create-principles-disciple 1.145.16 → 1.145.17

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
-  "productVersion": "2.3.9",
-  "sourceCommit": "a821a6fe469e297285c206a53f5175a6de679aa7"
+  "productVersion": "2.3.10",
+  "sourceCommit": "72df0b91189c8ad18dbbfefb48c140609bad5c14"
 }

package/codex-adapter/dist/worker/workspace-worker.js

@@ -28,7 +28,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { computeFeatureFlagsFromConfig, createRuntimeStateHandle, createPainSignalBridge, isRetryWaitBackoffElapsed, PrincipleTreeLedgerAdapter, resolveDiagnosticianCapability, } from '@principles/core/runtime-v2';
-import { createWorkspaceBehaviorEvidencePort, loadPdConfigForPlugin, loadFeatureFlagFromConfig, reconcileGovernanceContinuation, runInternalizationConsumerCycle, saveHostToolDeclaration, } from '@principles/host-runtime';
+import { createWorkspaceBehaviorEvidencePort, createCodexArtificerTrustedFactsPort, loadPdConfigForPlugin, loadFeatureFlagFromConfig, reconcileGovernanceContinuation, runInternalizationConsumerCycle, saveHostToolDeclaration, } from '@principles/host-runtime';
 import { catchUpCodexIngestion } from '../ingestion/catch-up.js';
 import { CODEX_TOOL_SEMANTIC_MAPPINGS, CODEX_TOOL_SEMANTICS } from '../tool-semantics.js';
 const WORKER_OWNER = 'companion-worker';
@@ -407,6 +407,7 @@ export async function runCodexWorkspaceWorkerCycle(options) {
         logger,
         emitEvent,
         behaviorEvidence: createWorkspaceBehaviorEvidencePort(workspaceDir, CODEX_TOOL_SEMANTICS),
+        trustedFacts: createCodexArtificerTrustedFactsPort(),
         toolSemantics: CODEX_TOOL_SEMANTICS,
         // PRI-741: artificer generation gets the Codex host projection
         // (Bash/apply_patch — evidence-bound, intentionally sparse).

package/console/dist/server/index.js

@@ -23,6 +23,7 @@ import { handleApprovalsGroupedRoute, disposeApprovalsGroupedModels } from './ro
 import { handleGovernanceRoute, handleGovernanceExperienceRoute, resolveOwnerConfigSnapshot, disposeGovernanceModels } from './routes/governance.js';
 import { handleOwnerDecisionsRoute } from './routes/owner-decisions.js';
 import { handleEvidenceOutcomesRoute } from './routes/evidence-outcomes.js';
+import { handleDesignGateRoute } from './routes/design-gate.js';
 import { handleOwnerDecisionInboxRoute, handleOwnerDecisionViewRoute, handleOwnerDecisionLibraryRoute, parseOwnerDecisionViewSubPath } from './routes/owner-decision.js';
 import { handleOwnerIdentityRoute } from './routes/owner-identity.js';
 import { handleEvidenceChainRoute, disposeEvidenceChainModels } from './routes/evidence-chain.js';
@@ -502,6 +503,17 @@ function handleRequest(services) {
                 }))(req, res);
                 return;
             }
+            if (urlPath.startsWith('/api/v1/governance/design-gate/')) {
+                const identity = resolveOwnerIdentity(process.env, defaultOwnerIdentityHomeDir());
+                const { ownerId, credentialId } = identity;
+                asyncHandler(() => handleDesignGateRoute(req, res, {
+                    workspaceDir: services.workspaceDir,
+                    subPath: urlPath.slice('/api/v1/governance/design-gate'.length),
+                    ownerIdentity: services.authConfig.isEnabled() && ownerId !== null && credentialId !== null
+                        ? { ownerId, credentialId } : null,
+                }))(req, res);
+                return;
+            }
             // PRI-466/477: GET/POST/PUT /api/v1/intent (+ /init, /content sub-paths)
             if (urlPath === '/api/v1/intent' || urlPath.startsWith('/api/v1/intent/')) {
                 const subPath = urlPath === '/api/v1/intent' ? '' : urlPath.slice('/api/v1/intent'.length);

