create-principles-disciple 1.144.27 → 1.145.1

package/codex-adapter/dist/worker/workspace-worker.js

@@ -9,6 +9,10 @@
  *   3. lease + run one Diagnostician task, then ONE bounded downstream
  *      consumer cycle through the SHARED host-neutral executor
  *      (internalization_auto_consumer = workspace execution authority)
+ *   4. SPEC-CODEX-PAIN-CLOSURE-001 CR-05: continue the post-processing of
+ *      succeeded diagnoses (pending candidates, intake/seed orphans) WITHOUT
+ *      re-running the diagnosis LLM; CR-08: persist cycle liveness facts
+ *      (readiness is computed elsewhere and never implies liveness).
  *
  * Every step reuses existing authority: catch-up reuses the Slice A/B
  * ingestion + admission seams, reconciliation reuses
@@ -29,6 +33,29 @@ import { catchUpCodexIngestion } from '../ingestion/catch-up.js';
 import { CODEX_TOOL_SEMANTIC_MAPPINGS, CODEX_TOOL_SEMANTICS } from '../tool-semantics.js';
 const WORKER_OWNER = 'companion-worker';
 const DEFAULT_DIAG_CANDIDATE_LIMIT = 5;
+/** CR-05 §9.1: bounded per-cycle post-processing continuation budget. */
+const DEFAULT_POST_PROCESSING_LIMIT = 2;
+/** CR-08 §9.3: liveness facts are worker-owned runtime state (not governance truth). */
+function isPlainRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+const LIVENESS_FILE = 'codex-worker-liveness.json';
+const LIVENESS_STAGE_DEADLINE_MS = {
+    catch_up: 5 * 60_000,
+    reconcile: 5 * 60_000,
+    diagnosis_execution: 15 * 60_000,
+    post_processing: 5 * 60_000,
+    downstream_cycle: 10 * 60_000,
+};
+export function readCodexWorkerLiveness(workspaceDir) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(path.resolve(workspaceDir), '.state', LIVENESS_FILE), 'utf8'));
+        return isPlainRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
 function workerLogger(logger) {
     return logger ?? {
         info: () => undefined,
@@ -44,6 +71,46 @@ function directoryExists(dir) {
         return false;
     }
 }
+function writeLiveness(workspaceDir, patch) {
+    try {
+        const root = path.resolve(workspaceDir);
+        const stateDir = path.join(root, '.state');
+        const file = path.join(stateDir, LIVENESS_FILE);
+        // The subpath is a constant, so containment always holds — the explicit
+        // check keeps the write boundary auditable (defense in depth).
+        if (!file.startsWith(root + path.sep))
+            return;
+        if (!directoryExists(stateDir))
+            fs.mkdirSync(stateDir, { recursive: true });
+        let current = {};
+        try {
+            const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (isPlainRecord(parsed))
+                current = parsed;
+        }
+        catch {
+            current = {};
+        }
+        const merged = { ...current, ...patch, updatedAt: new Date().toISOString() };
+        // CodeQL (insecure temporary file): the fixed predictable `.tmp` name is a
+        // symlink-swap surface in a shared state dir. Write+rename through an
+        // EXCLUSIVE random temp file in the same directory (O_EXCL | 0600) — the
+        // rename stays atomic within the directory.
+        const tmp = path.join(stateDir, `${LIVENESS_FILE}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 10)}.tmp`);
+        const fd = fs.openSync(tmp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
+        try {
+            fs.writeFileSync(fd, JSON.stringify(merged));
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(tmp, file);
+    }
+    catch {
+        // liveness bookkeeping must never break the cycle (rc-9: the cycle report
+        // itself remains the observable degradation channel)
+    }
+}
 /**
  * Oldest pending diagnostician first; retry_wait candidates are filtered to
  * those whose backoff window has ELAPSED, so an old-but-still-waiting task
@@ -51,18 +118,42 @@ function directoryExists(dir) {
  * bounded (`limit`), and executePendingDiagnosis re-enforces the backoff
  * window on the chosen task — no double bookkeeping.
  */
-async function pickDiagnosticianCandidate(stateManager, limit) {
+const DIAGNOSTICIAN_FAIR_SHARE_SCOPE = 'codex-worker-diagnostician-fair-share';
+/**
+ * SPEC §9.1 fair-share pick (review P1): pending and due-retry are both
+ * continuously-eligible classes; neither may starve the other while new
+ * pending signals keep arriving. A persistent round-robin cursor (stored in
+ * the existing reconciliation_cursor authority, so a worker restart does NOT
+ * reset it to pending-priority) alternates service between the two classes —
+ * each eligible class is served at least every other cycle, well inside the
+ * 3-full-cycle bound. Single-eligible work is always served.
+ */
+async function pickDiagnosticianCandidate(stateManager, limit, nowIso) {
     const pending = await stateManager.listTasks({ taskKind: 'diagnostician', status: 'pending', orderBy: 'updated_at_asc', limit });
-    const [first] = pending;
-    if (first !== undefined)
-        return first;
+    const [pendingTask] = pending;
+    let retryTask = null;
     const retrying = await stateManager.listTasks({ taskKind: 'diagnostician', status: 'retry_wait', orderBy: 'updated_at_asc', limit });
     for (const candidate of retrying) {
         if (isRetryWaitBackoffElapsed(candidate.status, candidate.leaseExpiresAt)) {
-            return candidate;
+            retryTask = candidate;
+            break;
         }
     }
-    return null;
+    if (pendingTask === undefined && retryTask === null)
+        return null;
+    if (retryTask === null) {
+        await stateManager.setDiagnosticianServiceCursor(DIAGNOSTICIAN_FAIR_SHARE_SCOPE, { lastUpdatedAt: nowIso, lastTaskId: 'pending' });
