create-principles-disciple 1.145.1 → 1.145.4

package/core/dist/runtime-v2/internalization/consumer-evidence-preflight.js

@@ -0,0 +1,284 @@
+import { assessEvidenceReadiness, } from './evidence-readiness.js';
+import { buildArtificerRunCorrelation } from './artificer-run-correlation.js';
+import { PDRuntimeError } from '../error-categories.js';
+import { createPITaskDiagnosticJson, mergePITaskMetadata, hydratePITaskRecord, parseSeedSourcePainId } from './pitask-metadata.js';
+/**
+ * Resolve the canonical Pain from the trusted seed along the persisted
+ * predecessor graph. Never infer Pain from model output or the Owner's
+ * selection. Multiple conflicting seeds and unresolvable ancestry fail closed.
+ */
+export async function resolveArtificerCanonicalPainId(taskId, getTask) {
+    const pending = [taskId];
+    const seen = new Set();
+    const pains = new Set();
+    while (pending.length > 0 && seen.size < 64) {
+        const id = pending.shift();
+        if (id === undefined || seen.has(id))
+            continue;
+        seen.add(id);
+        const task = await getTask(id);
+        if (task === null)
+            return null;
+        const sourcePainId = parseSeedSourcePainId(task.diagnosticJson);
+        if (sourcePainId !== null)
+            pains.add(sourcePainId);
+        const piTask = hydratePITaskRecord(task);
+        if (piTask) {
+            for (const parentId of [piTask.parentTaskId, ...piTask.dependencyTaskIds]) {
+                if (typeof parentId === 'string' && parentId.length > 0 && !seen.has(parentId)) {
+                    pending.push(parentId);
+                }
+            }
+        }
+    }
+    return pending.length === 0 && pains.size === 1 ? [...pains][0] ?? null : null;
+}
+/**
+ * Lineage marker for preflight NHR transitions. Honest by construction: this
+ * is NOT a persisted run id (`run_<taskId>_<attempt>` spelling is reserved
+ * for lease-minted runs — there is no run for a pure preflight block), and
+ * consumer-side recovery classification treats unknown reasonCodes as
+ * recovery-type review, which never resolves artifacts through sourceRunId.
+ */
+export const ARTIFICER_EVIDENCE_NHR_SOURCE_RUN_ID = 'evidence-preflight';
+/** rc-8: bounded single-line detail for metadata payloads. */
+function boundedDetail(value, max = 480) {
+    const flat = value.replace(/\s+/g, ' ').trim();
+    return flat.length > max ? `${flat.slice(0, max)}…[truncated]` : flat;
+}
+/**
+ * FR-04: the persisted NHR diagnostics must name the concrete out-edge — the
+ * `pd runtime internalization retry --confirm` recovery authority
+ * (ownerRetryNeedsHumanReviewTask) and the B1 evidence-attach entry.
+ */
+function withNhrOutEdge(nextAction) {
+    return `${nextAction} Out-edge once evidence is attached (or to abandon this review): pd runtime internalization retry --confirm.`;
+}
+function readDiagnosticJson(task) {
+    const raw = task.diagnosticJson;
+    return typeof raw === 'string' && raw.trim() !== '' ? raw : null;
+}
+/**
+ * SPEC-PD-IAER-001 §6.3: the exact set of statuses a task may sit in when the
+ * consumer preflight reaches it — `InternalizationOrchestrator.findCandidates`
+ * scans pending AND retry_wait, and the preflight runs on the dry-run wake of
+ * those candidates. The NHR transition may only land from a WAKE-ELIGIBLE
+ * status: `acquireLease` moves a task to `leased` WITHOUT touching
+ * diagnostic_json, so a consumer that read the task before another consumer
+ * leased it must LOSE this write (rc-9: observable lost race) instead of
+ * writing needs_human_review over an actively leased task.
+ */
+const WAKE_ELIGIBLE_NHR_SOURCES = ['pending', 'retry_wait'];
+/**
+ * Atomic needs_human_review transition (evaluator-runner NHR precedent):
+ * status + humanReviewContext in ONE CAS-guarded metadata write, then the
+ * read-back invariant (INV-2 class: only a durable effect may be reported).
+ *
+ * §6.3 status precondition: the store CAS takes a single expected-status
+ * literal, so the two wake-eligible sources are tried as two individually
+ * atomic conditional UPDATEs over the same read-time diagnosticJson snapshot.