package/console/dist/server/routes/design-gate.d.ts

@@ -0,0 +1,11 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export interface DesignGateRouteContext {
+    workspaceDir: string;
+    subPath: string;
+    ownerIdentity: {
+        ownerId: string;
+        credentialId: string;
+    } | null;
+}
+/** Authenticated Owner attestations; never treats a principle approval as a design decision. */
+export declare function handleDesignGateRoute(req: IncomingMessage, res: ServerResponse, ctx: DesignGateRouteContext): Promise<void>;

package/console/dist/server/routes/design-gate.js

@@ -0,0 +1,156 @@
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { createRuntimeStateHandle, SqliteDesignGateStore, DesignGateStoreError } from '@principles/core/runtime-v2';
+import { listObservedDesignGateSessions, readDesignGateSpecSnapshot } from '@principles/host-runtime';
+import { readBody } from '../utils/request.js';
+import { sendSuccess, sendError, sendBadRequest, sendMethodNotAllowed } from '../utils/response.js';
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function text(value) {
+    return typeof value === 'string' && value.trim().length > 0 && value.length <= 4096;
+}
+function decision(value) {
+    return value === 'approved' || value === 'not_approved' || value === 'not_required';
+}
+function scope(value) {
+    return record(value) && Object.keys(value).every(key => key === 'paths' || key === 'actions')
+        && Array.isArray(value.paths) && value.paths.length > 0 && value.paths.length <= 100
+        && value.paths.every(p => text(p) && !/[*?[\]]/.test(p) && !path.isAbsolute(p) && !p.split(/[\\/]/).includes('..'))
+        && Array.isArray(value.actions) && value.actions.length > 0 && value.actions.length <= 3
+        && value.actions.every(a => a === 'read' || a === 'write' || a === 'execute');
+}
+function closedBody(value, keys) {
+    return record(value) && Object.keys(value).every(key => keys.includes(key));
+}
+/** Authenticated Owner attestations; never treats a principle approval as a design decision. */
+export async function handleDesignGateRoute(req, res, ctx) {
+    if (!ctx.ownerIdentity) {
+        sendError(res, 403, 'owner_authentication_required', 'A verified Owner identity is required to read or change design declarations.');
+        return;
+    }
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    if (req.method === 'GET' && ctx.subPath === '/sessions') {
+        try {
+            sendSuccess(res, { sessions: listObservedDesignGateSessions(ctx.workspaceDir) });
+        }
+        catch {
+            sendError(res, 503, 'session_source_unavailable', 'Observed Codex session data is unavailable.', { nextAction: 'Run a Codex session with PD observation enabled, then refresh.' });
+        }
+        return;
+    }
+    if (req.method === 'GET' && ctx.subPath === '/declaration') {
+        const project = url.searchParams.get('projectWorkspacePath');
+        const session = url.searchParams.get('hostSessionId');
+        if (!text(project) || !text(session)) {
+            sendBadRequest(res, 'Project and native session are required.');
+            return;
+        }
+        let declaration;
+        try {
+            const handle = await createRuntimeStateHandle({ workspaceDir: ctx.workspaceDir, readonly: true, bootstrapIfMissing: false });
+            try {
+                declaration = new SqliteDesignGateStore(handle.stateManager.connection).getLatestDeclaration(project, session);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        catch {
+            sendError(res, 503, 'declaration_source_unavailable', 'The design declaration source could not be read.', {
+                nextAction: 'Restore or initialize the governance workspace state database, then refresh the declaration.',
+            });
+            return;
+        }
+        sendSuccess(res, { declaration });
+        return;
+    }
+    if (req.method !== 'POST') {
+        sendMethodNotAllowed(res);
+        return;
+    }
+    let raw;
+    try {
+        raw = JSON.parse(await readBody(req));
+    }
+    catch {
+        sendBadRequest(res, 'Request body must be valid JSON.');
+        return;
+    }
+    const create = ctx.subPath === '/declarations';
+    const mutate = /^\/declarations\/([^/]+)\/(decision|revoke)$/.exec(ctx.subPath);
+    if (!create && !mutate) {
+        sendError(res, 404, 'not_found', 'Unknown design declaration operation.');
+        return;
+    }
+    if (create) {
+        if (!closedBody(raw, ['projectWorkspacePath', 'hostSessionId', 'specPath', 'scope', 'decision'])
+            || !text(raw.projectWorkspacePath) || !text(raw.hostSessionId) || !text(raw.specPath)
