create-principles-disciple 1.145.21 → 1.145.22

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
-  "productVersion": "2.3.11",
-  "sourceCommit": "d2e8da5d5442288872bdb9f73255b6ff4d5cbf55"
+  "productVersion": "2.3.12",
+  "sourceCommit": "973e331df2bb7b09968731e26825dfe1ee83ad48"
 }

package/console/dist/server/index.js

@@ -22,6 +22,7 @@ import { handleReceiptsRoute, disposeReceiptsModels } from './routes/receipts.js
 import { handleApprovalsGroupedRoute, disposeApprovalsGroupedModels } from './routes/approvals-grouped.js';
 import { handleGovernanceRoute, handleGovernanceExperienceRoute, resolveOwnerConfigSnapshot, disposeGovernanceModels } from './routes/governance.js';
 import { handleOwnerDecisionsRoute } from './routes/owner-decisions.js';
+import { handleRuleCandidateBindingsRoute } from './routes/rule-candidate-bindings.js';
 import { handleEvidenceOutcomesRoute } from './routes/evidence-outcomes.js';
 import { handleDesignGateRoute } from './routes/design-gate.js';
 import { handleOwnerDecisionInboxRoute, handleOwnerDecisionViewRoute, handleOwnerDecisionLibraryRoute, parseOwnerDecisionViewSubPath } from './routes/owner-decision.js';
@@ -485,6 +486,16 @@ function handleRequest(services) {
                 asyncHandler(() => handleGovernanceRoute(req, res, services.workspaceDir))(req, res);
                 return;
             }
+            if (urlPath === '/api/v1/governance/rule-candidate-bindings' || urlPath.startsWith('/api/v1/governance/rule-candidate-bindings/')) {
+                const { ownerId, credentialId } = resolveOwnerIdentity(process.env, defaultOwnerIdentityHomeDir());
+                asyncHandler(() => handleRuleCandidateBindingsRoute(req, res, {
+                    workspaceDir: services.workspaceDir,
+                    subPath: urlPath.slice('/api/v1/governance/rule-candidate-bindings'.length),
+                    ownerIdentity: services.authConfig.isEnabled() && ownerId !== null && credentialId !== null
+                        ? { ownerId, credentialId } : null,
+                }))(req, res);
+                return;
+            }
             // PRI-629: GET/POST /api/v1/governance/owner-decisions — unified Owner Inbox
             // (read projection + resolution). Identity derived server-side (SPEC §29):
             // configured owner when registered, else the authenticated console operator.