+        return pendingTask ?? null;
+    }
+    if (pendingTask === undefined) {
+        await stateManager.setDiagnosticianServiceCursor(DIAGNOSTICIAN_FAIR_SHARE_SCOPE, { lastUpdatedAt: nowIso, lastTaskId: 'retry_wait' });
+        return retryTask;
+    }
+    const cursor = await stateManager.getDiagnosticianServiceCursor(DIAGNOSTICIAN_FAIR_SHARE_SCOPE);
+    const serveRetryFirst = cursor?.lastTaskId !== 'retry_wait';
+    const servedClass = serveRetryFirst ? 'retry_wait' : 'pending';
+    await stateManager.setDiagnosticianServiceCursor(DIAGNOSTICIAN_FAIR_SHARE_SCOPE, { lastUpdatedAt: nowIso, lastTaskId: servedClass });
+    return serveRetryFirst ? retryTask : pendingTask;
 }
 /**
  * Run ONE bounded worker cycle for a canonical workspace. Never throws:
@@ -73,6 +164,7 @@ export async function runCodexWorkspaceWorkerCycle(options) {
     const logger = workerLogger(options.logger);
     const emitEvent = options.emitEvent ?? ((_event, _payload) => undefined);
     const base = { workspaceDir };
+    const cycleStartedAt = new Date();
     // Step 1 — Workspace eligibility.
     if (!directoryExists(workspaceDir)) {
         return { ...base, mode: 'degraded', reason: 'workspace_missing', nextAction: 'The workspace directory no longer exists; remove it from the install manifest or restore it. No PD state was mutated.' };
@@ -86,6 +178,13 @@ export async function runCodexWorkspaceWorkerCycle(options) {
     if (flags['host.codex']?.enabled !== true) {
         return { ...base, mode: 'paused', reason: 'host.codex_disabled', nextAction: 'Set features.host.codex.enabled=true in the Workspace .pd/config.yaml to enable Codex PD behavior.' };
     }
+    // CR-08: liveness bookkeeping starts only after the workspace proved
+    // eligible — writing into a missing workspace directory would fabricate it.
+    writeLiveness(workspaceDir, {
+        lastCycleStartedAt: cycleStartedAt.toISOString(),
+        runningStage: 'catch_up',
+        stageDeadline: new Date(cycleStartedAt.getTime() + LIVENESS_STAGE_DEADLINE_MS.catch_up).toISOString(),
+    });
     const consumerFlag = loadFeatureFlagFromConfig(workspaceDir, 'internalization_auto_consumer', { info: (m) => logger.info(m), warn: (m) => logger.warn(m) });
     // PRI-638 P1-C: the Diagnostician capability gate is resolved from the same
     // canonical authority the runtime factory uses. An Owner-disabled agent is
@@ -128,7 +227,7 @@ export async function runCodexWorkspaceWorkerCycle(options) {
             mode: 'paused',
             reason: 'internalization_auto_consumer_disabled',
             nextAction: 'Automatic internalization execution is paused for this Workspace; manual commands remain available: pd diagnose, pd runtime internalization run-once.',
-            report: { catchUp, reconcile, diagnostician: null, downstream: null },
+            report: { catchUp, reconcile, postProcessing: null, diagnostician: null, downstream: null },
         };
     }
     else {
@@ -144,7 +243,7 @@ export async function runCodexWorkspaceWorkerCycle(options) {
                 if (sweep.recovered > 0 || sweep.errors.length > 0) {
                     emitEvent('CODEX_WORKER_RECOVERY_SWEEP', JSON.stringify({ recovered: sweep.recovered, failed: sweep.errors.length }));
                 }
-                const candidate = await pickDiagnosticianCandidate(handle.stateManager, options.diagnosticianCandidateLimit ?? DEFAULT_DIAG_CANDIDATE_LIMIT);
+                const candidate = await pickDiagnosticianCandidate(handle.stateManager, options.diagnosticianCandidateLimit ?? DEFAULT_DIAG_CANDIDATE_LIMIT, new Date().toISOString());
                 if (candidate !== null) {
                     const stateDir = path.join(workspaceDir, '.state');
                     const bridge = await createPainSignalBridge({
@@ -196,7 +295,82 @@ export async function runCodexWorkspaceWorkerCycle(options) {
                 mode: 'degraded',
                 reason: `diagnostician_execution_failed:${detail}`,
                 nextAction: 'Inspect the Workspace runtime profile and provider configuration; the task keeps its pending/retry state and no evidence was mutated.',
-                report: { catchUp, reconcile, diagnostician: null, downstream: null },
+                report: { catchUp, reconcile, postProcessing: null, diagnostician: null, downstream: null },
+            };
+        }
+    }
+    // Step 6b — SPEC-CODEX-PAIN-CLOSURE-001 CR-05 (SPEC §9.1): continue the
+    // post-processing of SUCCEEDED diagnoses (candidates stuck before
+    // admission/intake/seed — the original incident shape) without re-running
+    // the diagnosis LLM. Runs in the SAME consumer-flag authority as fresh
+    // diagnoses; every class (pending / due-retry / post-processing) is served
+    // every cycle it has eligible work, so no class can starve another
+    // (SPEC §9.1: each eligible class served within 3 full cycles).
+    let postProcessing = null;
+    writeLiveness(workspaceDir, { runningStage: 'post_processing', stageDeadline: new Date(Date.now() + LIVENESS_STAGE_DEADLINE_MS.post_processing).toISOString() });
+    if (consumerFlag.enabled && !diagnosticianDisabled) {
+        try {
+            const handle = await createRuntimeStateHandle({ workspaceDir, readonly: false });
+            try {
+                const { eligible: backlog, corrupt } = await handle.stateManager.listDiagnosisPostProcessingBacklog({ limit: DEFAULT_POST_PROCESSING_LIMIT });
+                const { eligible: backlogAll, corrupt: corruptAll } = await handle.stateManager.listDiagnosisPostProcessingBacklog({ limit: 200 });