+            || !scope(raw.scope) || !decision(raw.decision)) {
+            sendBadRequest(res, 'Expected an observed project/session, SPEC path, explicit paths/actions and decision; identity fields are not accepted.');
+            return;
+        }
+    }
+    else if (!closedBody(raw, mutate?.[2] === 'decision' ? ['expectedRevision', 'decision'] : ['expectedRevision'])
+        || typeof raw.expectedRevision !== 'number' || !Number.isSafeInteger(raw.expectedRevision) || raw.expectedRevision < 1
+        || (mutate?.[2] === 'decision' && !decision(raw.decision))) {
+        sendBadRequest(res, 'Expected the current revision and a valid decision.');
+        return;
+    }
+    // All request validation/source checks precede any write transaction.
+    if (!record(raw)) {
+        sendBadRequest(res, 'Invalid declaration.');
+        return;
+    }
+    try {
+        let createInput = null;
+        if (create && text(raw.projectWorkspacePath) && text(raw.hostSessionId) && text(raw.specPath) && scope(raw.scope) && decision(raw.decision)) {
+            const chosen = listObservedDesignGateSessions(ctx.workspaceDir).find(entry => entry.projectWorkspacePath === raw.projectWorkspacePath && entry.hostSessionId === raw.hostSessionId);
+            if (!chosen) {
+                sendError(res, 409, 'native_scope_unverified', 'Select a Codex session already observed by this workspace.');
+                return;
+            }
+            const snapshot = readDesignGateSpecSnapshot(chosen.projectWorkspacePath, path.resolve(chosen.projectWorkspacePath, raw.specPath));
+            createInput = { project: chosen.projectWorkspacePath, session: chosen.hostSessionId, specPath: snapshot.realPath, specDigest: snapshot.digest, scope: raw.scope, decision: raw.decision };
+        }
+        const handle = await createRuntimeStateHandle({ workspaceDir: ctx.workspaceDir, bootstrapIfMissing: false });
+        try {
+            const store = new SqliteDesignGateStore(handle.stateManager.connection);
+            const actor = ctx.ownerIdentity;
+            const decidedAt = new Date().toISOString();
+            if (createInput) {
+                sendSuccess(res, { declaration: store.createDeclaration({ sourceRef: randomUUID(), governanceWorkspacePath: path.resolve(ctx.workspaceDir), projectWorkspacePath: createInput.project, hostSessionId: createInput.session, taskRef: `codex:${createInput.session}`, specPath: createInput.specPath, specDigest: createInput.specDigest, scope: createInput.scope, decision: createInput.decision, actor, decidedAt }) });
+            }
+            else if (mutate && typeof raw.expectedRevision === 'number') {
+                const sourceRef = decodeURIComponent(mutate[1] ?? '');
+                if (mutate[2] === 'revoke')
+                    sendSuccess(res, { declaration: store.revoke({ sourceRef, expectedRevision: raw.expectedRevision, actor, decidedAt }) });
+                else if (decision(raw.decision)) {
+                    const existing = store.getDeclaration(sourceRef);
+                    if (existing) {
+                        const currentSpec = readDesignGateSpecSnapshot(existing.projectWorkspacePath, existing.specPath);
+                        if (currentSpec.digest !== existing.specDigest) {
+                            sendError(res, 409, 'design_gate_spec_changed', 'The bound SPEC changed after this declaration was recorded.', {
+                                nextAction: 'Review the current SPEC and create a new declaration before changing its decision.',
+                            });
+                            return;
+                        }
+                    }
+                    sendSuccess(res, { declaration: store.updateDecision({ sourceRef, expectedRevision: raw.expectedRevision, decision: raw.decision, actor, decidedAt }) });
+                }
+            }
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        if (error instanceof DesignGateStoreError) {
+            const status = error.code === 'invalid_input' ? 400 : error.code === 'not_found' ? 404 : error.code === 'corrupt_data' ? 503 : 409;
+            sendError(res, status, `design_gate_${error.code}`, error.message, { nextAction: 'Refresh the declaration before retrying; no previous record was overwritten.' });
+        }
+        else {
+            sendError(res, 503, 'design_gate_source_unavailable', 'The SPEC, observed session or declaration source could not be verified.', { nextAction: 'Check that the SPEC is a readable file inside the observed project and refresh the session list.' });
+        }
+    }
+}

