create-principles-disciple 1.144.27 → 1.145.0

package/host-runtime/dist/prompt-injection-projection.js

@@ -3,24 +3,32 @@ import { escapeXml } from '@principles/core/prompt-builder';
 import { loadPdConfigForPlugin } from './pd-config.js';
 import { buildActivePrinciplePromptContext, readPromptActivationCandidates, MAX_SHARED_DIAGNOSTIC_IDS } from './active-principle-prompt.js';
 import { readWorkspaceHostKindFacts } from './host-liveness-contract.js';
-export const PROMPT_INJECTION_TARGET_HOSTS = ['openclaw', 'codex'];
+/** Single host roster (review P2): every consumer derives from this list, so a
+ * new host cannot fork route-unconfirmed per-host forecasts from the routes. */
+export const PROMPT_INJECTION_TARGET_HOSTS = ['openclaw', 'codex', 'workbuddy'];
+/** Runtime membership test derived from the roster (rc-2): the ONE guard for
+ * "is this untrusted host-kind string a host with a known prompt-injection
+ * route". Every consumer narrows with this — never by re-typing the literals
+ * (review R1: each re-typed list forked the roster and dropped WorkBuddy). */
+export function isPromptInjectionTargetHost(kind) {
+    return typeof kind === 'string' && PROMPT_INJECTION_TARGET_HOSTS.includes(kind);
+}
 export const PROMPT_INJECTION_UNIT = 'utf16_code_units';
 /**
  * THE one route formula (P4): Codex always injects through the shared route
- * (codex-adapter has no flag branch); OpenClaw routes by its
- * `abstraction_layer_v1` gate. Every consumer that needs "which route would
- * host X take" must call this — never re-type the ternary.
+ * (codex-adapter has no flag branch); so does WorkBuddy (workbuddy-adapter
+ * renders through the shared runtime unconditionally — it has no legacy
+ * route); OpenClaw routes by its `abstraction_layer_v1` gate. Every consumer
+ * that needs "which route would host X take" must call this — never re-type
+ * the ternary.
  */
 export function promptRouteForHost(hostKind, flagEnabled) {
-    if (hostKind === 'codex')
+    if (hostKind === 'codex' || hostKind === 'workbuddy')
         return 'shared_render';
     return flagEnabled ? 'shared_render' : 'legacy_trim';
 }
 function standardHostRoutes(flagEnabled) {
-    return [
-        { hostKind: 'openclaw', route: promptRouteForHost('openclaw', flagEnabled) },
-        { hostKind: 'codex', route: promptRouteForHost('codex', flagEnabled) },
-    ];
+    return PROMPT_INJECTION_TARGET_HOSTS.map((hostKind) => ({ hostKind, route: promptRouteForHost(hostKind, flagEnabled) }));
 }
 /**
  * Resolve the effective route for this workspace. Pure read of existing
@@ -83,8 +91,8 @@ export function resolvePromptInjectionRouteDecision(input) {
             perHost: standardHostRoutes(flagEnabled),
         };
     }
-    const knownKinds = facts.effectiveKinds.filter((kind) => kind === 'openclaw' || kind === 'codex');
-    const unknownKinds = facts.effectiveKinds.filter((kind) => kind !== 'openclaw' && kind !== 'codex');
+    const knownKinds = facts.effectiveKinds.filter(isPromptInjectionTargetHost);
+    const unknownKinds = facts.effectiveKinds.filter((kind) => !isPromptInjectionTargetHost(kind));
     if (unknownKinds.length > 0) {
         return {
             status: 'unconfirmed',
@@ -92,7 +100,7 @@ export function resolvePromptInjectionRouteDecision(input) {
             declaredHostKinds: facts.declaredKinds,
             effectiveHostKinds: facts.effectiveKinds,
             unconfirmedReason: `unknown_host_kind_declared: ${unknownKinds.join(', ')} has no known prompt-injection route`,
-            nextAction: 'pass an explicit target host (openclaw|codex) for this request, or remove the unknown host declaration',
+            nextAction: 'pass an explicit target host (openclaw|codex|workbuddy) for this request, or remove the unknown host declaration',
             perHost: standardHostRoutes(flagEnabled),
         };
     }
@@ -117,7 +125,7 @@ export function resolvePromptInjectionRouteDecision(input) {
             declaredHostKinds: facts.declaredKinds,
             effectiveHostKinds: facts.effectiveKinds,
             unconfirmedReason: 'no_host_facts_and_flag_off: no host declaration or host evidence exists, and the applicable hosts would take different routes',
-            nextAction: 'pass an explicit target host (openclaw|codex), or let a host run once in this workspace so it persists its declaration',
+            nextAction: 'pass an explicit target host (openclaw|codex|workbuddy), or let a host run once in this workspace so it persists its declaration',
             perHost: standardHostRoutes(flagEnabled),
         };
     }
@@ -151,8 +159,8 @@ export function resolvePromptInjectionRouteDecision(input) {
         flagEnabled,
         declaredHostKinds: facts.declaredKinds,
         effectiveHostKinds: facts.effectiveKinds,
-        unconfirmedReason: 'multi_host_routes_differ: openclaw would take the legacy list route and codex the shared route under the current flag-off config',
-        nextAction: 'pass an explicit target host (openclaw|codex) for this request, or enable abstraction_layer_v1 so both hosts share one route',
+        unconfirmedReason: 'multi_host_routes_differ: openclaw would take the legacy list route while codex/workbuddy would take the shared route under the current flag-off config',
+        nextAction: 'pass an explicit target host (openclaw|codex|workbuddy) for this request, or enable abstraction_layer_v1 so all hosts share one route',
         perHost: standardHostRoutes(flagEnabled),
     };
 }
@@ -216,7 +224,13 @@ function isDiagnosticCapHit(ids) {
  */
 export async function buildLivePromptInjectionProjection(input) {
     const flagEnabled = computeFeatureFlagsFromConfig(loadPdConfigForPlugin(input.workspaceDir).effective).flags.abstraction_layer_v1?.enabled === true;
-    const sharedRoute = input.targetHost === 'codex' ? true : flagEnabled;
+    // Route face follows THE one route formula (review P2-2: a re-typed
+    // codex-only ternary forecast WorkBuddy as legacy_trim while its adapter
+    // renders shared unconditionally). No explicit target (console callers)
+    // keeps the flag-gated workspace default.
+    const sharedRoute = input.targetHost === undefined
+        ? flagEnabled
+        : promptRouteForHost(input.targetHost, flagEnabled) === 'shared_render';
     if (sharedRoute) {
         const context = await buildActivePrinciplePromptContext(input);
         const oversized = context.oversizedActivationIds ?? [];