+                const oldestCreatedAt = backlogAll[0]?.createdAt;
+                const blocked = [];
+                // SPEC review round-4 P1: corrupt admission_json rows are surfaced as a
+                // candidate-level queryable blocker — never deleted, never eligible for
+                // writes, never blocking healthy work (the scan filters via json_valid).
+                for (const item of corruptAll) {
+                    blocked.push({ candidateId: item.candidateId, reason: 'admission_json_corrupt: repair or re-run the diagnosis (pd candidate show reports the unreadable disposition)' });
+                }
+                const resumedTaskIds = new Set();
+                if (backlog.length > 0) {
+                    const stateDir = path.join(workspaceDir, '.state');
+                    const bridge = await createPainSignalBridge({
+                        workspaceDir,
+                        stateDir,
+                        ledgerAdapter: new PrincipleTreeLedgerAdapter({ stateDir }),
+                        owner: WORKER_OWNER,
+                        effectiveConfig: config.effective,
+                        getEnvVar: (name) => process.env[name],
+                    });
+                    for (const item of backlog) {
+                        const resumed = await bridge.resumeSucceededDiagnosisPostProcessing({ taskId: item.taskId });
+                        if (resumed.status === 'resumed') {
+                            resumedTaskIds.add(item.taskId);
+                        }
+                        else if (resumed.status === 'blocked') {
+                            blocked.push({ candidateId: item.candidateId, reason: resumed.reason ?? 'blocked' });
+                        }
+                        for (const skip of resumed.skipped ?? [])
+                            blocked.push(skip);
+                    }
+                }
+                postProcessing = {
+                    resumedTaskIds: [...resumedTaskIds],
+                    processedCount: backlog.length,
+                    remainingCount: Math.max(0, backlogAll.length - backlog.length),
+                    oldestAgeMs: oldestCreatedAt !== undefined ? Math.max(0, Date.now() - Date.parse(oldestCreatedAt)) : null,
+                    blocked,
+                };
+                if (corrupt.length > 0) {
+                    emitEvent('CODEX_WORKER_ADMISSION_CORRUPT', JSON.stringify({ candidateIds: corruptAll.map((c) => c.candidateId) }));
+                }
+                if (backlog.length > 0) {
+                    emitEvent('CODEX_WORKER_POST_PROCESSING', JSON.stringify(postProcessing));
+                }
+            }
+            finally {
+                await handle.close().catch(() => undefined);
+            }
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200);
+            return {
+                ...base,
+                mode: 'degraded',
+                reason: `post_processing_continuation_failed:${detail}`,
+                nextAction: 'Inspect the workspace state.db principle_candidates/tasks; the worker retries automatically on the next cycle.',
+                report: { catchUp, reconcile, postProcessing: null, diagnostician, downstream: null },
             };
         }
     }
@@ -223,9 +397,10 @@ export async function runCodexWorkspaceWorkerCycle(options) {
             mode: 'degraded',
             reason: `host_tool_declaration_persist_failed:${declared.reason}`,
             nextAction: 'Repair Codex host declaration persistence (.pd/host-tool-semantics/codex.json) before running the downstream internalization cycle; the worker retries automatically on the next cycle.',
-            report: { catchUp, reconcile, diagnostician, downstream: null },
+            report: { catchUp, reconcile, postProcessing: null, diagnostician, downstream: null },
         };
     }
+    writeLiveness(workspaceDir, { runningStage: 'downstream_cycle', stageDeadline: new Date(Date.now() + LIVENESS_STAGE_DEADLINE_MS.downstream_cycle).toISOString() });
     const downstream = await runInternalizationConsumerCycle(workspaceDir, {
         owner: WORKER_OWNER,
         logLabel: 'CodexWorker',
@@ -249,11 +424,19 @@ export async function runCodexWorkspaceWorkerCycle(options) {
                 : diagnostician?.status === 'degraded' ? `diagnostician_degraded:${diagnostician.message ?? 'unknown'}`
                     : downstream.skipReason === 'runtime_config_error' || downstream.skipReason === 'cycle_error' || downstream.skipReason === 'config_malformed' ? `downstream:${downstream.skipReason}`
                         : undefined;
+    writeLiveness(workspaceDir, {
+        runningStage: null,
+        stageDeadline: null,
+        lastCycleCompletedAt: new Date().toISOString(),
+        lastCycleDurationMs: Date.now() - cycleStartedAt.getTime(),
+        lastCycleMode: degradedReason !== undefined ? 'degraded' : 'ready',
+        ...(degradedReason !== undefined ? { lastDegradedReason: degradedReason } : {}),
+    });
     return {
         ...base,
         mode: degradedReason !== undefined ? 'degraded' : 'ready',
         ...(degradedReason !== undefined ? { reason: degradedReason, nextAction: 'Inspect the Workspace .pd/config.yaml runtime profile and the per-step report above; the worker retries automatically on the next cycle.' } : {}),
-        report: { catchUp, reconcile, diagnostician, downstream },
+        report: { catchUp, reconcile, postProcessing, diagnostician, downstream },
     };
 }
 // Slice D (PRI-625): the mode authority moved to host-runtime so the CLI and

