create-principles-disciple 1.145.26 → 1.145.28

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
   "productVersion": "2.3.13",
-  "sourceCommit": "7fa8fd8361962f41676275ba26ac81d51e6ee84b"
+  "sourceCommit": "7195795954fd2ed208714ada70ccbc10b1efdfe6"
 }

package/console/dist/server/models/RuleCandidateBindingConsoleModel.d.ts

@@ -7,6 +7,19 @@ export declare class RuleCandidateBindingConsoleModel {
     private readonly workspaceDir;
     constructor(workspaceDir: string);
     private ledger;
+    /** One bounded readonly batch read of the pain events behind the queue.
+     * `degraded` names an unreadable trajectory store so lookups that found
+     * nothing are labeled 不可读 rather than 未记录 (rc-9 — never misattribute). */
+    private painSources;
+    /** Identity stays with the ledger adapter (the identity authority); the
+     * principle entry / decidedAt come from the caller's single file snapshot.
+     * bindingRevision rides along so the source-correction preview can anchor
+     * its eligibility to the CURRENT binding (PRI-1048 R6 #4). */
+    private queueBinding;
+    /** PRI-1048 R6 #4: read-only eligibility preview for source-correct-once.
+     * Only the bound+blocked shape can offer it; the click-time authority
+     * (reviseRuleSourceOnce) re-checks everything server-side. */
+    private sourceCorrectionPreview;
     list(): Promise<RuleBindingQueueView>;
     review(candidateId: string, search: string): Promise<{
         ok: true;
@@ -37,4 +50,17 @@ export declare class RuleCandidateBindingConsoleModel {
         scribeTaskId: string;
         taskRevisionEpoch: number;
     }>;
+    /**
+     * SPEC-PRI-1047 修复 B: 认证入口的一次 Owner source-correction。区别于
+     * revise（binding 修订预算）：这是「修正上游材料」的独立一次预算，回执
+     * 绑定真实 Owner actor/request。调用侧（路由）负责 ownerIdentity 门。
+     */
+    correctSource(candidateId: string, input: {
+        expectedBindingRevision: number;
+        expectedScribeTaskId: string;
+        expectedArtificerTaskId: string;
+        expectedScribeArtifactDigest: string;
+        reason: string;
+        requestId: string;
+    }, actorId: string): Promise<import("@principles/core/runtime-v2").ReviseRuleSourceOnceResult>;
 }