package/host-runtime/dist/workbuddy-worker-status.d.ts

@@ -0,0 +1,24 @@
+/**
+ * WorkBuddy worker status-mode semantics — host-runtime authority (mirrors
+ * the Codex Slice D placement): the CLI worker --status and any health
+ * surface share ONE mode evaluation, which only depends on host-neutral
+ * inputs (governance workspace directory, .pd/config.yaml flags, install
+ * manifest registration). The WorkBuddy evaluation has NO ingestion step to
+ * gate — the hook is the only evidence producer in the WorkBuddy MVP
+ * (SPEC workbuddy-host-adapter §1 Excluded: no transcript reads).
+ *
+ * SPEC §15 worker mode, evaluated WITHOUT executing anything (no lease, no
+ * LLM). `manual_action_required` means no Companion-registered worker serves
+ * this governance workspace — manual `pd diagnose` / `pd runtime
+ * internalization run-once` is the recovery route.
+ */
+export type WorkbuddyWorkerMode = 'ready' | 'manual_action_required' | 'paused' | 'degraded';
+export interface WorkbuddyWorkerStatusEvaluation {
+    readonly mode: WorkbuddyWorkerMode;
+    readonly reason?: string;
+    readonly nextAction?: string;
+}
+export declare function computeWorkbuddyWorkerStatusMode(input: {
+    workspaceDir: string;
+    registeredInInstallManifest: boolean;
+}): WorkbuddyWorkerStatusEvaluation;