package/console/dist/server/models/ApprovalsConsoleModel.js

@@ -2,6 +2,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { SqliteConnection, SqliteApprovalQueueStore, SqliteActivationStateStore, SqlitePIArtifactStore, ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, createProductionGateDeps, ApprovalCompletionService, ApprovalQueue, mapConfidenceToLabel, isArtifactRevisionOf, detectPromptReplacementTarget, buildOwnerRevisionArtifact, PrincipleTreeLedgerAdapter, MVP_CHANNELS, } from '@principles/core/runtime-v2';
 import { resolveLedgerPrincipleId } from './principle-id-resolution.js';
+import { createArtifactPrincipleResolutionDeps } from './artifact-principle-resolver.js';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
 import { resolveWorkspaceHostToolSemantics, checkPromptArtifactDeliverabilityById, operatorDeclaredBudgetResolution, resolveLivePromptInjectionProjection, runtimeBudgetObservationToResolution, selectConsoleRuntimeBudgetFacts, } from '@principles/host-runtime';
 import { PROMPT_BUDGET_HOST_KINDS } from '@principles/core/runtime-v2';
@@ -459,17 +460,7 @@ export class ApprovalsConsoleModel {
             // ids against the ledger and otherwise walks the candidate lineage
             // (scribe → dreamer seed → candidateId → derivedFromPainIds).
             const ledger = new PrincipleTreeLedgerAdapter({ stateDir });
-            const resolution = await resolveLedgerPrincipleId(artifact, {
-                ledger,
-                getArtifactById: (id) => piArtifactStore.getArtifactById(id),
-                getTaskDiagnosticJson: (taskId) => {
-                    const row = connection
-                        .getDb()
-                        .prepare('SELECT diagnostic_json FROM tasks WHERE task_id = ?')
-                        .get(taskId);
-                    return row?.diagnostic_json ?? null;
-                },
-            });
+            const resolution = await resolveLedgerPrincipleId(artifact, createArtifactPrincipleResolutionDeps(connection, piArtifactStore, this.workspaceDir));
             if (resolution.status === 'unresolved') {
                 return `ledger_activate_skipped: artifact ${artifactId} — ${resolution.reason}`;
             }
@@ -653,6 +644,10 @@ export class ApprovalsConsoleModel {
                 // warn later. The dispatcher gate now blocks both, and the existing
                 // post-commit upgrade below keeps its role unchanged.
                 ledgerIdentity: {
+                    getCandidateKind: (candidateId) => {
+                        const row = connection.getDb().prepare('SELECT recommendation_kind FROM principle_candidates WHERE candidate_id = ?').get(candidateId);
+                        return row !== null && typeof row === 'object' && Object.hasOwn(row, 'recommendation_kind') ? Reflect.get(row, 'recommendation_kind') : undefined;
+                    },
                     ledger: new PrincipleTreeLedgerAdapter({ stateDir: `${this.workspaceDir}/.state` }),
                     getArtifactById: artifactReadModel.getArtifactById,
                     getTaskDiagnosticJson: (taskId) => {
@@ -939,6 +934,10 @@ export class ApprovalsConsoleModel {
                 writers: [new PromptWriter()],
                 approvalQueueStore: queueStore,
                 ledgerIdentity: {
+                    getCandidateKind: (candidateId) => {
+                        const row = connection.getDb().prepare('SELECT recommendation_kind FROM principle_candidates WHERE candidate_id = ?').get(candidateId);
+                        return row !== null && typeof row === 'object' && Object.hasOwn(row, 'recommendation_kind') ? Reflect.get(row, 'recommendation_kind') : undefined;
+                    },
                     ledger: new PrincipleTreeLedgerAdapter({ stateDir: `${this.workspaceDir}/.state` }),
                     getArtifactById: async (id) => {
                         const rec = await artifactStore.getArtifactById(id);

package/console/dist/server/models/RuleCandidateBindingConsoleModel.d.ts

@@ -0,0 +1,40 @@
+import { reviseRuleBindingOnce } from '@principles/core/runtime-v2';
+import type { RuleCandidateBindingRequest, RuleCandidateBindingMutationResult } from '@principles/core/runtime-v2';
+import type { RuleBindingReviewView, RuleBindingQueueView } from '../../shared/rule-candidate-binding-contract.js';
+import { ActivationsConsoleModel } from './ActivationsConsoleModel.js';
+/** Derived review only. Binding authority stays inside the locked core Ledger writer. */
+export declare class RuleCandidateBindingConsoleModel {
+    private readonly workspaceDir;
+    constructor(workspaceDir: string);
+    private ledger;
+    list(): Promise<RuleBindingQueueView>;
+    review(candidateId: string, search: string): Promise<{
+        ok: true;
+        review: RuleBindingReviewView;
+    } | {
+        ok: false;
+        reason: string;
+        nextAction: string;
+    }>;
+    mutate(candidateId: string, request: RuleCandidateBindingRequest, actorId: string): Promise<RuleCandidateBindingMutationResult & {
+        revision?: Awaited<ReturnType<typeof reviseRuleBindingOnce>>;
+        operations?: Awaited<ReturnType<ActivationsConsoleModel['getActivations']>>;
+        operationsScope?: string;
+        stopPath?: string;
+        nextAction?: string;
+    }>;
+    revise(candidateId: string, input: {
+        expectedBindingRevision: number;
+        expectedScribeTaskId: string;
+        expectedTaskRevisionEpoch: number;
+        requestId: string;
+    }): Promise<{
+        status: 'refused';
+        reason: string;
+        nextAction: string;
+    } | {
+        status: 'revision_started' | 'revision_already_started';
+        scribeTaskId: string;
+        taskRevisionEpoch: number;
+    }>;
+}