package/console/dist/server/models/RuleCandidateBindingConsoleModel.js

@@ -1,6 +1,8 @@
 import path from 'node:path';
 import { existsSync } from 'node:fs';
-import { createRuntimeStateHandle, PrincipleTreeLedgerAdapter, reviseRuleBindingOnce, } from '@principles/core/runtime-v2';
+import Database from 'better-sqlite3';
+import { createRuntimeStateHandle, PrincipleTreeLedgerAdapter, reviseRuleBindingOnce, resolveRuleBindingRevisionTarget, reviseRuleSourceOnce, previewRuleSourceCorrection, hydratePITaskRecord, candidateIdFromDreamerSeed, } from '@principles/core/runtime-v2';
+import { readLedgerFileState } from '@principles/core/principle-tree-ledger';
 import { ActivationsConsoleModel } from './ActivationsConsoleModel.js';
 function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -8,6 +10,108 @@ function record(value) {
 function stringField(value, key) {
     return record(value) && typeof value[key] === 'string' ? value[key] : '';
 }
+/** Internalization chain order; the queue projection walks it read-only. */
+const CHAIN_KINDS = ['dreamer', 'philosopher', 'scribe', 'artificer', 'evaluator', 'rollout_reviewer'];
+/** PRI-1048: bounded queue — a governance workspace carries tens of candidates;
+ * the cap keeps the derived scan bounded and the response honest via `truncated`. */
+const MAX_QUEUE_ITEMS = 200;
+function buildChainContext(allTasks) {
+    const byId = new Map(allTasks.map(task => [task.taskId, task]));
+    const dreamersByCandidate = new Map();
+    const dependentsByTaskId = new Map();
+    for (const task of allTasks) {
+        if (task.taskKind === 'dreamer') {
+            const seed = candidateIdFromDreamerSeed(task.diagnosticJson ?? null);
+            if (seed) {
+                const list = dreamersByCandidate.get(seed) ?? [];
+                list.push(task);
+                dreamersByCandidate.set(seed, list);
+            }
+        }
+        const pi = hydratePITaskRecord(task);
+        if (!pi)
+            continue;
+        for (const dependencyId of pi.dependencyTaskIds) {
+            const list = dependentsByTaskId.get(dependencyId) ?? [];
+            list.push(task);
+            dependentsByTaskId.set(dependencyId, list);
+        }
+    }
+    return { byId, dreamersByCandidate, dependentsByTaskId };
+}
+function walkChain(dreamer, context) {
+    let current = dreamer;
+    let kind = 'dreamer';
+    for (;;) {
+        if (!current)
+            return { stage: 'advanced', stageKind: kind, reasonCode: null, detail: null };
+        if (current.status === 'needs_human_review' || current.status === 'failed') {
+            const pi = hydratePITaskRecord(current);
+            const review = pi?.humanReviewContext;
+            return {
+                stage: 'blocked', stageKind: kind,
+                reasonCode: review && typeof review.reasonCode === 'string' ? review.reasonCode : null,
+                detail: review && typeof review.detail === 'string' ? review.detail : (current.lastError ?? null),
+            };
+        }
+        if (current.status !== 'succeeded')
+            return { stage: 'in_progress', stageKind: kind, reasonCode: null, detail: null };
+        const nextIndex = CHAIN_KINDS.indexOf(kind) + 1;
+        const nextKind = nextIndex < CHAIN_KINDS.length ? CHAIN_KINDS[nextIndex] : undefined;
+        if (!nextKind)
+            return { stage: 'advanced', stageKind: kind, reasonCode: null, detail: null };
+        const next = (context.dependentsByTaskId.get(current.taskId) ?? []).find(task => task.taskKind === nextKind);
+        if (!next)
+            return { stage: 'advanced', stageKind: kind, reasonCode: null, detail: null };
+        current = next;
+        kind = nextKind;
+    }
+}
+function deriveGeneration(candidateId, context) {
+    const dreamers = context.dreamersByCandidate.get(candidateId) ?? [];
+    if (dreamers.length === 0)
+        return { stage: 'not_built', stageKind: null, reasonCode: null, detail: null };
+    const walks = dreamers.map(dreamer => walkChain(dreamer, context));
+    const [first] = walks;
+    if (!first)
+        return { stage: 'ambiguous', stageKind: null, reasonCode: null, detail: null };
+    const sameWalk = (a, b) => a.stage === b.stage && a.stageKind === b.stageKind && a.reasonCode === b.reasonCode;
+    if (walks.every(walk => sameWalk(walk, first)))
+        return first;
+    return { stage: 'ambiguous', stageKind: null, reasonCode: null, detail: null };
+}
+/**
+ * Real backend eligibility only: the production resolver plus the exact
+ * budget rule reviseRuleBindingOnce enforces on the same scribe task. The
+ * revise-once route still authoritatively re-checks at click time.
+ */
+async function deriveResume(stateManager, candidateId) {
+    const target = await resolveRuleBindingRevisionTarget(stateManager, candidateId);
+    if (target.status !== 'ready')
+        return { status: 'refused', reason: target.reason, scribeTaskId: null, taskRevisionEpoch: null };
+    const scribe = await stateManager.getTask(target.scribeTaskId);
+    const pi = scribe ? hydratePITaskRecord(scribe) : null;
+    if (!scribe || !pi)
+        return { status: 'refused', reason: 'scribe_missing', scribeTaskId: target.scribeTaskId, taskRevisionEpoch: target.taskRevisionEpoch };
+    if (pi.ruleBindingRevisionCauseId || pi.revisionCauseId?.startsWith('rule-binding:')) {
+        return { status: 'refused', reason: 'revision_budget_exhausted', scribeTaskId: target.scribeTaskId, taskRevisionEpoch: target.taskRevisionEpoch };
+    }
+    return { status: 'ready', reason: null, scribeTaskId: target.scribeTaskId, taskRevisionEpoch: target.taskRevisionEpoch };