+ * A task concurrently leased/moved by another consumer matches neither
+ * precondition → the write loses and `false` is reported — never a partial
+ * or clobbering effect.
+ */
+async function transitionToNeedsHumanReview(params, context) {
+    const { taskId, piTask, stateManager } = params;
+    const merged = mergePITaskMetadata(piTask, { humanReviewContext: context });
+    const patch = {
+        status: 'needs_human_review',
+        diagnosticJson: createPITaskDiagnosticJson(merged),
+    };
+    const expectedDiagnosticJson = readDiagnosticJson(piTask);
+    let updated = null;
+    for (const expectedStatus of WAKE_ELIGIBLE_NHR_SOURCES) {
+        updated = await stateManager.updateTaskIfDiagnosticJsonUnchanged(taskId, expectedDiagnosticJson, patch, { expectedStatus });
+        if (updated !== null) {
+            break;
+        }
+    }
+    if (!updated) {
+        return false;
+    }
+    const current = await stateManager.getTask(taskId);
+    if (!current || current.status !== 'needs_human_review') {
+        throw new PDRuntimeError('storage_unavailable', `needs_human_review effect not durable for task ${taskId} (read-back status: ${current?.status ?? 'task_missing'})`);
+    }
+    return true;
+}
+/**
+ * Run the evidence readiness preflight for one code_tool_hook Artificer task.
+ * The caller owns channel resolution (pi_metadata.channel ===
+ * 'code_tool_hook'); this module never re-guesses channels.
+ */
+export async function preflightArtificerOwnerEvidence(params) {
+    const { taskId, piTask, owner, workspaceDir, eventEmitter, behaviorEvidence } = params;
+    // 1. Host assembly gap — never misread as "Owner has not labeled" (§6.2).
+    if (behaviorEvidence === undefined) {
+        return { decision: 'evidence_source_unavailable' };
+    }
+    const selection = piTask.ownerEvidenceSelection;
+    let readiness = assessEvidenceReadiness({
+        channelRequiresOwnerEvidence: true,
+        ownerSelection: selection ?? null,
+        assemblePack: selection !== undefined ? () => behaviorEvidence.assemble(selection) : undefined,
+    });
+    // The persisted digest is an Owner confirmation, not just a syntactic field.
+    // The trajectory may change AFTER resume and BEFORE the next consumer wake.
+    // An assembled but changed pack must never enter the model (TOCTOU guard).
+    if (readiness.status === 'ready'
+        && selection?.contentDigest !== undefined
+        && readiness.evidenceHash !== selection.contentDigest) {
+        readiness = {
+            status: 'invalid_evidence',
+            reasonCode: 'owner_behavior_examples_stale',
+            detail: 'assembled evidence digest differs from the Owner-confirmed digest',
+            nextAction: 'Evidence changed after Owner confirmation; re-attach fresh examples, verify and resume.',
+        };
+    }
+    if (readiness.status === 'ready') {
+        const canonicalPainId = await resolveArtificerCanonicalPainId(taskId, (id) => params.stateManager.getTask(id));
+        if (canonicalPainId === null || canonicalPainId !== readiness.sourcePainId) {
+            readiness = {
+                status: 'invalid_evidence',
+                reasonCode: 'owner_behavior_examples_scope_mismatch',
+                detail: 'Owner evidence Pain does not match a unique canonical task seed Pain',
+                nextAction: 'Inspect the task lineage and reselect evidence for its canonical source Pain.',
+            };
+        }
+    }
+    // Telemetry (FR-08): the gate ran — record the verdict with the unified
+    // run-correlation block (PRI-984; persistentRunId/adapterRunId are
+    // semantically absent pre-lease, see artificer-run-correlation.ts) + stable
+    // reasonCode + bounded references, never raw trajectories. reasonCode is
+    // the FR-04 code where one exists, otherwise the gate status itself
+    // ('ready'; 'not_applicable' cannot occur for this hard-coded channel gate
+    // and throws below).