package/console/dist/server/models/RuleCandidateBindingConsoleModel.js

@@ -0,0 +1,130 @@
+import path from 'node:path';
+import { existsSync } from 'node:fs';
+import { createRuntimeStateHandle, PrincipleTreeLedgerAdapter, reviseRuleBindingOnce, } from '@principles/core/runtime-v2';
+import { ActivationsConsoleModel } from './ActivationsConsoleModel.js';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function stringField(value, key) {
+    return record(value) && typeof value[key] === 'string' ? value[key] : '';
+}
+/** Derived review only. Binding authority stays inside the locked core Ledger writer. */
+export class RuleCandidateBindingConsoleModel {
+    workspaceDir;
+    constructor(workspaceDir) {
+        this.workspaceDir = workspaceDir;
+    }
+    ledger(stateManager) {
+        return new PrincipleTreeLedgerAdapter({
+            stateDir: path.join(this.workspaceDir, '.state'),
+            reviewSources: {
+                loadCandidateMaterial: async (candidateId) => {
+                    const candidate = await stateManager.getCandidate(candidateId);
+                    if (!candidate)
+                        return null;
+                    const [task, run, artifact] = await Promise.all([
+                        stateManager.getTask(candidate.taskId), stateManager.getRun(candidate.sourceRunId),
+                        stateManager.getArtifact(candidate.artifactId),
+                    ]);
+                    const parentTask = task?.taskKind === 'diag_router' && task.inputRef ? await stateManager.getTask(task.inputRef) : null;
+                    return { candidate, task, run, artifact, parentTask };
+                },
+            },
+        });
+    }
+    async list() {
+        // A fresh workspace with no state.db simply has no binding queue yet;
+        // any other storage problem still surfaces as an error (503 at the route).
+        if (!existsSync(path.join(this.workspaceDir, '.pd', 'state.db')))
+            return { items: [] };
+        const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
+        try {
+            const ledger = this.ledger(handle.stateManager);
+            // Split diagnoses commit their rule candidates on diag_router sub-tasks;
+            // the queue must surface both provenance shapes, not only direct
+            // diagnostician commits.
+            const tasks = [
+                ...await handle.stateManager.listTasks({ taskKind: 'diagnostician' }),
+                ...await handle.stateManager.listTasks({ taskKind: 'diag_router' }),
+            ];
+            const items = [];
+            for (const task of tasks) {
+                for (const candidate of await handle.stateManager.getCandidatesByTaskId(task.taskId)) {
+                    if (candidate.rawRecommendationKind !== 'rule')
+                        continue;
+                    const identity = ledger.resolveCandidatePrincipleIdentity(candidate.candidateId, 'rule');
+                    items.push({ candidateId: candidate.candidateId, text: candidate.description || candidate.title, reason: identity.status === 'unresolved' ? identity.reason : 'bound' });
+                }
+            }
+            return { items };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async review(candidateId, search) {
+        const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
+        try {
+            const result = await this.ledger(handle.stateManager).createRuleCandidateBindingReview(candidateId, { search, limit: 20 });
+            if (!result.ok)
+                return result;
+            const { candidateMaterial: material } = result;
+            return { ok: true, review: {
+                    candidateId, candidateText: stringField(material.candidate, 'description') || stringField(material.candidate, 'title'),
+                    sourcePainId: stringField(Reflect.get(material, 'parentTask'), 'inputRef') || stringField(material.task, 'inputRef'),
+                    evidence: stringField(material.artifact, 'contentJson') || stringField(material.candidate, 'sourceRecommendationJson'),
+                    candidateDigest: result.reviewedCandidateDigest,
+                    currentRevision: result.currentRevision,
+                    currentBinding: result.currentBinding,
+                    eligibleTargets: result.eligibleTargets.map(({ principle, reviewedPrincipleDigest }) => ({
+                        principleId: principle.id, text: principle.text, status: principle.status, version: principle.version, digest: reviewedPrincipleDigest,
+                    })),
+                    resumeNotice: '关联后自动启动一次现有配置的正文修订与代码生成、验证；沿用现有调用预算和超时。失败会保留关联与旧工件，不会自动循环，也不会批准或启用规则。',
+                } };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async mutate(candidateId, request, actorId) {
+        const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir });
+        try {
+            const ledger = this.ledger(handle.stateManager);
+            const result = await ledger.mutateRuleCandidateBinding({ candidateId, request, owner: { actorId, source: 'authenticated_console' } });
+            if (!result.ok)
+                return result;
+            if (request.action === 'bind') {
+                // Replays also resume the same cause: a crash after Ledger commit must not require another consent.
+                try {
+                    const revision = await reviseRuleBindingOnce({ stateManager: handle.stateManager, ledger: { resolveForCandidate: async (id) => ledger.resolveCandidatePrincipleIdentity(id, 'rule') }, candidateId, expectedBindingRevision: result.binding.revision });
+                    return { ...result, revision };
+                }
+                catch {
+                    return { ...result, revision: { status: 'refused', reason: 'revision_source_unavailable', nextAction: '关联已保存。重试相同请求以恢复同一次修订，或使用恢复入口；不要重新关联。' } };
+                }
+            }
+            // Revoke is independent of present target eligibility and never generates or deactivates anything.
+            let operations;
+            try {
+                operations = await new ActivationsConsoleModel(this.workspaceDir).getActivations();
+            }
+            catch {
+                operations = { status: 'degraded', activations: [], reason: 'activation_source_unavailable', nextAction: '运行记录暂不可读，请重新查看规则运行列表；不能据此认定没有运行中的规则。' };
+            }
+            return { ...result, operations, operationsScope: 'workspace', stopPath: '/activation', nextAction: '归属已撤回。已运行规则须在规则运行列表另行停用；撤回前已通过最终检查的在途操作仍可能完成。' };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async revise(candidateId, input) {
+        const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir });
+        try {
+            const ledger = this.ledger(handle.stateManager);
+            return await reviseRuleBindingOnce({ stateManager: handle.stateManager, ledger: { resolveForCandidate: async (id) => ledger.resolveCandidatePrincipleIdentity(id, 'rule') }, candidateId, ...input });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}