package/host-runtime/dist/workbuddy-worker-status.js

@@ -0,0 +1,52 @@
+/**
+ * WorkBuddy worker status-mode semantics — host-runtime authority (mirrors
+ * the Codex Slice D placement): the CLI worker --status and any health
+ * surface share ONE mode evaluation, which only depends on host-neutral
+ * inputs (governance workspace directory, .pd/config.yaml flags, install
+ * manifest registration). The WorkBuddy evaluation has NO ingestion step to
+ * gate — the hook is the only evidence producer in the WorkBuddy MVP
+ * (SPEC workbuddy-host-adapter §1 Excluded: no transcript reads).
+ *
+ * SPEC §15 worker mode, evaluated WITHOUT executing anything (no lease, no
+ * LLM). `manual_action_required` means no Companion-registered worker serves
+ * this governance workspace — manual `pd diagnose` / `pd runtime
+ * internalization run-once` is the recovery route.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { loadPdConfigForPlugin } from './pd-config.js';
+import { computeFeatureFlagsFromConfig } from '@principles/core/runtime-v2';
+function directoryExists(dir) {
+    try {
+        return fs.statSync(dir).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+export function computeWorkbuddyWorkerStatusMode(input) {
+    const workspaceDir = path.resolve(input.workspaceDir);
+    if (!directoryExists(workspaceDir)) {
+        return { mode: 'degraded', reason: 'workspace_missing', nextAction: 'The governance workspace directory does not exist; run the WorkBuddy setup flow to initialize it.' };
+    }
+    const config = loadPdConfigForPlugin(workspaceDir);
+    if (!config.ok) {
+        const [first] = config.errors;
+        return { mode: 'degraded', reason: `pd_config_invalid:${first?.reason ?? 'unknown'}`, nextAction: first?.nextAction ?? 'Repair the governance workspace .pd/config.yaml.' };
+    }
+    const { flags } = computeFeatureFlagsFromConfig(config.effective);
+    if (flags['host.workbuddy']?.enabled !== true) {
+        return { mode: 'paused', reason: 'host.workbuddy_disabled', nextAction: 'Set features.host.workbuddy.enabled=true in the governance workspace .pd/config.yaml to enable WorkBuddy PD behavior.' };
+    }
+    if (flags.internalization_auto_consumer?.enabled !== true) {
+        return { mode: 'paused', reason: 'internalization_auto_consumer_disabled', nextAction: 'Automatic execution is paused; manual commands remain available: pd diagnose, pd runtime internalization run-once.' };
+    }
+    if (!input.registeredInInstallManifest) {
+        return {
+            mode: 'manual_action_required',
+            reason: 'workspace_not_in_install_manifest',
+            nextAction: `No Companion worker is registered for this governance workspace. Manual path: pd diagnose --workspace "${workspaceDir}", then pd runtime internalization run-once.`,
+        };
+    }
+    return { mode: 'ready' };
+}

package/host-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,14 +24,14 @@
     "@principles/core": "file:../core",
     "@principles/install-layout": "file:../install-layout",
     "better-sqlite3": "^13.0.3",
-    "js-yaml": "^5.4.1"
+    "js-yaml": "^5.4.3"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^26.4.1",
     "@types/js-yaml": "^4.0.9",
     "typescript": "^7.0.2",
-    "vite": "^8.3.0",
+    "vite": "^8.3.4",
     "vitest": "^5.0.0"
   },
   "repository": {