+    eventEmitter.emitTelemetry({
+        eventType: 'artificer_evidence_readiness_checked',
+        traceId: taskId,
+        timestamp: new Date().toISOString(),
+        sessionId: owner,
+        agentId: 'artificer',
+        payload: {
+            ...buildArtificerRunCorrelation({
+                taskId,
+                attemptNumber: piTask.attemptCount,
+                executionMode: 'preflight',
+                reasonCode: readiness.status === 'owner_evidence_required' || readiness.status === 'invalid_evidence'
+                    ? readiness.reasonCode
+                    : readiness.status,
+                workspaceDir,
+                evidenceDigest: readiness.status === 'ready' ? readiness.evidenceHash : undefined,
+            }),
+            channel: 'code_tool_hook',
+            gateStatus: readiness.status,
+            ...(readiness.status === 'owner_evidence_required' ? { missingFields: [...readiness.missingFields] } : {}),
+            ...(readiness.status === 'invalid_evidence' ? { detail: boundedDetail(readiness.detail) } : {}),
+            ...(readiness.status === 'ready' ? { evidenceHash: readiness.evidenceHash, sourcePainId: readiness.sourcePainId } : {}),
+        },
+    });
+    if (readiness.status === 'ready') {
+        return {
+            decision: 'ready',
+            pack: readiness.pack,
+            evidenceHash: readiness.evidenceHash,
+            sourcePainId: readiness.sourcePainId,
+        };
+    }
+    if (readiness.status === 'not_applicable') {
+        // Unreachable by construction (channelRequiresOwnerEvidence is hard-coded
+        // true) — fail loud rather than silently proceeding evidence-less.
+        throw new PDRuntimeError('input_invalid', 'evidence preflight returned not_applicable for a code_tool_hook task — channel gate caller bug');
+    }
+    if (readiness.status === 'evidence_source_error') {
+        // PRI-980 review P2-1 — SPEC §6.2 case 3: a storage/I-O failure of the
+        // evidence source is preserved AS a storage fault. Same family as the
+        // absent port: the task stays wake-eligible (pending/retry_wait — the
+        // next cycle retries the assembly at zero model cost), NO NHR write, NO
+        // owner-fault reasonCode ever reaches the task. rc-9: the degradation is
+        // observable through the registered crash-durable blocked event carrying
+        // the storage reasonCode (never an FR-04 code) + nextAction; a concurrent
+        // write race is moot here because nothing is written.
+        eventEmitter.emitTelemetry({
+            eventType: 'artificer_blocked_on_owner_evidence',
+            traceId: taskId,
+            timestamp: new Date().toISOString(),
+            sessionId: owner,
+            agentId: 'artificer',
+            payload: {
+                ...buildArtificerRunCorrelation({
+                    taskId,
+                    attemptNumber: piTask.attemptCount,
+                    executionMode: 'preflight',
+                    reasonCode: 'evidence_source_error',
+                    workspaceDir,
+                }),
+                nextAction: readiness.nextAction,
+                detail: boundedDetail(readiness.detail),
+                reviewPersisted: false,
+            },
+        });
+        return {
+            decision: 'evidence_source_error',
+            reason: 'evidence_source_error',
+            nextAction: readiness.nextAction,
+            detail: boundedDetail(readiness.detail),
+        };
+    }
+    const blocked = readiness.status === 'owner_evidence_required'
+        ? {
+            reasonCode: readiness.reasonCode,
+            nextAction: withNhrOutEdge(readiness.nextAction),
+            missingFields: readiness.missingFields,
+        }
+        : {
+            reasonCode: readiness.reasonCode,
+            nextAction: withNhrOutEdge(readiness.nextAction),
+            detail: boundedDetail(readiness.detail),
+        };
+    const reviewContext = {
+        reasonCode: blocked.reasonCode,
+        sourceRunId: ARTIFICER_EVIDENCE_NHR_SOURCE_RUN_ID,
+        revisionEpoch: piTask.revisionCount ?? 0,
+        detail: boundedDetail(JSON.stringify({
+            missingFields: blocked.missingFields,
+            ...(blocked.detail !== undefined ? { detail: blocked.detail } : {}),
+            nextAction: blocked.nextAction,
+        })),
+        createdAt: new Date().toISOString(),
+    };
+    const reviewPersisted = await transitionToNeedsHumanReview(params, reviewContext);
+    // Owner-recovery evidence: must be durably observable even if the process
+    // dies right after the state transition. Carries the FR-08 correlation
+    // block (persistentRunId stays absent: the block happened pre-lease — no
+    // run row exists and none may be fabricated).
