's natural
         // turn/tool ids (turn_id → runId, tool_use_id → toolCallId) through the core
         // event-JSONL writer (same events_*.jsonl format as the OpenClaw EventLog;
@@ -262,7 +297,7 @@ export async function processHookInvocation(rawStdin, _env = process.env, cwd =
             projectDir: requestedCwd,
             hostKind: 'codex',
             toolSemantics: CODEX_TOOL_SEMANTICS,
-            events: codexEventEmitter(path.join(resolution.workspaceDir, '.state')),
+            events: codexEventEmitter(path.join(resolution.workspaceDir, '.state'), evidenceContext),
             // PRI-780 (revised after Codex review round 2 P1): NO context provider —
             // v2 rules stay SUSPENDED on Codex (never loaded context-blind). See
             // annotateContextWarnings for the structured unsupported declaration.
@@ -273,8 +308,56 @@ export async function processHookInvocation(rawStdin, _env = process.env, cwd =
         // rulehost_evaluated rows, so shadow evidence never reached the
         // promotion pipeline.
         const evaluationDiagnostics = recordRuleHostEvaluations(path.join(resolution.workspaceDir, '.state'), event.context.sessionId, result.metadata?.evaluations);
-        const stderr = [...annotateContextWarnings(result.warnings ?? []).slice(0, 16).map((warning) => diagnostic(warning, 'Inspect PD Workspace state and retry; the hook failed open.')), ...evaluationDiagnostics, ...ingestionDiagnostics];
-        return { stdout: adapter.encodeOutput(result, event.kind), exitCode: 0, stderr };
+        // PD v2 Phase 1: encode BEFORE recording an attributed deny — a
+        // runtime_verified application claims only what reached the stdout
+        // channel (codex_permission_decision_encoded boundary). Dormant while
+        // v2 enforcement is suspended (PRI-780); wired honestly for the day it
+        // is not.
+        const encoded = adapter.encodeOutput(result, event.kind);
+        if (result.decision === 'deny') {
+            try {
+                let liveActivationId;
+                const evaluations = result.metadata?.evaluations;
+                if (Array.isArray(evaluations)) {
+                    for (const entry of evaluations) {
+                        if (typeof entry !== 'object' || entry === null)
+                            continue;
+                        const record = entry;
+                        if (record.activationMode === 'live' && typeof record.activationId === 'string' && record.activationId.length > 0) {
+                            ({ activationId: liveActivationId } = record);
+                            break;
+                        }
+                    }
+                }
+                const { metadata } = result;
+                const principleId = typeof metadata?.principleId === 'string' ? metadata.principleId : undefined;
+                const ruleId = typeof metadata?.ruleId === 'string' ? metadata.ruleId : undefined;
+                const rawPayload = parsed;
+                const toolName = typeof rawPayload?.tool_name === 'string'
+                    ? String(rawPayload.tool_name)
+                    : 'unknown-tool';
+                const toolUseId = typeof rawPayload?.tool_use_id === 'string'
+                    ? String(rawPayload.tool_use_id)
+                    : undefined;
+                recordCodexDenyEvidence({
+                    workspaceDir: resolution.workspaceDir,
+                    sessionId: event.context.sessionId,
+                    ...(toolUseId ? { toolUseId } : {}),
+                    toolName,
+                    activationId: liveActivationId,
+                    principleId,
+                    ruleId,
+                    reason: result.reason,
+                    evidenceEnabled: evidenceContext.evidenceEnabled,
+                    warn: evidenceContext.warn,
+                });
+            }
+            catch (error) {
+                evidenceDiagnostics.push(diagnostic(`codex_evidence_deny_failed:${errorMessage(error)}`, 'The deny decision was already encoded; evidence replay from the durable source is safe.'));
+            }
+        }
+        const stderr = [...annotateContextWarnings(result.warnings ?? []).slice(0, 16).map((warning) => diagnostic(warning, 'Inspect PD Workspace state and retry; the hook failed open.')), ...evaluationDiagnostics, ...evidenceDiagnostics, ...ingestionDiagnostics];
+        return { stdout: encoded, exitCode: 0, stderr };
     }
     catch (error) {
         const reason = error instanceof CodexEncoderError ? error.reason : `runtime_failed:${errorMessage(error)}`;

package/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/codex-adapter",
-  "version": "0.4.8",
+  "version": "0.5.0",
   "description": "Codex CLI host adapter for Principles Disciple — implements HostAdapter interface for OpenAI Codex CLI's stdin/stdout JSON hook model (ADR-0020).",
   "type": "module",
   "main": "./dist/index.js",