+}
+/** Uses the caller's ONE ledger snapshot: decidedAt + principle entry, no extra file read. */
+function boundPrincipleView(state, lookup) {
+    if (state.availability.status === 'unreadable')
+        return null;
+    const principle = Object.hasOwn(state.ledger.tree.principles, lookup.principleId) ? state.ledger.tree.principles[lookup.principleId] : undefined;
+    if (!principle)
+        return null;
+    const binding = Object.hasOwn(state.ledger.tree.ruleCandidateBindings ?? {}, lookup.candidateId)
+        ? state.ledger.tree.ruleCandidateBindings?.[lookup.candidateId]?.revisions.at(-1) : undefined;
+    return {
+        principleId: lookup.principleId, text: principle.text, status: principle.status,
+        version: principle.version, revision: lookup.revision, decidedAt: binding?.decidedAt ?? '',
+    };
+}
 /** Derived review only. Binding authority stays inside the locked core Ledger writer. */
 export class RuleCandidateBindingConsoleModel {
     workspaceDir;
@@ -32,31 +136,172 @@ export class RuleCandidateBindingConsoleModel {
             },
         });
     }
+    /** One bounded readonly batch read of the pain events behind the queue.
+     * `degraded` names an unreadable trajectory store so lookups that found
+     * nothing are labeled 不可读 rather than 未记录 (rc-9 — never misattribute). */
+    painSources(painIds) {
+        const result = new Map();
+        const distinct = [...new Set(painIds.filter(id => id !== ''))];
+        if (distinct.length === 0)
+            return { sources: result, degraded: null };
+        const dbPath = path.join(this.workspaceDir, '.state', 'trajectory.db');
+        if (!existsSync(dbPath))
+            return { sources: result, degraded: null };
+        let db = null;
+        try {
+            db = new Database(dbPath, { readonly: true });
+            const placeholders = distinct.map(() => '?').join(',');
+            const rows = db.prepare(`SELECT canonical_pain_id AS painId, source, text, created_at AS createdAt
+         FROM pain_events WHERE canonical_pain_id IN (${placeholders})`).all(...distinct);
+            // Multiple events may share a canonical id; keep the newest (same policy
+            // as the pain list ordering — newest first).
+            for (const row of rows) {
+                if (!record(row))
+                    continue;
+                const painId = typeof row.painId === 'string' ? row.painId : '';
+                if (painId === '')
+                    continue;
+                const existing = result.get(painId);
+                const createdAt = typeof row.createdAt === 'string' ? row.createdAt : null;
+                if (existing && existing.createdAt && createdAt && existing.createdAt >= createdAt)
+                    continue;
+                result.set(painId, {
+                    painId,
+                    text: typeof row.text === 'string' && row.text.trim() !== '' ? row.text : null,
+                    source: typeof row.source === 'string' ? row.source : 'unknown',
+                    createdAt,
+                });
+            }
+        }
+        catch {
+            // Read failure must not masquerade as never-recorded: the degraded flag
+            // turns missing lookups into 记录暂不可读 (rc-9 observable degradation).
+            return { sources: new Map(), degraded: 'trajectory_unreadable' };
+        }
+        finally {
+            db?.close();
+        }
+        return { sources: result, degraded: null };
+    }
+    /** Identity stays with the ledger adapter (the identity authority); the
+     * principle entry / decidedAt come from the caller's single file snapshot.
+     * bindingRevision rides along so the source-correction preview can anchor
+     * its eligibility to the CURRENT binding (PRI-1048 R6 #4). */
+    queueBinding(stateManager, ledgerState, candidateId) {
+        const identity = this.ledger(stateManager).resolveCandidatePrincipleIdentity(candidateId, 'rule');
+        if (identity.status === 'resolved') {
+            const view = boundPrincipleView(ledgerState, { candidateId, principleId: identity.principleId, revision: identity.bindingRevision ?? 0 });
+            if (view)
+                return { view: { status: 'bound', principle: view }, bindingRevision: identity.bindingRevision ?? null };
+            // Bound in the ledger but the principle entry itself is unreadable or
+            // gone — surface as attention, never silently unlinked.
+            return { view: { status: 'attention', reason: 'bound_principle_unreadable' }, bindingRevision: identity.bindingRevision ?? null };
+        }
+        if (identity.reason === 'missing')
+            return { view: { status: 'unlinked' }, bindingRevision: null };
+        if (identity.reason === 'binding_revoked')
+            return { view: { status: 'binding_revoked' }, bindingRevision: null };
+        return { view: { status: 'attention', reason: identity.reason }, bindingRevision: null };
+    }
+    /** PRI-1048 R6 #4: read-only eligibility preview for source-correct-once.
+     * Only the bound+blocked shape can offer it; the click-time authority
+     * (reviseRuleSourceOnce) re-checks everything server-side. */
+    async sourceCorrectionPreview(stateManager, candidateId, bindingRevision) {
+        const ledger = this.ledger(stateManager);
+        const preview = await previewRuleSourceCorrection({
+            stateManager,
+            ledger: { resolveForCandidate: async (id) => ledger.resolveCandidatePrincipleIdentity(id, 'rule') },