package/console/dist/server/models/artifact-principle-resolver.d.ts

@@ -1,7 +1,7 @@
-import { PrincipleTreeLedgerAdapter } from '@principles/core/runtime-v2';
 import type { PIArtifactRecord, SqliteConnection } from '@principles/core/runtime-v2';
+import { type LedgerResolutionDeps } from './principle-id-resolution.js';
 export interface ArtifactPrincipleResolutionDeps {
-    readonly ledger: PrincipleTreeLedgerAdapter;
+    readonly ledger: LedgerResolutionDeps['ledger'];
     readonly getArtifactById: (artifactId: string) => Promise<PIArtifactRecord | null>;
     /** Read one column from the tasks table (same workspace as the caller). */
     readonly getTaskDiagnosticJson: (taskId: string) => string | null;

package/console/dist/server/models/artifact-principle-resolver.js

@@ -20,8 +20,17 @@ function isRecord(value) {
  * per model call, not per artifact.
  */
 export function createArtifactPrincipleResolutionDeps(conn, artifactStore, workspaceDir) {
+    const adapter = new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') });
     return {
-        ledger: new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') }),
+        ledger: {
+            isAvailable: () => adapter.isAvailable(),
+            hasPrinciple: (id) => adapter.hasPrinciple(id),
+            listForCandidate: (id) => adapter.listForCandidate(id),
+            resolveForCandidate: async (id) => {
+                const row = conn.getDb().prepare('SELECT recommendation_kind FROM principle_candidates WHERE candidate_id = ?').get(id);
+                return adapter.resolveCandidatePrincipleIdentity(id, isRecord(row) ? row.recommendation_kind : undefined);
+            },
+        },
         getArtifactById: (artifactId) => artifactStore.getArtifactById(artifactId),
         getTaskDiagnosticJson: (taskId) => {
             const row = conn