package/console/dist/server/index.js

@@ -22,6 +22,7 @@ import { handleReceiptsRoute, disposeReceiptsModels } from './routes/receipts.js
 import { handleApprovalsGroupedRoute, disposeApprovalsGroupedModels } from './routes/approvals-grouped.js';
 import { handleGovernanceRoute, handleGovernanceExperienceRoute, resolveOwnerConfigSnapshot, disposeGovernanceModels } from './routes/governance.js';
 import { handleOwnerDecisionsRoute } from './routes/owner-decisions.js';
+import { handleEvidenceOutcomesRoute } from './routes/evidence-outcomes.js';
 import { handleOwnerDecisionInboxRoute, handleOwnerDecisionViewRoute, handleOwnerDecisionLibraryRoute, parseOwnerDecisionViewSubPath } from './routes/owner-decision.js';
 import { handleOwnerIdentityRoute } from './routes/owner-identity.js';
 import { handleEvidenceChainRoute, disposeEvidenceChainModels } from './routes/evidence-chain.js';
@@ -525,6 +526,23 @@ function handleRequest(services) {
                 asyncHandler(() => handleEvidenceChainRoute(req, res, services.workspaceDir))(req, res);
                 return;
             }
+            // PD v2 Phase 1: POST /api/v1/evidence/outcomes — Owner outcome feedback
+            // into the normalized evidence ledger. Identity derived server-side,
+            // same rule as owner-decisions (configured owner or authenticated
+            // console operator; never a body-supplied identity).
+            if (urlPath === '/api/v1/evidence/outcomes') {
+                const eoIdentity = resolveOwnerIdentity(process.env, defaultOwnerIdentityHomeDir());
+                const { ownerId, credentialId } = eoIdentity;
+                const authEnabledForOwner = services.authConfig.isEnabled()
+                    && ownerId !== null && credentialId !== null;
+                asyncHandler(() => handleEvidenceOutcomesRoute(req, res, {
+                    workspaceDir: services.workspaceDir,
+                    ownerIdentity: authEnabledForOwner
+                        ? { ownerId, credentialId }
+                        : null,
+                }))(req, res);
+                return;
+            }
             // GET /api/health
             if (urlPath === '/api/health') {
                 asyncHandler(() => handleHealthRoute(req, res, {

package/console/dist/server/models/ActivationsConsoleModel.d.ts

@@ -1,4 +1,6 @@
 import type { ActivationStatusRecord, PromotionReadinessResult, ActivationControlState, ActivationDecisionRecord, GlobalRuleCodePause, OwnerPromotionActor, OwnerPromotionResult } from '@principles/core/runtime-v2';
+import { type PromptInjectionTargetHost } from '@principles/host-runtime';
+import type { PromptActivationInjectionStatusWire, PromptInjectionRouteSummaryWire } from '../../shared/prompt-injection-contract.js';
 import { type GovernanceAuditWriter } from 'principles-disciple/governance-audit';
 /**
  * PRI-491 — owner-observable activation record.
@@ -48,6 +50,14 @@ export interface ActivationRecord {
     enforcement?: 'eligible' | 'safety_isolated';
     legacyDecisionUnknown?: boolean;
     ownerReviewDueAt?: string;
+    /**
+     * PD_PROMPT_CAPACITY_V1 R-A3: current injection status for LIVE prompt
+     * activations — positive single-item evidence per row (oversized carries
+     * its own reason, window_excluded means it fits but the window is full).
+     * Absent for non-prompt channels, deactivated rows, and when the status
+     * reader itself degrades (see ActivationsResponse.promptInjectionRoute).
+     */
+    promptInjection?: PromptActivationInjectionStatusWire;
 }
 export interface ActivationsResponse {
     activations: ActivationRecord[];
@@ -57,6 +67,8 @@ export interface ActivationsResponse {
     reason?: string;
     /** Present when status is 'degraded' — next operator action. */
     nextAction?: string;
+    /** R-A3/AC-01: route context for the per-activation injection statuses. */
+    promptInjectionRoute?: PromptInjectionRouteSummaryWire;
 }
 export interface RuleCodeOwnerReview {
     activation: ActivationStatusRecord;
@@ -137,7 +149,7 @@ export declare class ActivationsConsoleModel {
     private readonly workspaceDir;
     private readonly governanceAuditWriter;
     constructor(workspaceDir: string, governanceAuditWriter?: GovernanceAuditWriter);
-    getActivations(): Promise<ActivationsResponse>;
+    getActivations(targetHost?: PromptInjectionTargetHost): Promise<ActivationsResponse>;
     getOwnerReview(activationId: string, ownerIdentityConfigured?: boolean, ownerActor?: OwnerPromotionActor): Promise<RuleCodeOwnerReview>;
     continueObserving(activationId: string, input: OwnerMutationInput): Promise<{
         decisionId: string;