+            candidateId,
+            expectedBindingRevision: bindingRevision,
+        });
+        return preview.status === 'ready'
+            ? {
+                status: 'ready', reason: null,
+                scribeTaskId: preview.scribeTaskId, artificerTaskId: preview.artificerTaskId,
+                scribeArtifactDigest: preview.scribeArtifactDigest, expectedBindingRevision: preview.expectedBindingRevision,
+            }
+            : { status: 'unavailable', reason: preview.reason, scribeTaskId: null, artificerTaskId: null, scribeArtifactDigest: null, expectedBindingRevision: null };
+    }
     async list() {
         // A fresh workspace with no state.db simply has no binding queue yet;
         // any other storage problem still surfaces as an error (503 at the route).
-        if (!existsSync(path.join(this.workspaceDir, '.pd', 'state.db')))
-            return { items: [] };
+        if (!existsSync(path.join(this.workspaceDir, '.pd', 'state.db'))) {
+            return { items: [], summary: { painGroups: 0, candidates: 0, bound: 0, unlinked: 0, blocked: 0 }, truncated: false };
+        }
         const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
         try {
-            const ledger = this.ledger(handle.stateManager);
+            const { stateManager } = handle;
+            const allTasks = await stateManager.listTasks();
+            const taskById = new Map(allTasks.map(task => [task.taskId, task]));
             // Split diagnoses commit their rule candidates on diag_router sub-tasks;
-            // the queue must surface both provenance shapes, not only direct
-            // diagnostician commits.
-            const tasks = [
-                ...await handle.stateManager.listTasks({ taskKind: 'diagnostician' }),
-                ...await handle.stateManager.listTasks({ taskKind: 'diag_router' }),
-            ];
-            const items = [];
-            for (const task of tasks) {
-                for (const candidate of await handle.stateManager.getCandidatesByTaskId(task.taskId)) {
+            // getCandidatesByTaskId already spans "own + child" tasks, so traversing
+            // BOTH task lists surfaces router-committed candidates twice. The queue
+            // aggregation owner (this model) dedupes by canonical candidateId; the
+            // shared store query keeps its semantics for every other consumer.
+            const diagnosisTasks = allTasks.filter(task => task.taskKind === 'diagnostician' || task.taskKind === 'diag_router');
+            const collected = new Map();
+            for (const task of diagnosisTasks) {
+                for (const candidate of await stateManager.getCandidatesByTaskId(task.taskId)) {
                     if (candidate.rawRecommendationKind !== 'rule')
                         continue;
-                    const identity = ledger.resolveCandidatePrincipleIdentity(candidate.candidateId, 'rule');
-                    items.push({ candidateId: candidate.candidateId, text: candidate.description || candidate.title, reason: identity.status === 'unresolved' ? identity.reason : 'bound' });
+                    if (collected.has(candidate.candidateId))
+                        continue;
+                    // Source pain: a router candidate resolves through its parent
+                    // diagnostician; a direct candidate reads its own inputRef.
+                    const candidateTask = taskById.get(candidate.taskId) ?? task;
+                    const parentTask = candidateTask.taskKind === 'diag_router' && candidateTask.inputRef
+                        ? taskById.get(candidateTask.inputRef) : undefined;
+                    const diagnosisTaskId = parentTask?.taskId ?? candidateTask.taskId;
+                    const painId = (parentTask?.inputRef ?? candidateTask.inputRef) ?? '';
+                    collected.set(candidate.candidateId, {
+                        candidateId: candidate.candidateId,
+                        text: candidate.description || candidate.title,
+                        painId, diagnosisTaskId,
+                    });
                 }
             }
-            return { items };
+            const truncated = collected.size > MAX_QUEUE_ITEMS;
+            const entries = [...collected.values()].slice(0, MAX_QUEUE_ITEMS);
+            const painLookup = this.painSources(entries.map(entry => entry.painId));
+            const chainContext = buildChainContext(allTasks);
+            const ledgerState = readLedgerFileState(path.join(this.workspaceDir, '.state'));
+            const items = [];
+            for (const entry of entries) {
+                const diagnosisTask = chainContext.byId.get(entry.diagnosisTaskId) ?? null;
+                const { view: binding, bindingRevision } = this.queueBinding(stateManager, ledgerState, entry.candidateId);
+                const generation = binding.status === 'unlinked' ? null : deriveGeneration(entry.candidateId, chainContext);
+                const resume = binding.status === 'bound' ? await deriveResume(stateManager, entry.candidateId) : null;
+                // PRI-1048 R6 #4: the source-correction entry applies to the bound+blocked
+                // shape only (the binding revision budget is typically already spent there).
+                const sourceCorrection = binding.status === 'bound' && generation?.stage === 'blocked' && bindingRevision !== null
+                    ? await this.sourceCorrectionPreview(stateManager, entry.candidateId, bindingRevision)
+                    : null;
+                items.push({