package/console/dist/server/models/principle-id-resolution.d.ts

@@ -1,10 +1,10 @@
-import type { PIArtifactRecord, PIArtifactSnapshot } from '@principles/core/runtime-v2';
+import type { CandidatePrincipleIdentityResolution, PIArtifactRecord, PIArtifactSnapshot } from '@principles/core/runtime-v2';
 import type { PrincipleTreeLedgerAdapter } from '@principles/core/runtime-v2';
 /**
  * PRI-768 v5 follow-up (audit findings F3/F4): resolve the LEDGER principle id
  * behind an approval artifact.
  *
- * F4: `extractPrincipleId`'s last fallback returns `principleDraft.title`, and
+ * F4: `resolveLedgerActivationId`'s last fallback returns `principleDraft.title`, and
  * `ledger.activatePrinciple(<title>)` then always fails ("Cannot update missing
  * principle") because ledger keys are UUIDs, never titles. A candidate id must
  * be validated against the ledger before it is used as an update key.
@@ -32,19 +32,14 @@ export type LedgerPrincipleResolution = {
     reason: string;
 };
 export interface LedgerResolutionDeps {
-    ledger: PrincipleTreeLedgerAdapter;
+    ledger: Pick<PrincipleTreeLedgerAdapter, 'isAvailable' | 'hasPrinciple' | 'listForCandidate'> & {
+        resolveForCandidate?: (candidateId: string) => Promise<CandidatePrincipleIdentityResolution>;
+    };
     getArtifactById: (artifactId: string) => Promise<PIArtifactRecord | null>;
     /** Read one column from the tasks table; null when the row is missing. */
     getTaskDiagnosticJson: (taskId: string) => string | null;
 }
 export declare function toResolutionSnapshot(record: PIArtifactRecord): PIArtifactSnapshot;
-/** Candidate id embedded in a dreamer task id ("dreamer-<uuid>-<channel>"). */
-export declare function candidateIdFromDreamerTaskId(taskId: string | null | undefined): string | null;
-/**
- * Resolve the ledger principle id for an approval artifact. Direct hits
- * (sourcePrincipleId column / contentJson ids) are validated against the
- * ledger before being trusted; otherwise the candidate lineage is walked and
- * the ledger must resolve that candidate to EXACTLY ONE principle (multiple
- * matches stay unresolved — ambiguity must not be silently collapsed).
- */
+export { candidateIdFromDreamerTaskId } from '@principles/core/runtime-v2';
+/** All Console read models use the activation boundary's fail-closed identity semantics. */
 export declare function resolveLedgerPrincipleId(artifact: PIArtifactRecord, deps: LedgerResolutionDeps): Promise<LedgerPrincipleResolution>;