package/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/codex-adapter",
-  "version": "0.5.2",
+  "version": "0.5.5",
   "description": "Codex CLI host adapter for Principles Disciple — implements HostAdapter interface for OpenAI Codex CLI's stdin/stdout JSON hook model (ADR-0020).",
   "type": "module",
   "main": "./dist/index.js",
@@ -22,7 +22,9 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE",
+    "NOTICE"
   ],
   "scripts": {
     "build": "tsc",
@@ -38,10 +40,10 @@
   "devDependencies": {
     "@types/node": "^26.4.1",
     "typescript": "^7.0.2",
-    "vite": "^8.3.0",
+    "vite": "^8.3.4",
     "vitest": "^5.0.0"
   },
-  "license": "MIT",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/csuzngjh/principles.git",

package/console/dist/server/models/ApprovalsConsoleModel.d.ts

@@ -78,12 +78,12 @@ export type ApproveWithActivationResult = {
     capacity: {
         category: 'single_item_exceeds_budget' | 'route_unconfirmed' | 'content_unconfirmed';
         route?: 'legacy_trim' | 'shared_render';
-        hostKind?: 'openclaw' | 'codex';
+        hostKind?: 'openclaw' | 'codex' | 'workbuddy';
         budget?: number;
         costChars?: number;
         overByChars?: number;
         perHost?: {
-            hostKind: 'openclaw' | 'codex';
+            hostKind: 'openclaw' | 'codex' | 'workbuddy';
             fits: boolean;
             costChars: number;
         }[];