package/console/dist/ui/api.d.ts

@@ -1,5 +1,6 @@
 import type { ApiResponse } from "../types.js";
 import type { OwnerDecisionsData, OwnerResolutionResultData, OwnerDecisionInboxData, OwnerDecisionLibraryData } from "./utils/validators.js";
+import type { DesignGateAction, DesignGateDecision, DesignGateDeclaration, DesignGateScope } from "@principles/core/runtime-v2/internalization/design-gate-facts";
 import type { GovernanceExperienceSnapshot, OwnerGovernanceView, OwnerDecisionViewCore } from '@principles/core/runtime-v2';
 import type { OwnerIdentityViewData, OwnerIdentityRegisterData, OwnerIdentityUnregisterData } from "./utils/validators.js";
 import type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, RecoveryResultData, FailedTaskDetailData, ActivationsData, DisableActivationData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, UpdateRecoveryData, UpdateTransactionData, ApprovalRecordData, PrinciplesListData, CorePrinciplesData, ApprovalsGroupedData, EvidenceChainData, TrajectoryData, IntentSummaryData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, IntentInitResultData, IntentSaveResultData, IntentRawContentData, IntentVersionData, RuleCodeOwnerReviewData, RuleCodeMutationData } from "./utils/validators.js";
@@ -343,7 +344,34 @@ export interface FollowUpPayload {
     candidateId?: string;
 }
 declare function dispatchFollowUp(decisionId: string, payload: FollowUpPayload): Promise<ApiResponse<FollowUpResponseData>>;
-export { request, getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchCorePrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchOwnerDecisionView, fetchOwnerDecisionInbox, fetchOwnerDecisionLibrary, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, fetchEvidenceAudit, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchGovernanceExperience, recoverFailedTask, fetchFailedTaskDetail, fetchOwnerDecisions, resolveOwnerDecision, fetchApprovalsGrouped, fetchAllActivations, disableActivation, proposePromptRevision, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyFullUpdate, fetchUpdateRecovery, fetchUpdateTransaction, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };
+export interface DesignGateObservedSession {
+    projectWorkspacePath: string;
+    hostSessionId: string;
+}
+export interface DesignGateDeclarationInput {
+    projectWorkspacePath: string;
+    hostSessionId: string;
+    specPath: string;
+    scope: DesignGateScope;
+    decision: DesignGateDecision;
+}
+declare function fetchDesignGateSessions(): Promise<ApiResponse<{
+    sessions: DesignGateObservedSession[];
+}>>;
+declare function fetchDesignGateDeclaration(projectWorkspacePath: string, hostSessionId: string): Promise<ApiResponse<{
+    declaration: DesignGateDeclaration | null;
+}>>;
+declare function createDesignGateDeclaration(input: DesignGateDeclarationInput): Promise<ApiResponse<{
+    declaration: DesignGateDeclaration | null;
+}>>;
+declare function updateDesignGateDecision(sourceRef: string, expectedRevision: number, decision: DesignGateDecision): Promise<ApiResponse<{
+    declaration: DesignGateDeclaration | null;
+}>>;
+declare function revokeDesignGateDeclaration(sourceRef: string, expectedRevision: number): Promise<ApiResponse<{
+    declaration: DesignGateDeclaration | null;
+}>>;
+export { request, getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchCorePrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchOwnerDecisionView, fetchOwnerDecisionInbox, fetchOwnerDecisionLibrary, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, fetchEvidenceAudit, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchGovernanceExperience, recoverFailedTask, fetchFailedTaskDetail, fetchOwnerDecisions, resolveOwnerDecision, fetchApprovalsGrouped, fetchAllActivations, disableActivation, proposePromptRevision, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyFullUpdate, fetchUpdateRecovery, fetchUpdateTransaction, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, fetchDesignGateSessions, fetchDesignGateDeclaration, createDesignGateDeclaration, updateDesignGateDecision, revokeDesignGateDeclaration, };
+export type { DesignGateAction, DesignGateDecision, DesignGateDeclaration, DesignGateScope };
 export type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, RecoveryResultData, ActivationsData, DisableActivationData, RuleCodeOwnerReviewData, RuleCodeMutationData, FailedTaskDetailData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, UpdateRecoveryData, ApprovalRecordData, PrinciplesListData, CorePrinciplesData, CorePrincipleData, ApprovalsGroupedData, EvidenceChainData, EvidenceChainRecordData, EvidenceChainStateData, TrajectoryData, TrajectoryStageData, IntentSummaryData, IntentSectionsData, IntentDocWarningData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, LinkCandidateFollowUpData, GuideRulehostFollowUpData, GeneratePatchProposalFollowUpData, IntentVersionEntry, IntentVersionData, } from "./utils/validators.js";
 export type { ActivationRecordData as ActivationRecord } from "./utils/validators.js";
 export type { OwnerDecisionInboxData, OwnerDecisionLibraryData } from "./utils/validators.js";