package/console/dist/server/models/ActivationsConsoleModel.js

@@ -1,5 +1,5 @@
 import { SqliteConnection, SqliteActivationStateStore, SqlitePIArtifactStore, extractPrincipleId, extractEvidenceRefs, PromotionReadinessReader, RuleHostWriter, createProductionGateDeps, SqliteActivationSafetyStore, isFeatureEnabled, RuleCodeOwnerDecisionService, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, buildPromotionEvidenceSnapshot, } from '@principles/core/runtime-v2';
-import { resolvePromotionHostLiveness, resolveWorkspaceHostToolSemantics } from '@principles/host-runtime';
+import { resolvePromotionHostLiveness, resolveWorkspaceHostToolSemantics, readPromptActivationInjectionStatuses } from '@principles/host-runtime';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -160,7 +160,7 @@ export class ActivationsConsoleModel {
         this.workspaceDir = workspaceDir;
         this.governanceAuditWriter = governanceAuditWriter;
     }
-    async getActivations() {
+    async getActivations(targetHost) {
         const stateDbPath = path.join(this.workspaceDir, '.pd', 'state.db');
         if (!fs.existsSync(stateDbPath)) {
             return { activations: [], status: 'degraded', reason: 'state.db not found — workspace may not be initialized', nextAction: 'Run pd runtime diagnostics to check workspace state' };
@@ -314,6 +314,56 @@ export class ActivationsConsoleModel {
                 }
                 return enriched;
             });
+            // PD_PROMPT_CAPACITY_V1 R-A3: per-live-prompt-activation injection
+            // status with positive single-item evidence. Degradation is observable
+            // (route summary carries the reason) and never turns a row "healthy"
+            // by omission (rc-9 / AC-06).
+            let promptInjectionRoute;
+            let statusByActivation;
+            try {
+                const report = await readPromptActivationInjectionStatuses({ workspaceDir: this.workspaceDir, targetHost });
+                promptInjectionRoute = {
+                    status: report.route.status,
+                    ...(report.route.hostKind !== undefined ? { hostKind: report.route.hostKind } : {}),
+                    ...(report.route.route !== undefined ? { route: report.route.route } : {}),
+                    flagEnabled: report.route.flagEnabled,
+                    ...(report.route.unconfirmedReason !== undefined ? { unconfirmedReason: report.route.unconfirmedReason } : {}),
+                    ...(report.route.nextAction !== undefined ? { nextAction: report.route.nextAction } : {}),
+                    ...(report.globalReason !== undefined ? { globalReason: report.globalReason } : {}),
+                };
+                statusByActivation = new Map(report.statuses.map((entry) => [
+                    entry.activationId,
+                    {
+                        activationId: entry.activationId,
+                        status: entry.status,
+                        ...(entry.inCurrentWindow !== undefined ? { inCurrentWindow: entry.inCurrentWindow } : {}),
+                        ...(entry.costChars !== undefined ? { costChars: entry.costChars } : {}),
+                        ...(entry.budget !== undefined ? { budget: entry.budget } : {}),
+                        ...(entry.budgetScope !== undefined ? { budgetScope: entry.budgetScope } : {}),
+                        ...(entry.route !== undefined ? { route: entry.route } : {}),
+                        ...(entry.reason !== undefined ? { reason: entry.reason } : {}),
+                        ...(entry.perHostFits !== undefined
+                            ? { perHostFits: entry.perHostFits.map((fit) => ({ hostKind: fit.hostKind, fits: fit.fits })) }
+                            : {}),
+                    },
+                ]));
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                promptInjectionRoute = {
+                    status: 'unconfirmed',
+                    flagEnabled: false,
+                    unconfirmedReason: `injection_status_reader_failed: ${message}`,
+                    nextAction: 'check workspace .pd/state.db readability and the host declarations',
+                };
+            }
+            for (const fact of facts) {
+                if (fact.channel === 'prompt' && fact.status !== 'deactivated') {
+                    const entry = statusByActivation?.get(fact.activationId);
+                    if (entry !== undefined)
+                        fact.promptInjection = entry;
+                }
+            }
             // rc-9: surface dangling references instead of silently returning a degraded list.
             if (danglingArtifactIds.size > 0) {
                 return {
@@ -321,11 +371,13 @@ export class ActivationsConsoleModel {
                     status: 'degraded',
                     reason: `${danglingArtifactIds.size} activation(s) reference non-existent artifact_id(s): ${Array.from(danglingArtifactIds).join(', ')}`,
                     nextAction: 'Run pd runtime internalization integrity to check for orphaned activations',
+                    promptInjectionRoute,
                 };
             }
             return {
                 activations: facts,
                 status: 'ok',
+                promptInjectionRoute,
             };
         }
         finally {