package/console/dist/server/models/ApprovalsConsoleModel.js

@@ -306,7 +306,7 @@ export class ApprovalsConsoleModel {
             return `injection_budget_check_failed: could not recompute the prompt injection projection (${message}); the activation is committed but its injection status is unverified. nextAction=check .pd/state.db readability and re-run pd runtime activation list`;
         }
         if (resolution.status === 'unconfirmed') {
-            return `injection_capacity_unconfirmed: the activation is committed but this workspace's effective injection route cannot be confirmed (${resolution.decision.unconfirmedReason ?? 'unknown reason'}); per-host forecasts: ${resolution.perHost.map((entry) => `${entry.hostKind}=${entry.projection.route} (${entry.projection.usedChars}c${entry.projection.truncated ? ', truncated' : ''})`).join('; ')}. nextAction=${resolution.decision.nextAction ?? 'pass an explicit target host (openclaw|codex)'}`;
+            return `injection_capacity_unconfirmed: the activation is committed but this workspace's effective injection route cannot be confirmed (${resolution.decision.unconfirmedReason ?? 'unknown reason'}); per-host forecasts: ${resolution.perHost.map((entry) => `${entry.hostKind}=${entry.projection.route} (${entry.projection.usedChars}c${entry.projection.truncated ? ', truncated' : ''})`).join('; ')}. nextAction=${resolution.decision.nextAction ?? 'pass an explicit target host (openclaw|codex|workbuddy)'}`;
         }
         const { projection } = resolution;
         if (projection.injectedActivationIds.includes(activationId)) {

package/console/dist/server/models/ApprovalsGroupedConsoleModel.js

@@ -363,7 +363,7 @@ export class ApprovalsGroupedConsoleModel {
                         truncated: reference?.truncated ?? false,
                         capacityStatus: 'unconfirmed',
                         unconfirmedReason: resolution.decision.unconfirmedReason ?? 'effective injection route cannot be confirmed',
-                        nextAction: resolution.decision.nextAction ?? 'pass an explicit target host (openclaw|codex)',
+                        nextAction: resolution.decision.nextAction ?? 'pass an explicit target host (openclaw|codex|workbuddy)',
                         perHost: resolution.perHost.map((entry) => ({
                             hostKind: entry.hostKind,
                             route: entry.projection.route,

package/console/dist/server/models/PrinciplesConsoleModel.d.ts

@@ -32,6 +32,15 @@ export interface PrincipleListItem {
     conflictsWithCount: number;
     createdAt: string;
     updatedAt: string;
+    /**
+     * PRI-956 (F15): the ledger `status` is an ASSET lifecycle ("ingested &
+     * not archived") and has no deactivated value — a deactivated principle
+     * stays `active` here forever. When the runtime authority (activations
+     * table) says every prompt activation for this principle is deactivated,
+     * the route annotates it so the UI can disclose "runtime revoked" instead
+     * of implying "in effect" from the asset status alone.
+     */
+    runtimeDeactivated?: boolean;
     /** Detected language of the principle text ('en' | 'zh' | 'unknown'). PRI-332 */
     detectedLanguage: 'en' | 'zh' | 'unknown';
     /** Structured readability warning code — front-end renders via i18n. PRI-332 P1-5 */
@@ -72,6 +81,13 @@ export interface PrinciplesListOutput {
     categories?: Record<string, number>;
     /** If the approval cross-check was unavailable, this explains why (ERR-002) */
     approvalCrossCheckUnavailable?: string;
+    /**
+     * PRI-956 (F15, D3): if the activations-table query that determines
+     * CURRENT runtime revocation was unavailable, this explains why — the UI
+     * must express "runtime status cannot be confirmed" instead of defaulting
+     * to either active or revoked.
+     */
+    revocationCheckUnavailable?: string;
 }
 export type PrincipleFilter = 'all' | 'actionable';
 export interface PrincipleDetailOutput {
@@ -86,7 +102,16 @@ export declare class PrinciplesConsoleModel {
     constructor(workspaceDir: string);
     private getLedgerPath;
     private loadLedger;
-    listPrinciples(filter?: PrincipleFilter, decidedPrincipleIds?: Set<string>, pendingApprovalPrincipleIds?: Set<string>): Promise<PrinciplesListOutput>;
+    /**
+     * PRI-956 (F15): decision-id sets from the route's cross-checks. All
+     * optional; `deactivated` comes from the activations table (runtime
+     * authority) and only annotates disclosure — never re-buckets.
+     */
+    listPrinciples(filter?: PrincipleFilter, decisionIds?: {
+        decided?: Set<string>;
+        pendingApproval?: Set<string>;
+        deactivated?: Set<string>;
+    }): Promise<PrinciplesListOutput>;
     getPrincipleDetail(principleId: string): Promise<PrincipleDetailOutput | null>;
     archivePrinciple(principleId: string): Promise<boolean>;
     unarchivePrinciple(principleId: string): Promise<boolean>;