package/console/dist/ui/api.js

@@ -891,9 +891,113 @@ async function dispatchFollowUp(decisionId, payload) {
         body: JSON.stringify(payload),
     }, validateFollowUpResponse);
 }
+function isDesignGateRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateDesignGateSessions(value) {
+    if (!isDesignGateRecord(value) || !Array.isArray(value.sessions))
+        return null;
+    const sessions = [];
+    for (const entry of value.sessions) {
+        if (!isDesignGateRecord(entry)
+            || typeof entry.projectWorkspacePath !== "string" || entry.projectWorkspacePath.trim() === ""
+            || typeof entry.hostSessionId !== "string" || entry.hostSessionId.trim() === "")
+            return null;
+        sessions.push({ projectWorkspacePath: entry.projectWorkspacePath, hostSessionId: entry.hostSessionId });
+    }
+    return { sessions };
+}
+function isDesignGateAction(value) {
+    return value === "read" || value === "write" || value === "execute";
+}
+function isDesignGateDecisionValue(value) {
+    return value === "approved" || value === "not_approved" || value === "not_required";
+}
+function isNonEmptyDesignGateString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function isDesignGateStringArray(value) {
+    if (!Array.isArray(value))
+        return false;
+    for (let index = 0; index < value.length; index += 1) {
+        if (!Object.hasOwn(value, index) || !isNonEmptyDesignGateString(value[index]))
+            return false;
+    }
+    return true;
+}
+/**
+ * Field-by-field mirror of the server declaration contract (rc-1 style) —
+ * the browser bundle never runtime-imports the Node-oriented core barrel, so
+ * the wire format is re-validated locally; the server remains the authority.
+ */
+function isDesignGateDeclarationValue(value) {
+    if (!isDesignGateRecord(value))
+        return false;
+    if (!Object.hasOwn(value, "sourceRef") || !isNonEmptyDesignGateString(value.sourceRef))
+        return false;
+    if (!isNonEmptyDesignGateString(value.governanceWorkspacePath))
+        return false;
+    if (!isNonEmptyDesignGateString(value.projectWorkspacePath))
+        return false;
+    if (!isNonEmptyDesignGateString(value.hostSessionId))
+        return false;
+    if (!isNonEmptyDesignGateString(value.taskRef))
+        return false;
+    if (!isNonEmptyDesignGateString(value.specPath) || !isNonEmptyDesignGateString(value.specDigest))
+        return false;
+    if (!isDesignGateRecord(value.scope))
+        return false;
+    if (!Object.hasOwn(value.scope, "paths") || !Object.hasOwn(value.scope, "actions"))
+        return false;
+    if (!isDesignGateStringArray(value.scope.paths) || value.scope.paths.length === 0)
+        return false;
+    if (!Array.isArray(value.scope.actions) || value.scope.actions.length === 0)
+        return false;
+    for (let index = 0; index < value.scope.actions.length; index += 1) {
+        if (!Object.hasOwn(value.scope.actions, index) || !isDesignGateAction(value.scope.actions[index]))
+            return false;
+    }
+    if (!isDesignGateDecisionValue(value.decision))
+        return false;
+    if (typeof value.revision !== "number" || !Number.isSafeInteger(value.revision) || value.revision < 1)
+        return false;
+    if (typeof value.revoked !== "boolean")
+        return false;
+    if (!isDesignGateRecord(value.actor)