+    eventEmitter.emitTelemetry({
+        eventType: 'artificer_blocked_on_owner_evidence',
+        traceId: taskId,
+        timestamp: new Date().toISOString(),
+        sessionId: owner,
+        agentId: 'artificer',
+        payload: {
+            ...buildArtificerRunCorrelation({
+                taskId,
+                attemptNumber: piTask.attemptCount,
+                executionMode: 'preflight',
+                reasonCode: blocked.reasonCode,
+                workspaceDir,
+            }),
+            nextAction: blocked.nextAction,
+            ...(blocked.missingFields !== undefined ? { missingFields: [...blocked.missingFields] } : {}),
+            ...(blocked.detail !== undefined ? { detail: blocked.detail } : {}),
+            reviewPersisted,
+        },
+    });
+    return {
+        decision: 'blocked',
+        reasonCode: blocked.reasonCode,
+        nextAction: blocked.nextAction,
+        ...(blocked.missingFields !== undefined ? { missingFields: blocked.missingFields } : {}),
+        ...(blocked.detail !== undefined ? { detail: blocked.detail } : {}),
+        reviewPersisted,
+    };
+}
+//# sourceMappingURL=consumer-evidence-preflight.js.map

package/core/dist/runtime-v2/internalization/consumer-evidence-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-evidence-preflight.js","sourceRoot":"","sources":["../../../src/runtime-v2/internalization/consumer-evidence-preflight.ts"],"names":[],"mappings":"AAkDA,OAAO,EACL,uBAAuB,GAGxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAKxD,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGnI;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,MAAc,EACd,OAAuD;IAEvD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/E,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,oBAAoB,CAAC;AA0EzE,8DAA8D;AAC9D,SAAS,aAAa,CAAC,KAAa,EAAE,GAAG,GAAG,GAAG;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,GAAG,UAAU,8GAA8G,CAAC;AACrI,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAkB;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;IAChC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAuC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAEhG;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,4BAA4B,CACzC,MAAwC,EACxC,OAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,oBAA6B;QACrC,cAAc,EAAE,0BAA0B,CAAC,MAAM,CAAC;KACnD,CAAC;IACF,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAiF,IAAI,CAAC;IACjG,KAAK,MAAM,cAAc,IAAI,yBAAyB,EAAE,CAAC;QACvD,OAAO,GAAG,MAAM,YAAY,CAAC,mCAAmC,CAC9D,MAAM,EACN,sBAAsB,EACtB,KAAK,EACL,EAAE,cAAc,EAAE,CACnB,CAAC;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACxD,MAAM,IAAI,cAAc,CACtB,qBAAqB,EACrB,kDAAkD,MAAM,uBAAuB,OAAO,EAAE,MAAM,IAAI,cAAc,GAAG,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,MAAwC;IAExC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;IAEvF,0EAA0E;IAC1E,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAChD,IAAI,SAAS,GAAG,uBAAuB,CAAC;QACtC,4BAA4B,EAAE,IAAI;QAClC,cAAc,EAAE,SAAS,IAAI,IAAI;QACjC,YAAY,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/F,CAAC,CAAC;IACH,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO;WAC3B,SAAS,EAAE,aAAa,KAAK,SAAS;WACtC,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;QACxD,SAAS,GAAG;YACV,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,+BAA+B;YAC3C,MAAM,EAAE,mEAAmE;YAC3E,UAAU,EAAE,yFAAyF;SACtG,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAC3D,MAAM,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CACxC,CAAC;QACF,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;YAC3E,SAAS,GAAG;gBACV,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,wCAAwC;gBACpD,MAAM,EAAE,sEAAsE;gBAC9E,UAAU,EAAE,+EAA+E;aAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,mEAAmE;IACnE,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,qBAAqB;IACrB,YAAY,CAAC,aAAa,CAAC;QACzB,SAAS,EAAE,sCAAsC;QACjD,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE;YACP,GAAG,4BAA4B,CAAC;gBAC9B,MAAM;gBACN,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,aAAa,EAAE,WAAW;gBAC1B,UAAU,EAAE,SAAS,CAAC,MAAM,KAAK,yBAAyB,IAAI,SAAS,CAAC,MAAM,KAAK,kBAAkB;oBACnG,CAAC,CAAC,SAAS,CAAC,UAAU;oBACtB,CAAC,CAAC,SAAS,CAAC,MAAM;gBACpB,YAAY;gBACZ,cAAc,EAAE,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAClF,CAAC;YACF,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,SAAS,CAAC,MAAM;YAC5B,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxH;KACF,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,YAAY,EAAE,SAAS,CAAC,YAAY;SACrC,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC1C,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gGAAgG,CAAC,CAAC;IAC9I,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACjD,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,sDAAsD;QACtD,YAAY,CAAC,aAAa,CAAC;YACzB,SAAS,EAAE,qCAAqC;YAChD,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE;gBACP,GAAG,4BAA4B,CAAC;oBAC9B,MAAM;oBACN,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,aAAa,EAAE,WAAW;oBAC1B,UAAU,EAAE,uBAAuB;oBACnC,YAAY;iBACb,CAAC;gBACF,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;gBACvC,eAAe,EAAE,KAAK;aACvB;SACF,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,uBAAuB;YACjC,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAKT,SAAS,CAAC,MAAM,KAAK,yBAAyB;QAChD,CAAC,CAAC;YACE,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC;YAChD,aAAa,EAAE,SAAS,CAAC,aAAa;SACvC;QACH,CAAC,CAAC;YACE,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC;YAChD,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;SACxC,CAAC;IAEN,MAAM,aAAa,GAAuB;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,oCAAoC;QACjD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;QACxC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;YACnC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,4BAA4B,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAElF,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,8CAA8C;IAC9C,YAAY,CAAC,aAAa,CAAC;QACzB,SAAS,EAAE,qCAAqC;QAChD,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE;YACP,GAAG,4BAA4B,CAAC;gBAC9B,MAAM;gBACN,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,aAAa,EAAE,WAAW;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,YAAY;aACb,CAAC;YACF,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,eAAe;SAChB;KACF,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/core/dist/runtime-v2/internalization/evidence-readiness.d.ts

@@ -0,0 +1,170 @@
+import { type BehaviorExamplePack } from './behavior-example-pack.js';
+/**
+ * Owner-labelled evidence selection (FR-03 contract fields). Provided by an
+ * authorized Owner operation — never fabricated by an internal agent.
+ * Shape mirrors the host-side `BehaviorExamplePackAssemblerInput` minus
+ * I/O-only fields, so an assembler can be driven straight from a selection.
+ */
+export interface OwnerEvidenceSelection {
+    /** Canonical pain ID the evidence belongs to (pain lineage root). */
+    readonly sourcePainId: string;
+    /** Owner-selected tool call demonstrating the behaviour to block. */
+    readonly sourceNegativeToolCallId: number;
+    /** Owner-selected tool calls demonstrating the behaviour to allow (1..3, unique). */
+    readonly positiveToolCallIds: readonly number[];
+    /** Owner's natural-language desired outcome — non-empty. */
+    readonly ownerDesiredOutcome: string;
+    /**
+     * B1 (PRI-983, SPEC FR-03): attach revision — 1 on first attach, +1 on every
+     * re-attach. ABSENT = legacy record written before revision tracking.
+     */
+    readonly revision?: number;
+    /**
+     * B1 (FR-03): `sha256:<hex>` content digest over the successfully assembled
+     * pack (canonical JSON, same convention as the readiness verdict hash).
+     * Resume re-assembles and refuses on mismatch — a silently stale reference
+     * can never re-enter the model (FR-03 "拒绝无声复用旧引用").
+     * ABSENT = legacy record; resume refuses un-digested selections.
+     */
+    readonly contentDigest?: string;
+    /**
+     * B1 (FR-03): authorized Owner operation label that wrote this selection
+     * (e.g. `cli:attach` / `cli:attach:<decidedBy>`). Evidence is only written
+     * by an explicit Owner operation — never by an internal agent (C-04).