package/console/dist/server/models/principle-id-resolution.js

@@ -1,4 +1,4 @@
-import { extractPrincipleId } from '@principles/core/runtime-v2';
+import { resolveLedgerActivationId } from '@principles/core/runtime-v2';
 export function toResolutionSnapshot(record) {
     return {
         artifactId: record.artifactId,
@@ -13,98 +13,11 @@ export function toResolutionSnapshot(record) {
         updatedAt: record.updatedAt,
     };
 }
-const DREAMER_TASK_PREFIX = 'dreamer-';
-/** Candidate id embedded in a dreamer task id ("dreamer-<uuid>-<channel>"). */
-export function candidateIdFromDreamerTaskId(taskId) {
-    if (!taskId || !taskId.startsWith(DREAMER_TASK_PREFIX))
-        return null;
-    const withoutPrefix = taskId.slice(DREAMER_TASK_PREFIX.length);
-    const lastDash = withoutPrefix.lastIndexOf('-');
-    if (lastDash <= 0)
-        return null;
-    const candidateId = withoutPrefix.slice(0, lastDash);
-    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(candidateId)
-        ? candidateId
-        : null;
-}
-function isRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-function readDreamerArtifactId(artifact) {
-    try {
-        const parsed = JSON.parse(artifact.contentJson);
-        if (isRecord(parsed) && Object.hasOwn(parsed, 'sourceTrace')) {
-            const trace = parsed.sourceTrace;
-            if (isRecord(trace) && Object.hasOwn(trace, 'dreamerArtifactId')) {
-                const id = trace.dreamerArtifactId;
-                if (typeof id === 'string' && id.trim() !== '')
-                    return id;
-            }
-        }
-    }
-    catch {
-        // contentJson is untrusted; lineage fallback below still applies.
-    }
-    const lineage = artifact.lineageArtifactIds ?? [];
-    const dreamer = lineage.find((id) => typeof id === 'string' && id.includes('-dreamer-'));
-    return dreamer ?? null;
-}
-/**
- * Resolve the ledger principle id for an approval artifact. Direct hits
- * (sourcePrincipleId column / contentJson ids) are validated against the
- * ledger before being trusted; otherwise the candidate lineage is walked and
- * the ledger must resolve that candidate to EXACTLY ONE principle (multiple
- * matches stay unresolved — ambiguity must not be silently collapsed).
- */
+export { candidateIdFromDreamerTaskId } from '@principles/core/runtime-v2';
+/** All Console read models use the activation boundary's fail-closed identity semantics. */
 export async function resolveLedgerPrincipleId(artifact, deps) {
-    const direct = extractPrincipleId(toResolutionSnapshot(artifact));
-    if (direct && deps.ledger.hasPrinciple(direct)) {
-        return { status: 'resolved', principleId: direct, how: 'direct' };
-    }
-    const dreamerArtifactId = readDreamerArtifactId(artifact);
-    if (!dreamerArtifactId) {
-        return {
-            status: 'unresolved',
-            reason: `no ledger principle for "${direct ?? 'no id'}" and artifact has no dreamer lineage`,
-        };
-    }
-    const dreamerArtifact = await deps.getArtifactById(dreamerArtifactId);
-    if (!dreamerArtifact) {
-        return { status: 'unresolved', reason: `dreamer artifact ${dreamerArtifactId} not found` };
-    }
-    // The dreamer TASK seed is the authoritative carrier of the candidate id;
-    // the task-id spelling is only a fallback.
-    let candidateId = candidateIdFromDreamerTaskId(dreamerArtifact.sourceTaskId);
-    if (dreamerArtifact.sourceTaskId) {
-        const diagnosticJson = deps.getTaskDiagnosticJson(dreamerArtifact.sourceTaskId);
-        if (diagnosticJson) {
-            try {
-                const parsed = JSON.parse(diagnosticJson);
-                if (isRecord(parsed) && Object.hasOwn(parsed, 'candidateId')) {
-                    const value = parsed.candidateId;
-                    if (typeof value === 'string' && value.trim() !== '')
-                        candidateId = value.trim();
-                }
-            }
-            catch {
-                // Malformed seed JSON — fall back to the task-id derivation above.
-            }
-        }
-    }
-    if (!candidateId) {
-        return { status: 'unresolved', reason: 'dreamer lineage carries no candidate id' };
-    }
-    const matches = deps.ledger.listForCandidate(candidateId);
-    if (matches.length === 1) {
-        const [entry] = matches;
-        if (entry)
-            return { status: 'resolved', principleId: entry.id, how: 'candidate_lineage' };
-    }
-    if (matches.length === 0) {
-        return { status: 'unresolved', reason: `ledger has no principle derived from candidate ${candidateId}` };
-    }
-    return {
-        status: 'unresolved',
-        reason: `candidate ${candidateId} maps to ${matches.length} ledger principles; refusing to guess`,
-    };
+    const result = await resolveLedgerActivationId(toResolutionSnapshot(artifact), deps);
+    return result.status === 'resolved'
+        ? { status: 'resolved', principleId: result.principleId, how: result.how === 'direct_validated' ? 'direct' : 'candidate_lineage' }
+        : result;
 }

package/console/dist/server/routes/rule-candidate-bindings.d.ts

@@ -0,0 +1,10 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export interface RuleCandidateBindingRouteContext {
+    workspaceDir: string;
+    subPath: string;
+    ownerIdentity: {
+        ownerId: string;
+        credentialId: string;
+    } | null;
+}
+export declare function handleRuleCandidateBindingsRoute(req: IncomingMessage, res: ServerResponse, ctx: RuleCandidateBindingRouteContext): Promise<void>;