+                    candidateId: entry.candidateId,
+                    text: entry.text,
+                    pain: painLookup.sources.get(entry.painId) ?? {
+                        painId: entry.painId, text: null,
+                        source: painLookup.degraded === 'trajectory_unreadable' && entry.painId !== '' ? 'unreadable' : 'unknown',
+                        createdAt: null,
+                    },
+                    diagnosisStatus: diagnosisTask?.status ?? 'unknown',
+                    binding,
+                    generation,
+                    resume,
+                    sourceCorrection,
+                });
+            }
+            return {
+                items,
+                summary: {
+                    painGroups: new Set(items.map(item => item.pain.painId === '' ? `candidate:${item.candidateId}` : item.pain.painId)).size,
+                    candidates: items.length,
+                    bound: items.filter(item => item.binding.status === 'bound').length,
+                    unlinked: items.filter(item => item.binding.status === 'unlinked').length,
+                    blocked: items.filter(item => item.generation?.stage === 'blocked').length,
+                },
+                truncated,
+            };
         }
         finally {
             await handle.close();
@@ -65,20 +310,44 @@ export class RuleCandidateBindingConsoleModel {
     async review(candidateId, search) {
         const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
         try {
-            const result = await this.ledger(handle.stateManager).createRuleCandidateBindingReview(candidateId, { search, limit: 20 });
+            const { stateManager } = handle;
+            const result = await this.ledger(stateManager).createRuleCandidateBindingReview(candidateId, { search, limit: 20 });
             if (!result.ok)
                 return result;
             const { candidateMaterial: material } = result;
+            const parentTaskInputRef = stringField(Reflect.get(material, 'parentTask'), 'inputRef');
+            const painId = parentTaskInputRef || stringField(material.task, 'inputRef');
+            const painLookup = this.painSources([painId]);
+            const pain = painLookup.sources.get(painId) ?? {
+                painId, text: null,
+                source: painLookup.degraded === 'trajectory_unreadable' && painId !== '' ? 'unreadable' : 'unknown',
+                createdAt: null,
+            };
+            const { currentBinding } = result;
+            const isBound = currentBinding?.action === 'bind';
+            const boundPrinciple = isBound && currentBinding
+                ? boundPrincipleView(readLedgerFileState(path.join(this.workspaceDir, '.state')), { candidateId, principleId: currentBinding.principleId, revision: currentBinding.revision })
+                : null;
+            const chainContext = buildChainContext(await stateManager.listTasks());
+            const generation = isBound ? deriveGeneration(candidateId, chainContext) : null;
+            const resume = isBound ? await deriveResume(stateManager, candidateId) : null;
+            const sourceCorrection = isBound && generation?.stage === 'blocked' && currentBinding
+                ? await this.sourceCorrectionPreview(stateManager, candidateId, currentBinding.revision)
+                : null;
             return { ok: true, review: {
                     candidateId, candidateText: stringField(material.candidate, 'description') || stringField(material.candidate, 'title'),
-                    sourcePainId: stringField(Reflect.get(material, 'parentTask'), 'inputRef') || stringField(material.task, 'inputRef'),
+                    sourcePain: pain,
                     evidence: stringField(material.artifact, 'contentJson') || stringField(material.candidate, 'sourceRecommendationJson'),
                     candidateDigest: result.reviewedCandidateDigest,
                     currentRevision: result.currentRevision,
-                    currentBinding: result.currentBinding,
+                    currentBinding,
+                    boundPrinciple,
                     eligibleTargets: result.eligibleTargets.map(({ principle, reviewedPrincipleDigest }) => ({
                         principleId: principle.id, text: principle.text, status: principle.status, version: principle.version, digest: reviewedPrincipleDigest,
                     })),
+                    generation,
+                    resume,
+                    sourceCorrection,
                     resumeNotice: '关联后自动启动一次现有配置的正文修订与代码生成、验证；沿用现有调用预算和超时。失败会保留关联与旧工件，不会自动循环，也不会批准或启用规则。',
                 } };
         }
@@ -127,4 +396,25 @@ export class RuleCandidateBindingConsoleModel {
             await handle.close();
         }
     }
+    /**
+     * SPEC-PRI-1047 修复 B: 认证入口的一次 Owner source-correction。区别于
+     * revise（binding 修订预算）：这是「修正上游材料」的独立一次预算，回执
+     * 绑定真实 Owner actor/request。调用侧（路由）负责 ownerIdentity 门。
+     */
+    async correctSource(candidateId, input, actorId) {
+        const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir });
+        try {
+            const ledger = this.ledger(handle.stateManager);
+            return await reviseRuleSourceOnce({
+                stateManager: handle.stateManager,
+                ledger: { resolveForCandidate: async (id) => ledger.resolveCandidatePrincipleIdentity(id, 'rule') },
+                candidateId,
+                ...input,
+                actor: actorId,
+            });
+        }
+        finally {
+            await handle.close();
+        }
+    }
 }