package/console/dist/server/models/PrinciplesConsoleModel.js

@@ -148,7 +148,15 @@ export class PrinciplesConsoleModel {
         this.cacheTimestamp = now;
         return ledger;
     }
-    async listPrinciples(filter, decidedPrincipleIds, pendingApprovalPrincipleIds) {
+    /**
+     * PRI-956 (F15): decision-id sets from the route's cross-checks. All
+     * optional; `deactivated` comes from the activations table (runtime
+     * authority) and only annotates disclosure — never re-buckets.
+     */
+    async listPrinciples(filter, decisionIds) {
+        const decidedPrincipleIds = decisionIds?.decided;
+        const pendingApprovalPrincipleIds = decisionIds?.pendingApproval;
+        const deactivatedPrincipleIds = decisionIds?.deactivated;
         const ledger = this.loadLedger();
         const principles = Object.values(ledger.tree.principles);
         const items = [];
@@ -185,6 +193,15 @@ export class PrinciplesConsoleModel {
         const classified = classifyPrinciples(items, decidedPrincipleIds, pendingApprovalPrincipleIds);
         const workspaceClassified = classified.filter((c) => c.category !== 'builtin');
         const workspaceItems = workspaceClassified.map((c) => c.principle);
+        // PRI-956 (F15): disclose runtime revocation — the ledger status above is
+        // asset lifecycle and never reflects deactivation; the runtime authority
+        // (activations table) is the only source for "currently revoked".
+        if (deactivatedPrincipleIds) {
+            for (const p of workspaceItems) {
+                if (deactivatedPrincipleIds.has(p.id))
+                    p.runtimeDeactivated = true;
+            }
+        }
         // PRI-641: summary and categories are computed over the same workspace
         // corpus the caller sees, so `principles[]` and `summary` can never
         // disagree (no "list 3, total 13" projection).

package/console/dist/server/routes/activations.js

@@ -99,8 +99,8 @@ export async function handleActivationsRoute(req, res, workspaceDir, subPath, au
         let targetHost;
         const rawHost = url.searchParams.get('host');
         if (rawHost !== null) {
-            if (rawHost !== 'openclaw' && rawHost !== 'codex') {
-                sendError(res, 400, 'validation_error', 'host must be one of: openclaw, codex');
+            if (rawHost !== 'openclaw' && rawHost !== 'codex' && rawHost !== 'workbuddy') {
+                sendError(res, 400, 'validation_error', 'host must be one of: openclaw, codex, workbuddy');
                 return;
             }
             targetHost = rawHost;
@@ -242,8 +242,8 @@ export async function handleActivationsRoute(req, res, workspaceDir, subPath, au
         }
         let targetHost;
         if (Object.hasOwn(body, 'host')) {
-            if (body.host !== 'openclaw' && body.host !== 'codex') {
-                sendError(res, 400, 'validation_error', 'host must be one of: openclaw, codex');
+            if (body.host !== 'openclaw' && body.host !== 'codex' && body.host !== 'workbuddy') {
+                sendError(res, 400, 'validation_error', 'host must be one of: openclaw, codex, workbuddy');
                 return;
             }
             targetHost = body.host;

package/console/dist/server/routes/approvals.js

@@ -133,8 +133,8 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
             // when the workspace's applicable hosts would take different routes.
             let targetHost;
             if (Object.hasOwn(parsed, 'host')) {
-                if (parsed.host !== 'openclaw' && parsed.host !== 'codex') {
-                    sendBadRequest(res, 'host must be one of: openclaw, codex');
+                if (parsed.host !== 'openclaw' && parsed.host !== 'codex' && parsed.host !== 'workbuddy') {
+                    sendBadRequest(res, 'host must be one of: openclaw, codex, workbuddy');
                     return;
                 }
                 targetHost = parsed.host;

package/console/dist/server/routes/failed-tasks.d.ts

@@ -1,6 +1,15 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { SqliteTaskStore } from '@principles/core/runtime-v2';
 export declare function disposeFailedTasksModels(): void;
+export interface PipelineHealth {
+    status: 'healthy' | 'backlogged' | 'stalled' | 'disabled' | 'unknown';
+    pendingCount: number | null;
+    oldestPendingTaskKind: string | null;
+    oldestPendingAgeMinutes: number | null;
+    lastProgressAt: string | null;
+    note: string;
+    nextAction?: string;
+}
 export type FailedTasksContext = {
     workspaceDir: string;
     subPath: string;