package/install-layout/dist/index.d.ts

@@ -1,7 +1,7 @@
 export declare const INSTALL_LAYOUT_VERSION: 1;
 export declare const INSTALL_LAYOUT_MODES: readonly ['canonical', 'legacy'];
 export type InstallLayoutMode = (typeof INSTALL_LAYOUT_MODES)[number];
-export declare const INSTALL_HOSTS: readonly ['codex', 'openclaw'];
+export declare const INSTALL_HOSTS: readonly ['codex', 'openclaw', 'workbuddy'];
 export type InstallHost = (typeof INSTALL_HOSTS)[number];
 export interface InstallManifest {
     layoutVersion: typeof INSTALL_LAYOUT_VERSION;
@@ -44,6 +44,13 @@ export interface InstallLayoutPaths {
      * links like any other runtime component.
      */
     codexAdapterDir: string;
+    /**
+     * WorkBuddy host adapter component (payload dir workbuddy-adapter/, npm
+     * name @principles/workbuddy-adapter; SPEC workbuddy-host-adapter §4.1).
+     * The WorkBuddy plugin wrapper resolves this dir to load the adapter entry
+     * the same way the Codex hook resolves the canonical runtime.
+     */
+    workbuddyAdapterDir: string;
 }
 export interface LayoutResolution {
     mode: InstallLayoutMode | 'missing';
@@ -65,6 +72,16 @@ export declare function parseInstallManifest(value: unknown): {
     error?: string;
 };
 export declare function getInstallLayoutPaths(homeDir: string): InstallLayoutPaths;
+/**
+ * WorkBuddy governance workspace (SPEC workbuddy-host-adapter §4.1 OD-07,
+ * frozen by Phase 0 probe P06 2026-10-12): an explicit user-level directory
+ * under the WorkBuddy config root, shared across projects, never auto-reused
+ * from Codex/OpenClaw state. projectDir stays the host cwd; this dir owns
+ * governance state (state.db / trajectory). The dir is CREATED only by the
+ * explicit setup flow — its absence means "not initialized", never a silent
+ * fallback to another host's database.
+ */
+export declare function getWorkbuddyWorkspaceDir(homeDir: string): string;
 export declare function resolveInstallLayout(options: ResolveInstallLayoutOptions): LayoutResolution;
 export declare function getConsoleServerEntry(paths: InstallLayoutPaths, mode: InstallLayoutMode): string;
 export declare function getConsoleWebIndex(paths: InstallLayoutPaths, mode: InstallLayoutMode): string;

package/install-layout/dist/index.js

@@ -1,7 +1,7 @@
 import * as path from 'node:path';
 export const INSTALL_LAYOUT_VERSION = 1;
 export const INSTALL_LAYOUT_MODES = ['canonical', 'legacy'];
-export const INSTALL_HOSTS = ['codex', 'openclaw'];
+export const INSTALL_HOSTS = ['codex', 'openclaw', 'workbuddy'];
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -48,7 +48,7 @@ export function parseInstallManifest(value) {
         return { error: 'install_manifest_malformed: mode must be canonical or legacy' };
     }
     if (!Array.isArray(value.hosts) || value.hosts.length === 0 || !value.hosts.every(isHost)) {
-        return { error: 'install_manifest_malformed: hosts must contain codex and/or openclaw' };
+        return { error: 'install_manifest_malformed: hosts must contain codex, openclaw and/or workbuddy' };
     }
     const hosts = [...new Set(value.hosts)];
     const workspaces = parseWorkspaceList(value.workspaces);
@@ -78,8 +78,21 @@ export function getInstallLayoutPaths(homeDir) {
         openClawExtensionDir: path.join(openClawDir, 'extensions', 'principles-disciple'),
         releaseManagerDir: path.join(runtimeDir, 'release-manager'),
         codexAdapterDir: path.join(runtimeDir, 'codex-adapter'),
+        workbuddyAdapterDir: path.join(runtimeDir, 'workbuddy-adapter'),
     };
 }
+/**
+ * WorkBuddy governance workspace (SPEC workbuddy-host-adapter §4.1 OD-07,
+ * frozen by Phase 0 probe P06 2026-10-12): an explicit user-level directory
+ * under the WorkBuddy config root, shared across projects, never auto-reused
+ * from Codex/OpenClaw state. projectDir stays the host cwd; this dir owns
+ * governance state (state.db / trajectory). The dir is CREATED only by the
+ * explicit setup flow — its absence means "not initialized", never a silent
+ * fallback to another host's database.
+ */
+export function getWorkbuddyWorkspaceDir(homeDir) {
+    return path.join(path.resolve(homeDir), '.workbuddy', 'pd-workspace');
+}
 export function resolveInstallLayout(options) {
     const paths = getInstallLayoutPaths(options.homeDir);
     const parsed = parseInstallManifest(options.manifest);