package/console/dist/server/routes/rule-candidate-bindings.js

@@ -43,7 +43,7 @@ export async function handleRuleCandidateBindingsRoute(req, res, ctx) {
         return;
     }
     const model = new RuleCandidateBindingConsoleModel(ctx.workspaceDir);
-    const match = /^\/([^/]+)(?:\/(review|revise-once))?$/.exec(ctx.subPath);
+    const match = /^\/([^/]+)(?:\/(review|revise-once|source-correct-once))?$/.exec(ctx.subPath);
     const url = new URL(req.url ?? '/', 'http://localhost');
     try {
         if ((ctx.subPath === '' || ctx.subPath === '/') && req.method === 'GET') {
@@ -84,6 +84,31 @@ export async function handleRuleCandidateBindingsRoute(req, res, ctx) {
             sendBadRequest(res, '请求必须是有效的 JSON。');
             return;
         }
+        if (match[2] === 'source-correct-once') {
+            // SPEC-PRI-1047: one bounded Owner source-correction per candidate. Closed
+            // field set: chain identity + digest precondition + reason/requestId —
+            // never identity-fabrication or approval fields.
+            if (!closed(raw, ['expectedBindingRevision', 'expectedScribeTaskId', 'expectedArtificerTaskId', 'expectedScribeArtifactDigest', 'reason', 'requestId'])
+                || !revision(raw.expectedBindingRevision) || raw.expectedBindingRevision < 1
+                || !text(raw.expectedScribeTaskId, 512) || !text(raw.expectedArtificerTaskId, 512)
+                || !digest(raw.expectedScribeArtifactDigest) || !text(raw.reason, 2000) || !text(raw.requestId, 200)) {
+                sendBadRequest(res, '请提交当前关联、原候选链任务与工件摘要；不接受身份或批准字段。');
+                return;
+            }
+            const result = await model.correctSource(candidateId, {
+                expectedBindingRevision: raw.expectedBindingRevision,
+                expectedScribeTaskId: raw.expectedScribeTaskId,
+                expectedArtificerTaskId: raw.expectedArtificerTaskId,
+                expectedScribeArtifactDigest: raw.expectedScribeArtifactDigest,
+                reason: raw.reason,
+                requestId: raw.requestId,
+            }, ctx.ownerIdentity.ownerId);
+            if (result.status === 'refused')
+                failure(res, result);
+            else
+                sendSuccess(res, result);
+            return;
+        }
         if (match[2] === 'revise-once') {
             if (!closed(raw, ['expectedBindingRevision', 'expectedScribeTaskId', 'expectedTaskRevisionEpoch', 'requestId'])
                 || !revision(raw.expectedBindingRevision) || raw.expectedBindingRevision < 1