package/console/dist/server/routes/failed-tasks.js

@@ -155,6 +155,104 @@ function parseRecoverBody(body) {
     const force = raw.force === true;
     return { ok: true, reason, force };
 }
+// ── PRI-955 (F11): derived learning-queue health projection ─────────────────
+//
+// "No failed tasks" is NOT "the pipeline is healthy" — the dogfood run
+// (2026-10-13) had a 13-deep pending backlog with downstream stages starving
+// for 35+ minutes while this page reported the pipeline as healthy. The
+// health projection below is DERIVED on read from the same state.db facts the
+// failed-task list already uses (no second truth, no new persistence):
+// - pendingCount: pending runner-kind tasks (the learning queue)
+// - oldestPendingAgeMinutes: queue age of the oldest pending task
+// - lastProgressAt: newest succeeded transition (updated_at of the newest
+//   succeeded task) — evidence that the pipeline actually advanced recently
+// Status rules (documented, never over-claimed):
+//   stalled    — work is waiting AND nothing progressed inside the window
+//   backlogged — work is waiting and the pipeline still progresses
+//   healthy    — nothing waiting AND a succeeded transition inside the window
+//   unknown    — no usable evidence (fresh workspace, unreadable counters)
+const PIPELINE_STALL_WINDOW_MS = 30 * 60 * 1000;
+const PIPELINE_FRESH_WINDOW_MS = 24 * 60 * 60 * 1000;
+function ageMinutes(iso, nowMs) {
+    if (typeof iso !== 'string' || iso.length === 0)
+        return null;
+    const ms = Date.parse(iso);
+    if (!Number.isFinite(ms))
+        return null;
+    return Math.max(0, Math.floor((nowMs - ms) / 60000));
+}
+async function derivePipelineHealth(store, consumerEnabled) {
+    const nowMs = Date.now();
+    try {
+        // C2/C4 (PRI-955 review): exact, untruncated aggregates over the
+        // authoritative tasks table, scoped to learning-pipeline runner kinds —
+        // a global MAX(succeeded) would let unrelated task kinds fake freshness,
+        // and a LIMIT-200 list length would misreport the queue size.
+        const agg = await store.aggregatePipelineHealth();
+        const { pendingCount } = agg;
+        const oldestPendingAgeMinutes = ageMinutes(agg.oldestPendingCreatedAt, nowMs);
+        const lastProgressAgeMinutes = ageMinutes(agg.lastSucceededAt, nowMs);
+        if (!consumerEnabled) {
+            return {
+                status: 'disabled', pendingCount, oldestPendingTaskKind: agg.oldestPendingTaskKind, oldestPendingAgeMinutes, lastProgressAt: agg.lastSucceededAt,
+                note: `内化自动消费者已禁用（internalization_auto_consumer=false）——学习管道不会推进。当前待处理 ${pendingCount} 个。`,
+                nextAction: '在 .pd/config.yaml 设置 features.internalization_auto_consumer.enabled=true，或改用 pd runtime internalization run-once 手动推进。',
+            };
+        }
+        if (pendingCount > 0) {
+            const stalled = (oldestPendingAgeMinutes ?? 0) > PIPELINE_STALL_WINDOW_MS / 60000
+                && (lastProgressAgeMinutes === null || lastProgressAgeMinutes > PIPELINE_STALL_WINDOW_MS / 60000);
+            if (stalled) {
+                return {
+                    status: 'stalled', pendingCount, oldestPendingTaskKind: agg.oldestPendingTaskKind, oldestPendingAgeMinutes, lastProgressAt: agg.lastSucceededAt,
+                    note: `学习队列有 ${pendingCount} 个待处理任务，最老等待 ${oldestPendingAgeMinutes ?? '?'} 分钟，且窗口内无任何推进。`,
+                    nextAction: '检查内化消费者是否在运行（OpenClaw 自动消费 / pd codex worker），并查看任务队列明细。',
+                };
+            }
+            return {
+                status: 'backlogged', pendingCount, oldestPendingTaskKind: agg.oldestPendingTaskKind, oldestPendingAgeMinutes, lastProgressAt: agg.lastSucceededAt,
+                note: `学习队列有 ${pendingCount} 个待处理任务（最老等待 ${oldestPendingAgeMinutes ?? '?'} 分钟）；最近推进 ${agg.lastSucceededAt ?? '未知'}。`,
+                nextAction: '积压会随消费者周期逐步消化；若长时间不降，检查消费者运行状态与模型通道。',
+            };
+        }
+        // PRI-955 review P1: healthy requires NO unresolved states either —
+        // pendingCount=0 + recent success is NOT healthy if failed, NHR, or
+        // retry_wait tasks are still present.
+        if (agg.failedCount > 0 || agg.needsHumanReviewCount > 0 || agg.retryWaitCount > 0) {
+            const parts = [];
+            if (agg.failedCount > 0)
+                parts.push(`${agg.failedCount} 个失败`);
+            if (agg.needsHumanReviewCount > 0)