package/console/dist/server/routes/rule-candidate-bindings.js

@@ -0,0 +1,116 @@
+import { RuleCandidateBindingConsoleModel } from '../models/RuleCandidateBindingConsoleModel.js';
+import { readBody } from '../utils/request.js';
+import { sendSuccess, sendError, sendBadRequest, sendMethodNotAllowed } from '../utils/response.js';
+function closed(value, keys) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        && Object.keys(value).every(key => keys.includes(key));
+}
+function text(value, limit) {
+    return typeof value === 'string' && value.trim().length > 0 && value.length <= limit;
+}
+function revision(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+}
+function digest(value) { return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value); }
+function bindingBody(raw) {
+    const common = ['action', 'expectedRevision', 'reason', 'requestId', 'resumeOnce'];
+    if (!closed(raw, [...common, 'principleId', 'expectedCandidateDigest', 'expectedPrincipleDigest'])
+        || !revision(raw.expectedRevision) || !text(raw.reason, 2000) || !text(raw.requestId, 200))
+        return null;
+    if (raw.action === 'bind' && raw.resumeOnce === true && text(raw.principleId, 128)
+        && digest(raw.expectedCandidateDigest) && digest(raw.expectedPrincipleDigest)) {
+        return { action: 'bind', principleId: raw.principleId, expectedRevision: raw.expectedRevision,
+            expectedCandidateDigest: raw.expectedCandidateDigest, expectedPrincipleDigest: raw.expectedPrincipleDigest,
+            reason: raw.reason, requestId: raw.requestId, resumeOnce: true };
+    }
+    if (raw.action === 'revoke' && raw.resumeOnce === false && closed(raw, common)) {
+        return { action: 'revoke', expectedRevision: raw.expectedRevision, reason: raw.reason, requestId: raw.requestId, resumeOnce: false };
+    }
+    return null;
+}
+function failure(res, result) {
+    const status = result.reason.includes('unavailable') || result.reason.includes('corrupt') ? 503
+        : result.reason === 'candidate_missing' ? 404 : 409;
+    // The UI surfaces `message` first (api.ts request()); carrying the reason in
+    // it keeps the specific cause — stale revision, digest mismatch, ineligible
+    // target — visible to the Owner instead of a generic refusal.
+    sendError(res, status, result.reason, `当前材料无法完成此操作（${result.reason}）。`, { reason: result.reason, nextAction: result.nextAction });
+}
+export async function handleRuleCandidateBindingsRoute(req, res, ctx) {
+    // Auth precedes model construction and body parsing: a refused caller cannot create state.
+    if (!ctx.ownerIdentity) {
+        sendError(res, 403, 'owner_authentication_required', '请先完成控制台认证并配置 Owner 身份。', { nextAction: '在设置中确认 Owner 身份后重试。' });
+        return;
+    }
+    const model = new RuleCandidateBindingConsoleModel(ctx.workspaceDir);
+    const match = /^\/([^/]+)(?:\/(review|revise-once))?$/.exec(ctx.subPath);
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    try {
+        if ((ctx.subPath === '' || ctx.subPath === '/') && req.method === 'GET') {
+            sendSuccess(res, await model.list());
+            return;
+        }
+        if (!match?.[1]) {
+            sendError(res, 404, 'not_found', '未找到该关联入口。');
+            return;
+        }
+        const candidateId = decodeURIComponent(match[1]);
+        if (match[2] === 'review') {
+            if (req.method !== 'GET') {
+                sendMethodNotAllowed(res);
+                return;
+            }
+            const search = url.searchParams.get('search') ?? '';
+            if (search.length > 200) {
+                sendBadRequest(res, '搜索内容最多 200 字。');
+                return;
+            }
+            const result = await model.review(candidateId, search);
+            if (result.ok)
+                sendSuccess(res, result.review);
+            else
+                failure(res, result);
+            return;
+        }
+        if (req.method !== 'POST') {
+            sendMethodNotAllowed(res);
+            return;
+        }
+        let raw;
+        try {
+            raw = JSON.parse(await readBody(req));
+        }
+        catch {
+            sendBadRequest(res, '请求必须是有效的 JSON。');
+            return;
+        }
+        if (match[2] === 'revise-once') {
+            if (!closed(raw, ['expectedBindingRevision', 'expectedScribeTaskId', 'expectedTaskRevisionEpoch', 'requestId'])
+                || !revision(raw.expectedBindingRevision) || raw.expectedBindingRevision < 1
+                || !revision(raw.expectedTaskRevisionEpoch) || !text(raw.expectedScribeTaskId, 512) || !text(raw.requestId, 200)) {
+                sendBadRequest(res, '请提交当前关联、修订任务及版本；不接受身份或批准字段。');
+                return;
+            }
+            const result = await model.revise(candidateId, { expectedBindingRevision: raw.expectedBindingRevision, expectedScribeTaskId: raw.expectedScribeTaskId,
+                expectedTaskRevisionEpoch: raw.expectedTaskRevisionEpoch, requestId: raw.requestId });
+            if (result.status === 'refused')
+                failure(res, result);
+            else
+                sendSuccess(res, result);
+            return;
+        }
+        const request = bindingBody(raw);
+        if (!request) {
+            sendBadRequest(res, '关联与撤回必须使用各自完整字段；不接受身份、时间或批准字段。');
+            return;
+        }
+        const result = await model.mutate(candidateId, request, ctx.ownerIdentity.ownerId);
+        if (result.ok)
+            sendSuccess(res, result);
+        else
+            failure(res, result);
+    }
+    catch {
+        sendError(res, 503, 'binding_source_unavailable', '关联材料暂不可读。', { nextAction: '恢复当前工作区的数据来源后重新加载；不要假定操作已完成。' });
+    }
+}