+     */
+    readonly ownerOperation?: string;
+    /** B1 (FR-03): ISO timestamp of the attach. ABSENT = legacy. */
+    readonly attachedAt?: string;
+}
+/** Stable reason codes (SPEC-PD-IAER-001 FR-04). Do not rename. */
+export type OwnerEvidenceReasonCode = 'owner_behavior_examples_required' | 'owner_behavior_examples_invalid' | 'owner_behavior_examples_stale' | 'owner_behavior_examples_scope_mismatch';
+/** Reserved error name for Owner evidence scope failures. Do not rename. */
+export declare const OWNER_EVIDENCE_SCOPE_ERROR_NAME = "OwnerEvidenceScopeError";
+/**
+ * Structured kinds of a typed evidence-assembly failure:
+ *   - `pain_not_found` / `tool_call_not_found`: the trajectory the selection
+ *     references does not resolve (cleaned or wrong workspace) → the stable
+ *     STALE code (FR-03: a cleaned trajectory must never be silently reused);
+ *   - `session_mismatch`: a selected row belongs to another session → the
+ *     stable SCOPE code (SPEC FR-04 cross pain/session);
+ *   - `evidence_source_error`: the evidence SOURCE itself failed (trajectory
+ *     store I/O: unavailable / locked / read error) → the §6.2 storage-fault
+ *     family, deliberately NOT an FR-04 Owner-fault code. Owner-reviewer
+ *     vocabulary: a PRI-980 review fix separates "Owner labelled bad
+ *     evidence" from "the evidence source could not be read" (§6.2: 保留明确
+ *     的存储故障，不误判为 Owner 尚未标注).
+ *
+ * (The type name predates the storage kind — it is the reserved typed-error
+ * family's stable name; do not rename, the plugin bundle relies on the
+ * structural `name` + kind contract.)
+ */
+export type OwnerEvidenceScopeMismatchKind = 'pain_not_found' | 'tool_call_not_found' | 'session_mismatch' | 'evidence_source_error';
+/** Build the typed error the plugin assembler throws for scope failures. */
+export declare function createOwnerEvidenceScopeError(kind: OwnerEvidenceScopeMismatchKind, message: string): Error;
+export type OwnerEvidenceScopeError = Error & {
+    readonly ownerEvidenceScopeKind: OwnerEvidenceScopeMismatchKind;
+};
+/** Structural guard (cross-bundle safe — see module comment above). */
+export declare function isOwnerEvidenceScopeError(value: unknown): value is OwnerEvidenceScopeError;
+/** Pre-computed assembly outcome, for callers that already ran the assembler. */
+export type EvidenceAssemblyOutcome = {
+    readonly ok: true;
+    readonly pack: BehaviorExamplePack;
+} | {
+    readonly ok: false;
+    readonly error: unknown;
+};
+export interface EvidenceReadinessInput {
+    /**
+     * Caller-declared target-channel applicability (the channel authority lives
+     * in the A2 wiring, not here). `false` → `not_applicable`. Anything other
+     * than an explicit `false` fails closed toward REQUIRING evidence.
+     */
+    readonly channelRequiresOwnerEvidence: boolean;
+    /** Owner selection; `undefined`/`null` = the Owner has not provided evidence. */
+    readonly ownerSelection?: OwnerEvidenceSelection | null;
+    /**
+     * Injected assembly step. Throws on failure (assembler ERR-069 fail-loud
+     * convention); the gate captures the throw and classifies it: typed scope
+     * kinds → the stable FR-04 codes, the typed `evidence_source_error` kind →
+     * the §6.2 storage-fault verdict, everything else → `invalid_evidence` with
+     * the bounded error detail — exception details are never swallowed.
+     * Takes precedence over `assemblyResult` when both are provided.
+     */
+    readonly assemblePack?: () => BehaviorExamplePack;
+    /** Pre-assembled result, alternative to `assemblePack`. */
+    readonly assemblyResult?: EvidenceAssemblyOutcome;
+}
+/**
+ * Evidence readiness verdict (FR-01 discriminant union). Field naming follows
+ * the house style for structured refusals (reasonCode / nextAction / detail).
+ */
+export type EvidenceReadiness = {
+    readonly status: 'ready';
+    readonly pack: BehaviorExamplePack;
+    /** `sha256:<hex>` content digest of the pack (intent-hash.ts convention). */
+    readonly evidenceHash: string;
+    readonly sourcePainId: string;
+} | {
+    readonly status: 'owner_evidence_required';
+    readonly reasonCode: Extract<OwnerEvidenceReasonCode, 'owner_behavior_examples_required'>;
+    readonly missingFields: readonly string[];
+    readonly nextAction: string;
+} | {
+    readonly status: 'invalid_evidence';
+    readonly reasonCode: OwnerEvidenceReasonCode;
+    /** Bounded structured reason (rc-8) — why the evidence was rejected. */
+    readonly detail: string;
+    readonly nextAction: string;
+} | {
+    /**
+     * The evidence SOURCE failed (trajectory store I/O — PRI-980 review
+     * P2-1, SPEC §6.2 case 3). Deliberately NOT `invalid_evidence`: a
+     * storage fault must never read as "Owner labelled bad evidence".