package/install-layout/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/install-layout",
-  "version": "0.2.7",
+  "version": "0.3.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.144.27",
+  "version": "1.145.0",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {
@@ -25,6 +25,7 @@
     "core",
     "host-runtime",
     "codex-adapter",
+    "workbuddy-adapter",
     "install-layout",
     "release-manager",
     "trust/root.json",
@@ -56,12 +57,12 @@
   "author": "csuzngjh",
   "license": "MIT",
   "dependencies": {
-    "@principles/install-layout": "^0.2.7",
+    "@principles/install-layout": "^0.3.0",
     "@tufjs/models": "3.0.1",
     "@inquirer/prompts": "^8.7.2",
     "commander": "^14.0.3",
     "fs-extra": "^11.4.0",
-    "js-yaml": "^5.4.1",
+    "js-yaml": "^5.4.3",
     "ora": "^9.4.1",
     "picocolors": "^1.0.0",
     "semver": "^7.8.5",
@@ -75,7 +76,7 @@
     "@types/semver": "^7.8.0",
     "@types/tar": "^7.0.87",
     "typescript": "^7.0.2",
-    "vite": "^8.3.0",
+    "vite": "^8.3.4",
     "vitest": "^5.0.0"
   },
   "engines": {
@@ -87,6 +88,6 @@
     "directory": "packages/create-principles-disciple"
   },
   "pd": {
-    "bundledPluginVersion": "2.1.0"
+    "bundledPluginVersion": "2.1.3"
   }
 }

package/pd-cli/dist/commands/candidate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"candidate.d.ts","sourceRoot":"","sources":["../../src/commands/candidate.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,mBAAmB,EA0BpB,MAAM,6BAA6B,CAAC;AAcrC,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAoED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oCAAoC,CACxD,YAAY,EAAE,mBAAmB,EACjC,SAAS,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCxB;AAgDD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCnF;AAID,UAAU,2BAA2B;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAaD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8JjG;AAID,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDnF;AAwXD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgKvF;AAID,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqPvF;AAID;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDrF;AAID;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4HvF;AAID,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAiFD,wBAAsB,sCAAsC,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkT1G;AAID,UAAU,qBAAqB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CrF"}
+{"version":3,"file":"candidate.d.ts","sourceRoot":"","sources":["../../src/commands/candidate.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,mBAAmB,EA0BpB,MAAM,6BAA6B,CAAC;AAerC,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAoED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oCAAoC,CACxD,YAAY,EAAE,mBAAmB,EACjC,SAAS,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCxB;AAgDD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CnF;AAID,UAAU,2BAA2B;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAaD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8JjG;AAKD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDnF;AAwXD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyLvF;AAID,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyPvF;AAID;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDrF;AAID;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+HvF;AAID,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAiFD,wBAAsB,sCAAsC,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoT1G;AAID,UAAU,qBAAqB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CrF"}