package/console/dist/shared/rule-candidate-binding-contract.d.ts

@@ -1,3 +1,91 @@
+/** Owner-facing projection DTOs for the rule-candidate binding queue (PRI-1048).
+ * Derived read-only views over existing authorities (state.db tasks/candidates,
+ * trajectory.db pain_events, the principle ledger, the internalization chain).
+ * No new persisted state; the Ledger remains the only binding authority. */
+/** Which owner feedback produced the candidate. Text is null when the pain
+ * record is gone — the UI must show 未记录, never fabricate a quote. */
+export interface RuleBindingPainSourceView {
+    painId: string;
+    text: string | null;
+    source: string;
+    createdAt: string | null;
+}
+/** The formal principle a candidate is currently bound to (ledger authority). */
+export interface RuleBindingBoundPrincipleView {
+    principleId: string;
+    text: string;
+    status: string;
+    version: number;
+    revision: number;
+    decidedAt: string;
+}
+/** Where the bound candidate's regeneration chain stands. `stageKind` names the
+ * deepest internalization task reached ('scribe', 'artificer', …). Blocked
+ * carries the server's reasonCode (e.g. textual_basis_unanchored) verbatim. */
+export interface RuleBindingGenerationView {
+    stage: 'not_built' | 'in_progress' | 'blocked' | 'advanced' | 'ambiguous';
+    stageKind: string | null;
+    reasonCode: string | null;
+    detail: string | null;
+}
+/** Real backend revision eligibility, resolved by the production resolver
+ * (resolveRuleBindingRevisionTarget + the same budget rule reviseRuleBindingOnce
+ * enforces). The UI may only offer 修订并继续 when status === 'ready'. */
+export interface RuleBindingResumeView {
+    status: 'ready' | 'refused';
+    reason: string | null;
+    scribeTaskId: string | null;
+    /** CAS input for the revise-once request (ready only). */
+    taskRevisionEpoch: number | null;
+}
+/** PRI-1048 (Owner review R6 #4): read-only eligibility preview for the
+ * source-correct-once capability (PRI-1047) — the bounded one-shot source
+ * revision that applies when the Artificer stopped for a SOURCE-material
+ * defect and the binding revision budget is spent. Click-time authority
+ * stays with reviseRuleSourceOnce on the server. */
+export interface RuleBindingSourceCorrectionView {
+    status: 'ready' | 'unavailable';
+    reason: string | null;
+    /** CAS inputs for the source-correct-once request (ready only). */
+    scribeTaskId: string | null;
+    artificerTaskId: string | null;
+    scribeArtifactDigest: string | null;
+    expectedBindingRevision: number | null;
+}
+export type RuleBindingQueueBindingView = {
+    status: 'unlinked';
+} | {
+    status: 'bound';
+    principle: RuleBindingBoundPrincipleView;
+} | {
+    status: 'binding_revoked';
+} | {
+    status: 'attention';
+    reason: string;
+};
+export interface RuleBindingQueueItem {
+    candidateId: string;
+    text: string;
+    pain: RuleBindingPainSourceView;
+    diagnosisStatus: string;
+    binding: RuleBindingQueueBindingView;
+    generation: RuleBindingGenerationView | null;
+    resume: RuleBindingResumeView | null;
+    /** PRI-1048 R6 #4: non-null only when bound (null = the capability does not apply). */
+    sourceCorrection: RuleBindingSourceCorrectionView | null;
+}
+export interface RuleBindingQueueSummary {
+    painGroups: number;
+    candidates: number;
+    bound: number;
+    unlinked: number;
+    blocked: number;
+}
+export interface RuleBindingQueueView {
+    items: RuleBindingQueueItem[];
+    summary: RuleBindingQueueSummary;
+    truncated: boolean;
+}
 export interface RuleBindingTargetView {
     principleId: string;
     text: string;
@@ -8,7 +96,7 @@ export interface RuleBindingTargetView {
 export interface RuleBindingReviewView {
     candidateId: string;
     candidateText: string;
-    sourcePainId: string;
+    sourcePain: RuleBindingPainSourceView;
     evidence: string;
     candidateDigest: string;
     currentRevision: number;
@@ -18,13 +106,10 @@ export interface RuleBindingReviewView {
         reason: string;
         revision: number;
     } | null;
+    boundPrinciple: RuleBindingBoundPrincipleView | null;
     eligibleTargets: RuleBindingTargetView[];
+    generation: RuleBindingGenerationView | null;
+    resume: RuleBindingResumeView | null;
+    sourceCorrection: RuleBindingSourceCorrectionView | null;
     resumeNotice: string;
 }
-export interface RuleBindingQueueView {
-    items: {
-        candidateId: string;
-        text: string;
-        reason: string;
-    }[];
-}

package/console/dist/shared/rule-candidate-binding-contract.js

@@ -1 +1,5 @@
+/** Owner-facing projection DTOs for the rule-candidate binding queue (PRI-1048).
+ * Derived read-only views over existing authorities (state.db tasks/candidates,
+ * trajectory.db pain_events, the principle ledger, the internalization chain).
+ * No new persisted state; the Ledger remains the only binding authority. */
 export {};