+     * `reason` (not `reasonCode`) marks it as outside the FR-04
+     * Owner-fault vocabulary — callers must keep the task wake-eligible /
+     * untouched and degrade observably, never write an owner-fault NHR
+     * reason.
+     */
+    readonly status: 'evidence_source_error';
+    readonly reason: 'evidence_source_error';
+    /** Bounded structured reason (rc-8) — the underlying failure message. */
+    readonly detail: string;
+    readonly nextAction: string;
+} | {
+    readonly status: 'not_applicable';
+};
+/**
+ * Structural validation of the Owner selection (rc-1..rc-5). Returns the list
+ * of field-level problems; an empty list means the selection is usable.
+ * Semantics deliberately mirror `validateOwnerSelection` in the plugin
+ * assembler (positive safe integers, 1..3 unique positives, non-empty text):
+ * a present-but-unusable selection is REJECTED, never repaired here.
+ *
+ * PRI-982: exported as the SINGLE shape authority for the persisted
+ * `pi_metadata.ownerEvidenceSelection` field — pitask-metadata parse reuses
+ * this validator so the persistence layer and the readiness gate can never
+ * diverge on what a usable selection is. Takes `unknown` (rc-1: the metadata
+ * parse reads it from a DB row) and rejects non-objects itself.
+ */
+export declare function validateOwnerEvidenceSelectionShape(selection: unknown): string[];
+/** `sha256:<hex>` content digest over the pack's canonical JSON (rc-6: one hash convention). */
+export declare function computeBehaviorExamplePackDigest(pack: BehaviorExamplePack): string;
+/**
+ * Pure evidence readiness judgment (FR-01). No I/O, no state — the caller
+ * injects the assembly step and declares channel applicability.
+ *
+ * Decision order:
+ *   1. channel does not require evidence → `not_applicable`;
+ *   2. no Owner selection → `owner_evidence_required` + missingFields;
+ *   3. selection present but structurally unusable → `invalid_evidence`
+ *      (assembler validateOwnerSelection semantics);
+ *   4. assembly throws / pre-assembled failure → `invalid_evidence` with the
+ *      bounded error detail (never swallowed);
+ *   5. assembled pack fails `validateBehaviorExamplePack` → `invalid_evidence`
+ *      (single validator authority);
+ *   6. otherwise → `ready` with the pack, its `sha256:<hex>` evidence hash,
+ *      and the source pain ID.
+ */
+export declare function assessEvidenceReadiness(input: EvidenceReadinessInput): EvidenceReadiness;
+//# sourceMappingURL=evidence-readiness.d.ts.map

package/core/dist/runtime-v2/internalization/evidence-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-readiness.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/internalization/evidence-readiness.ts"],"names":[],"mappings":"AA+CA,OAAO,EAA+B,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAInG;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,qFAAqF;IACrF,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,4DAA4D;IAC5D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,mEAAmE;AACnE,MAAM,MAAM,uBAAuB,GAC/B,kCAAkC,GAClC,iCAAiC,GACjC,+BAA+B,GAC/B,wCAAwC,CAAC;AAkB7C,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B,4BAA4B,CAAC;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8BAA8B,GACtC,gBAAgB,GAChB,qBAAqB,GACrB,kBAAkB,GAClB,uBAAuB,CAAC;AAkB5B,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,8BAA8B,EACpC,OAAO,EAAE,MAAM,GACd,KAAK,CAKP;AAED,MAAM,MAAM,uBAAuB,GAAG,KAAK,GAAG;IAC5C,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,CAAC;CACjE,CAAC;AAEF,uEAAuE;AACvE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,uBAAuB,CAK1F;AAED,iFAAiF;AACjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAC;IAC/C,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACxD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,mBAAmB,CAAC;IAClD,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAC;CACnD;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,uBAAuB,EAAE,kCAAkC,CAAC,CAAC;IAC1F,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACD;IACE;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;AAsDN;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CA2DhF;AAED,gGAAgG;AAChG,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAElF;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAuGxF"}