+                parts.push(`${agg.needsHumanReviewCount} 个需人工审查`);
+            if (agg.retryWaitCount > 0)
+                parts.push(`${agg.retryWaitCount} 个等待重试`);
+            return {
+                status: 'backlogged', pendingCount: 0, oldestPendingTaskKind: null, oldestPendingAgeMinutes: null, lastProgressAt: agg.lastSucceededAt,
+                note: `学习队列无积压，但存在未解决任务：${parts.join('、')}。`,
+                nextAction: '在失败任务列表查看详情，或在治理焦点处理需人工审查的任务。',
+            };
+        }
+        if (lastProgressAgeMinutes !== null && lastProgressAgeMinutes <= PIPELINE_FRESH_WINDOW_MS / 60000) {
+            return {
+                status: 'healthy', pendingCount: 0, oldestPendingTaskKind: null, oldestPendingAgeMinutes: null, lastProgressAt: agg.lastSucceededAt,
+                note: `学习队列无积压；最近推进 ${agg.lastSucceededAt}。`,
+            };
+        }
+        return {
+            status: 'unknown', pendingCount: 0, oldestPendingTaskKind: null, oldestPendingAgeMinutes: null, lastProgressAt: agg.lastSucceededAt,
+            note: '当前没有待处理任务，但窗口内没有可确认的推进证据——无法判定管道健康。',
+            nextAction: '产生一次真实任务（或运行一次内化消费者）后回到本页复查。',
+        };
+    }
+    catch {
+        // rc-9: 降级必须可观察——无法读取队列事实时报告 unknown，而非默认健康。
+        return {
+            status: 'unknown', pendingCount: null, oldestPendingTaskKind: null, oldestPendingAgeMinutes: null, lastProgressAt: null,
+            note: '学习队列状态不可读（计数失败）——无法判定管道健康。',
+            nextAction: '检查 .pd/state.db 可读性，或用 pd health 查看工作区诊断。',
+        };
+    }
+}
 /**
  * Dispatch one recovery attempt through the shared core services.
  *
@@ -341,7 +439,8 @@ export async function handleFailedTasksRoute(req, res, ctx) {
                 sendSuccess(res, {
                     tasks: [],
                     total: 0,
-                    nextAction: 'No failed tasks. PD pipeline is healthy. (state.db not yet initialized — no tasks have been created.)',
+                    pipeline: { status: 'unknown', pendingCount: null, oldestPendingTaskKind: null, oldestPendingAgeMinutes: null, lastProgressAt: null, note: 'state.db 尚未初始化——工作区还没有任何任务，管道健康状态未知。', nextAction: '运行时开始创建任务后回到本页复查。' },
+                    nextAction: 'No failed tasks. (state.db not yet initialized — pipeline health is UNKNOWN until the runtime creates tasks.)',
                 });
                 return;
             }
@@ -363,19 +462,29 @@ export async function handleFailedTasksRoute(req, res, ctx) {
                     ? { ownerDecisionRequired: decisionRequiredIds.has(task.taskId ?? '') }
                     : {}),
             }));
-            // Only report "PD pipeline is healthy" when total === 0. When
-            // tasks.length === 0 but total > 0, the caller has paginated past the
-            // last page — returning "healthy" here would mask the failures that
-            // exist on earlier pages.
+            // PRI-955 (F11): "no failed tasks" ≠ "pipeline healthy" — derive the
+            // learning-queue health projection from the same state.db facts and let
+            // the UI show it next to the empty claim.
+            const consumerFlag = ctx.featureFlags && Object.hasOwn(ctx.featureFlags, 'internalization_auto_consumer')
+                ? ctx.featureFlags.internalization_auto_consumer
+                : undefined;
+            const consumerEnabled = consumerFlag ? consumerFlag.enabled === true : true; // 无该 flag 时无法断言禁用——不因缺失而宣称 disabled
+            const pipeline = await derivePipelineHealth(store, consumerEnabled);
+            // Only claim anything like "healthy" from the pipeline projection, never
+            // from the failed-task count alone. When tasks.length === 0 but
+            // total > 0, the caller has paginated past the last page.
             if (total === 0) {
                 sendSuccess(res, {
                     tasks: enriched,
                     total,
-                    nextAction: 'No failed tasks. PD pipeline is healthy.',
+                    pipeline,
+                    nextAction: pipeline.status === 'healthy'
+                        ? `No failed tasks in the queried range. ${pipeline.note}`
+                        : `No failed tasks in the queried range. Pipeline status: ${pipeline.status} — ${pipeline.note}`,
                 });
             }
             else {
-                sendSuccess(res, { tasks: enriched, total });
+                sendSuccess(res, { tasks: enriched, total, pipeline });
             }
         }
         catch (err) {