+        || !Object.hasOwn(value.actor, "ownerId") || !Object.hasOwn(value.actor, "credentialId")
+        || !isNonEmptyDesignGateString(value.actor.ownerId) || !isNonEmptyDesignGateString(value.actor.credentialId))
+        return false;
+    if (!isNonEmptyDesignGateString(value.decidedAt))
+        return false;
+    return true;
+}
+function validateDesignGateDeclarationEnvelope(value) {
+    if (!isDesignGateRecord(value) || !Object.hasOwn(value, "declaration"))
+        return null;
+    if (value.declaration === null)
+        return { declaration: null };
+    return isDesignGateDeclarationValue(value.declaration) ? { declaration: value.declaration } : null;
+}
+const designGateBasePath = "/api/v1/governance/design-gate";
+async function fetchDesignGateSessions() {
+    return request(`${designGateBasePath}/sessions`, undefined, validateDesignGateSessions);
+}
+async function fetchDesignGateDeclaration(projectWorkspacePath, hostSessionId) {
+    const query = new URLSearchParams({ projectWorkspacePath, hostSessionId });
+    return request(`${designGateBasePath}/declaration?${query.toString()}`, undefined, validateDesignGateDeclarationEnvelope);
+}
+async function createDesignGateDeclaration(input) {
+    return request(`${designGateBasePath}/declarations`, { method: "POST", body: JSON.stringify(input) }, validateDesignGateDeclarationEnvelope);
+}
+async function updateDesignGateDecision(sourceRef, expectedRevision, decision) {
+    return request(`${designGateBasePath}/declarations/${encodeURIComponent(sourceRef)}/decision`, { method: "POST", body: JSON.stringify({ expectedRevision, decision }) }, validateDesignGateDeclarationEnvelope);
+}
+async function revokeDesignGateDeclaration(sourceRef, expectedRevision) {
+    return request(`${designGateBasePath}/declarations/${encodeURIComponent(sourceRef)}/revoke`, { method: "POST", body: JSON.stringify({ expectedRevision }) }, validateDesignGateDeclarationEnvelope);
+}
 // ── Exports ───────────────────────────────────────────────────────────────────
 export { request, 
 // auth
 getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchCorePrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchOwnerDecisionView, fetchOwnerDecisionInbox, fetchOwnerDecisionLibrary, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, fetchEvidenceAudit, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, 
 // Feedback submit ladder (Slice 3, spec §8)
-fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchGovernanceExperience, recoverFailedTask, fetchFailedTaskDetail, fetchOwnerDecisions, resolveOwnerDecision, fetchApprovalsGrouped, fetchAllActivations, disableActivation, proposePromptRevision, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyFullUpdate, fetchUpdateRecovery, fetchUpdateTransaction, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };
+fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchGovernanceExperience, recoverFailedTask, fetchFailedTaskDetail, fetchOwnerDecisions, resolveOwnerDecision, fetchApprovalsGrouped, fetchAllActivations, disableActivation, proposePromptRevision, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyFullUpdate, fetchUpdateRecovery, fetchUpdateTransaction, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, fetchDesignGateSessions, fetchDesignGateDeclaration, createDesignGateDeclaration, updateDesignGateDecision, revokeDesignGateDeclaration, };