package/console/dist/shared/rule-candidate-binding-contract.d.ts

@@ -0,0 +1,30 @@
+export interface RuleBindingTargetView {
+    principleId: string;
+    text: string;
+    status: string;
+    version: number;
+    digest: string;
+}
+export interface RuleBindingReviewView {
+    candidateId: string;
+    candidateText: string;
+    sourcePainId: string;
+    evidence: string;
+    candidateDigest: string;
+    currentRevision: number;
+    currentBinding: {
+        action: 'bind' | 'revoke';
+        principleId: string;
+        reason: string;
+        revision: number;
+    } | null;
+    eligibleTargets: RuleBindingTargetView[];
+    resumeNotice: string;
+}
+export interface RuleBindingQueueView {
+    items: {
+        candidateId: string;
+        text: string;
+        reason: string;
+    }[];
+}

package/console/dist/shared/rule-candidate-binding-contract.js

@@ -0,0 +1 @@
+export {};

package/console/dist/ui/api.d.ts

@@ -1,6 +1,8 @@
 import type { ApiResponse } from "../types.js";
 import type { OwnerDecisionsData, OwnerResolutionResultData, OwnerDecisionInboxData, OwnerDecisionLibraryData } from "./utils/validators.js";
 import type { DesignGateAction, DesignGateDecision, DesignGateDeclaration, DesignGateScope } from "@principles/core/runtime-v2/internalization/design-gate-facts";
+import type { RuleBindingReviewView, RuleBindingQueueView } from '../shared/rule-candidate-binding-contract.js';
+import type { RuleCandidateBindingRequest } from '@principles/core/runtime-v2';
 import type { GovernanceExperienceSnapshot, OwnerGovernanceView, OwnerDecisionViewCore } from '@principles/core/runtime-v2';
 import type { OwnerIdentityViewData, OwnerIdentityRegisterData, OwnerIdentityUnregisterData } from "./utils/validators.js";
 import type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, RecoveryResultData, FailedTaskDetailData, ActivationsData, DisableActivationData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, UpdateRecoveryData, UpdateTransactionData, ApprovalRecordData, PrinciplesListData, CorePrinciplesData, ApprovalsGroupedData, EvidenceChainData, TrajectoryData, IntentSummaryData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, IntentInitResultData, IntentSaveResultData, IntentRawContentData, IntentVersionData, RuleCodeOwnerReviewData, RuleCodeMutationData } from "./utils/validators.js";
@@ -41,6 +43,13 @@ export declare function shouldInvalidateSessionTokenOn401(requestToken: string |
 declare function request(path: string, options?: RequestInit): Promise<ApiResponse<unknown>>;
 declare function request<T>(path: string, options: RequestInit | undefined, validate: (value: unknown) => T | null): Promise<ApiResponse<T>>;
 declare function checkAuth(): Promise<boolean>;
+export declare function fetchRuleBindingQueue(): Promise<ApiResponse<RuleBindingQueueView>>;
+export declare function fetchRuleBindingReview(candidateId: string, search?: string): Promise<ApiResponse<RuleBindingReviewView>>;
+export declare function mutateRuleBinding(candidateId: string, body: RuleCandidateBindingRequest): Promise<ApiResponse<{
+    status: string;
+    revisionStatus?: string;
+    nextAction?: string;
+}>>;
 declare function fetchWorkspaces(): Promise<ApiResponse<WorkspaceEntryData[]>>;
 declare function addWorkspace(name: string, path: string): Promise<ApiResponse<WorkspaceEntryData>>;
 declare function removeWorkspace(name: string): Promise<ApiResponse<RemovedEnvelopeData>>;