package/pd-cli/dist/commands/candidate.js

@@ -27,6 +27,7 @@ import { resolveRuntimeAdapterFromConfig } from '../services/runtime-adapter-res
 import { resolvePromptFullPipelineSeedMode } from '../services/pd-config-loader.js';
 import { createRemediationResult, remediationAction } from './remediation-output.js';
 import { checkAdmissionGate } from './admission-gate.js';
+import { enforceFullAdmissionForWrite } from '../services/admission-write-gate.js';
 async function updateCandidateStatus(opts) {
     const { stateManager, candidateId, targetStatus, expectedCurrentStatus } = opts;
     const db = stateManager.connection;
@@ -169,7 +170,11 @@ export async function handleCandidateList(opts) {
             return;
         }
         if (result.candidates.length === 0) {
-            console.log(`No candidates found for task: ${opts.taskId}`);
+            // An empty result must name the library it queried: with one .pd/state.db per
+            // host workspace, "no candidates" and "wrong workspace" are otherwise identical
+            // to the Owner (PRI-957). Resolved for display so a relative -w still reads as
+            // the absolute directory the query hit.
+            console.log(`No candidates found for task: ${opts.taskId} (workspace: ${path.resolve(workspaceDir)})`);
             return;
         }
         console.log(`\nPrinciple Candidates for Task: ${opts.taskId}\n`);
@@ -710,6 +715,32 @@ export async function handleCandidateIntake(opts) {
         }
         // PRI-442 Stage 4: admission gate check — refuse non-admitted candidates
         // to prevent CLI from bypassing the production admission gate.
+        // SPEC-CODEX-PAIN-CLOSURE-001 CR-03 (§7.2): the partial record check is a
+        // FAST pre-refusal only. The write permission itself comes from the
+        // persisted admission disposition; when it is missing (pre-CR-03 records)
+        // a full re-evaluation from the persisted materials runs and is saved.
+        // SPEC CR-03 §7.2 (review S1): the persisted/full admission gate owns the
+        // write permission; the partial record check below stays a fast pre-refusal.
+        const fullGate = await enforceFullAdmissionForWrite(stateManager, opts.candidateId);
+        if (fullGate !== null) {
+            const result = {
+                candidateId: opts.candidateId,
+                status: 'refused',
+                admissionDecision: fullGate.decision,
+                reason: fullGate.reason,
+                nextAction: fullGate.nextAction,
+            };
+            if (opts.json) {
+                console.log(JSON.stringify(result, null, 2));
+            }
+            else {
+                console.error(`Admission gate refused candidate ${opts.candidateId}: ${fullGate.decision}`);
+                console.error(`  Reason:      ${fullGate.reason}`);
+                console.error(`  Next Action: ${fullGate.nextAction}`);
+            }
+            process.exit(1);
+            return;
+        }
         const admissionBlock = checkAdmissionGate(candidate);
         if (admissionBlock) {
             const result = {
@@ -888,7 +919,11 @@ export async function handleCandidateReview(opts) {
             // `create` keeps the pre-check: a low-confidence candidate still cannot
             // become a new Principle via the CLI.
             if (opts.decide === 'create') {
-                const admissionBlock = checkAdmissionGate(candidate);
+                // SPEC review S1: a CREATE decision is a governance write — it passes
+                // the full admission gate (the reuse verdict remains exempt by
+                // PRI-917 R5 F4: a reuse decision creates nothing).
+                const createFullGate = await enforceFullAdmissionForWrite(stateManager, opts.candidateId);
+                const admissionBlock = createFullGate ?? checkAdmissionGate(candidate);
                 if (admissionBlock) {
                     const payload = {
                         candidateId: opts.candidateId,
@@ -1188,7 +1223,10 @@ export async function handleCandidateRepair(opts) {
         // re-verify admission before re-intaking to prevent bypassing the gate.
         // A consumed candidate that would fail the gate indicates data corruption
         // or a prior bypass; refuse and surface the reason.
-        const admissionBlock = checkAdmissionGate(candidate);
+        // SPEC review S1: repair re-intake passes the SAME full write gate —
+        // a corrupted admission document can never be repaired into the Ledger.
+        const repairFullGate = await enforceFullAdmissionForWrite(stateManager, opts.candidateId);
+        const admissionBlock = repairFullGate ?? checkAdmissionGate(candidate);
         if (admissionBlock) {
             const result = {
                 candidateId: opts.candidateId,
@@ -1457,7 +1495,9 @@ export async function handleCandidateInternalizationBackfill(opts) {
             }
             // PRI-442 Stage 4: admission gate check — refuse non-admitted pending
             // candidates to prevent backfill from bypassing the admission gate.
-            const admissionBlock = checkAdmissionGate(candidate);
+            // SPEC review S1: backfill writes pass the full admission gate too.
+            const backfillFullGate = await enforceFullAdmissionForWrite(stateManager, candidateId);
+            const admissionBlock = backfillFullGate ?? checkAdmissionGate(candidate);
             if (admissionBlock) {
                 output.intakeFailed++;
                 output.results.push({ candidateId, route: 'unknown', status: 'intake_failed', reason: `Admission gate refused: ${admissionBlock.reason}`, statusBefore: 'pending', statusAfter: 'pending', intakeDecision: 'skipped', seedDecision: 'skipped', nextAction: admissionBlock.nextAction });