package/console/dist/ui/i18n/en.json

@@ -1404,6 +1404,51 @@
             "eyebrow": "Control Center",
             "title": "Config Readiness",
             "subtitle": "PD can only work when configuration is complete. This page shows config readiness — not a system health dashboard.",
+            "designGate": {
+                "title": "Local Codex Design Declaration",
+                "description": "Record an Owner decision for a SPEC and an observed native Codex session. The server verifies the session and SPEC snapshot; it does not prove that implementation matches natural-language intent.",
+                "loadingSessions": "Loading observed Codex sessions…",
+                "noSessions": "No native Codex sessions have been observed for this workspace yet. Open a Codex session with PD observation enabled, then refresh.",
+                "refresh": "Refresh",
+                "loadingDeclaration": "Loading the latest declaration…",
+                "nativeSession": "Observed native session",
+                "noDeclaration": "No declaration exists for this session. Record the SPEC, covered paths, actions, and an explicit Owner decision.",
+                "specPath": "SPEC file path",
+                "specPathHint": "Relative to the selected project workspace, or an absolute path inside it",
+                "scopePathsInput": "Project-relative paths covered by this declaration (one per line)",
+                "scopePathsHint": "packages/example/src/file.ts",
+                "scopePathsHelp": "Use . for the project root. With Execute, . covers command invocations originating in this native project/session; it does not sandbox process effects or prove filesystem containment.",
+                "scopeActionsInput": "Actions covered",
+                "initialDecision": "Owner decision",
+                "decisions": {
+                    "approved": "Approved",
+                    "notApproved": "Not approved",
+                    "notRequired": "Approval not required"
+                },
+                "actions": {
+                    "read": "Read",
+                    "write": "Write",
+                    "execute": "Execute"
+                },
+                "decision": "Decision:",
+                "revision": "Revision:",
+                "spec": "SPEC:",
+                "specDigest": "SPEC snapshot digest:",
+                "scopePaths": "Covered paths:",
+                "scopeActions": "Covered actions:",
+                "owner": "Recorded by Owner:",
+                "decidedAt": "Recorded at:",
+                "revoked": "Revoked",
+                "revokedLatest": "The latest declaration is revoked (revision {{revision}}). You can record a new declaration for this session.",
+                "semanticLimit": "This Owner declaration is bound to the shown SPEC snapshot, project, session, and paths/actions. Execute with . covers commands originating in this native project/session; it does not sandbox process effects or prove filesystem containment. Host operations outside a reliably classified path/action scope remain unknown. This declaration does not prove that code satisfies the SPEC’s natural-language meaning.",
+                "requiredFields": "Enter a SPEC path, at least one covered path, and one or more actions.",
+                "invalidMutationResponse": "The server returned no declaration after a successful change. Refresh before continuing.",
+                "approve": "Approve this scope",
+                "markPending": "Mark not approved",
+                "revoke": "Revoke declaration",
+                "saving": "Saving…",
+                "create": "Record declaration"
+            },
             "configReady": "Configuration complete. All enabled agents are ready.",
             "configNeedsSetup": "Some agents need configuration before they can run.",
             "configNotReady": "Some agents cannot run. Check configuration errors below.",

package/console/dist/ui/i18n/zh-CN.json

@@ -1404,6 +1404,51 @@
             "eyebrow": "控制中心",
             "title": "配置就绪",
             "subtitle": "PD 能否正常工作取决于配置是否完成。本页展示配置就绪状态——不是系统健康面板。",
+            "designGate": {
+                "title": "本地 Codex 设计声明",
+                "description": "为一份 SPEC 和已观测到的 Codex 原生会话记录拥有者决定。服务端会核验会话与 SPEC 快照，但不会证明实现符合自然语言意图。",
+                "loadingSessions": "正在加载已观测的 Codex 会话…",
+                "noSessions": "此工作区尚未观测到 Codex 原生会话。请在启用 PD 观测的情况下打开 Codex 会话，然后刷新。",
+                "refresh": "刷新",
+                "loadingDeclaration": "正在加载最新声明…",
+                "nativeSession": "已观测的原生会话",
+                "noDeclaration": "此会话尚无声明。请填写 SPEC、覆盖路径、操作和明确的拥有者决定。",
+                "specPath": "SPEC 文件路径",
+                "specPathHint": "相对于所选项目工作区，或工作区内的绝对路径",
+                "scopePathsInput": "声明覆盖的项目相对路径（每行一个）",
+                "scopePathsHint": "packages/example/src/file.ts",
+                "scopePathsHelp": "项目根目录使用 .。选择“执行”并填写 .，表示覆盖从此原生项目/会话发起的命令；这不会沙箱化进程副作用，也不能证明文件系统影响仅限于项目内。",
+                "scopeActionsInput": "覆盖的操作",
+                "initialDecision": "拥有者决定",
+                "decisions": {
+                    "approved": "已批准",
+                    "notApproved": "未批准",
+                    "notRequired": "无需批准"
+                },
+                "actions": {
+                    "read": "读取",
+                    "write": "写入",
+                    "execute": "执行"
+                },
+                "decision": "决定：",
+                "revision": "修订：",
+                "spec": "SPEC：",
+                "specDigest": "SPEC 快照摘要：",
+                "scopePaths": "覆盖路径：",
+                "scopeActions": "覆盖操作：",
+                "owner": "记录拥有者：",
+                "decidedAt": "记录时间：",
+                "revoked": "已撤回",
+                "revokedLatest": "最新声明已撤回（修订 {{revision}}）。你可以为此会话记录新声明。",
+                "semanticLimit": "此拥有者声明绑定所示 SPEC 快照、项目、会话及路径/操作范围。选择“执行”并填写 .，覆盖从此原生项目/会话发起的命令；这不会沙箱化进程副作用，也不能证明文件系统影响仅限于项目内。无法可靠分类到路径/操作范围的宿主操作仍属未知。此声明不能证明代码符合 SPEC 的自然语言含义。",
+                "requiredFields": "请填写 SPEC 路径、至少一个覆盖路径和至少一种操作。",
+                "invalidMutationResponse": "服务器在变更成功后未返回声明。请刷新后再继续。",
+                "approve": "批准此范围",
+                "markPending": "标记为未批准",
+                "revoke": "撤回声明",
+                "saving": "保存中…",
+                "create": "记录声明"
+            },
             "configReady": "配置完成，所有已启用智能体就绪。",
             "configNeedsSetup": "部分智能体需要配置后才能运行。",
             "configNotReady": "部分智能体无法运行，请检查下方配置错误。",

package/console/dist/ui/pages/control-center/ControlCenterPage.js

@@ -11,6 +11,7 @@ import { enumLabel } from "../../utils/enum-labels.js";
 import { WorkflowDiagram } from "./WorkflowDiagram.js";
 import { AgentGroup } from "./AgentGroup.js";
 import { RuntimeProfileManager } from "./RuntimeProfileManager.js";
+import { DesignGatePanel } from "./DesignGatePanel.js";
 import { AGENT_GROUPS, AGENT_METADATA, } from "../../utils/agent-metadata.js";
 // ── Runtime validators (H section / ERR-001/005/009/013) ─────────────────────
 function validateSource(raw) {
@@ -485,7 +486,7 @@ export function ControlCenterPage() {
     };
     const overallReadiness = computeOverallReadiness(diagnostics);
     const availableProfiles = catalogData?.profiles ?? configData.runtimeProfiles;
-    return (_jsx(PageShell, { children: _jsxs("div", { className: "animate-[pdFadeIn_400ms_ease-out]", children: [_jsx("div", { className: "font-mono text-[12px] tracking-[0.14em] text-ink-3 uppercase mb-3", children: t("pages.controlCenter.eyebrow") }), _jsx("h1", { className: "text-[29px] font-semibold tracking-tight text-ink mb-2", children: t("pages.controlCenter.title") }), _jsx("p", { className: "text-ink-3 text-[14px] max-w-[760px] leading-relaxed mb-7", children: t("pages.controlCenter.subtitle") }), _jsx(WorkflowDiagram, {}), _jsx(CompactStatusBar, { readiness: overallReadiness, agents: configData.agents }), _jsxs("section", { className: "mt-8", "aria-labelledby": "section-agents", children: [_jsx(SectionTitle, { id: "section-agents", children: t("pages.controlCenter.internalAgents") }), _jsx("p", { className: "text-ink-3 text-[13px] leading-relaxed mb-3", children: t("pages.controlCenter.internalAgentsDescription") }), (() => {
+    return (_jsx(PageShell, { children: _jsxs("div", { className: "animate-[pdFadeIn_400ms_ease-out]", children: [_jsx("div", { className: "font-mono text-[12px] tracking-[0.14em] text-ink-3 uppercase mb-3", children: t("pages.controlCenter.eyebrow") }), _jsx("h1", { className: "text-[29px] font-semibold tracking-tight text-ink mb-2", children: t("pages.controlCenter.title") }), _jsx("p", { className: "text-ink-3 text-[14px] max-w-[760px] leading-relaxed mb-7", children: t("pages.controlCenter.subtitle") }), _jsx(WorkflowDiagram, {}), _jsx(CompactStatusBar, { readiness: overallReadiness, agents: configData.agents }), _jsx(DesignGatePanel, {}), _jsxs("section", { className: "mt-8", "aria-labelledby": "section-agents", children: [_jsx(SectionTitle, { id: "section-agents", children: t("pages.controlCenter.internalAgents") }), _jsx("p", { className: "text-ink-3 text-[13px] leading-relaxed mb-3", children: t("pages.controlCenter.internalAgentsDescription") }), (() => {
                             const { groups, unknown } = groupAgentsByDependency(configData.agents);
                             const locale = i18n.language.startsWith("en")
                                 ? "en"

package/console/dist/ui/pages/control-center/DesignGatePanel.d.ts

@@ -0,0 +1 @@
+export declare function DesignGatePanel(): import("react").JSX.Element;