package/console/dist/ui/api.d.ts

@@ -50,6 +50,34 @@ export declare function mutateRuleBinding(candidateId: string, body: RuleCandida
     revisionStatus?: string;
     nextAction?: string;
 }>>;
+/** PRI-1048: consume the REAL backend revision capability (revise-once route);
+ * eligibility was resolved server-side from the production resolver. */
+export declare function reviseRuleBindingOnce(candidateId: string, body: {
+    expectedBindingRevision: number;
+    expectedScribeTaskId: string;
+    expectedTaskRevisionEpoch: number;
+    requestId: string;
+}): Promise<ApiResponse<{
+    status: string;
+    reason?: string;
+    nextAction?: string;
+}>>;
+/** PRI-1048 R6 #4: the bounded one-shot SOURCE correction (PRI-1047) — the
+ * capability that applies when the binding revision budget is spent and the
+ * Artificer stopped for a source-material defect. CAS inputs come from the
+ * server-computed sourceCorrection preview; the server re-validates all of it. */
+export declare function correctRuleSource(candidateId: string, body: {
+    expectedBindingRevision: number;
+    expectedScribeTaskId: string;
+    expectedArtificerTaskId: string;
+    expectedScribeArtifactDigest: string;
+    reason: string;
+    requestId: string;
+}): Promise<ApiResponse<{
+    status: string;
+    reason?: string;
+    nextAction?: string;
+}>>;
 declare function fetchWorkspaces(): Promise<ApiResponse<WorkspaceEntryData[]>>;
 declare function addWorkspace(name: string, path: string): Promise<ApiResponse<WorkspaceEntryData>>;
 declare function removeWorkspace(name: string): Promise<ApiResponse<RemovedEnvelopeData>>;

package/console/dist/ui/api.js

@@ -1,5 +1,5 @@
 import { clearStoredToken, loadStoredToken, storeToken } from "./utils/token-storage.js";
-import { validateBindingReview, validateBindingQueue, validateBindingMutation } from './utils/rule-binding-validators.js';
+import { validateBindingReview, validateBindingQueue, validateBindingMutation, validateBindingRevise } from './utils/rule-binding-validators.js';
 import { validateErrorResponse, validateHeaders, validateFeedbackReport, validateFeedbackDraftsList, validateFeedbackDraftEnvelope, validateFeedbackChannels, validateFeedbackSubmitResult, validateDeleteEnvelope, validateWorkspaceEntry, validateWorkspaceList, validateRemovedEnvelope, validateSyncResult, validateConfigSummary, validateConfigCatalog, validateAgentBindingUpdate, validateDefaultRuntimeUpdate, validateRuntimeProfileMutation, validateReadinessCheck, validateFeatureFlagUpdate, validateOutputLanguage, validateGovernanceQueue, validateRecoveryResult, validateFailedTaskDetail, validateOwnerDecisionsData, validateOwnerResolutionResult, validateActivations, validateDisableActivation, validateLifecycleMetrics, validateUpdateStatus, validateUpdateHistory, validateApplyUpdateResult, validateUpdateRecovery, validateUpdateTransaction, validateApprovalRecordDirect, validatePrinciplesList, validateCorePrinciples, validateApprovalsGrouped, validateEvidenceChain, validateTrajectoryData, validateIntentSummary, validateIntentDecisionList, validateIntentDecisionResult, validateIntentDecisionSummary, validateFollowUpResponse, validateIntentInitResult, validateIntentSaveResult, validateIntentRawContent, validateIntentVersions, validateOwnerGovernanceView, validateOwnerDecisionViewCore, validateOwnerDecisionInbox, validateOwnerDecisionLibrary, validateGovernanceExperienceSnapshot, validateRuleCodeOwnerReview, validateRuleCodeMutation, validateOwnerIdentityView, validateOwnerIdentityRegister, validateOwnerIdentityUnregister, } from "./utils/validators.js";
 // ── Auth ──────────────────────────────────────────────────────────────────────
 function getToken() {
@@ -136,6 +136,18 @@ export function fetchRuleBindingReview(candidateId, search = '') {
 export function mutateRuleBinding(candidateId, body) {
     return request(`/api/v1/governance/rule-candidate-bindings/${encodeURIComponent(candidateId)}`, { method: 'POST', body: JSON.stringify(body) }, validateBindingMutation);
 }
+/** PRI-1048: consume the REAL backend revision capability (revise-once route);
+ * eligibility was resolved server-side from the production resolver. */
+export function reviseRuleBindingOnce(candidateId, body) {
+    return request(`/api/v1/governance/rule-candidate-bindings/${encodeURIComponent(candidateId)}/revise-once`, { method: 'POST', body: JSON.stringify(body) }, validateBindingRevise);
+}
+/** PRI-1048 R6 #4: the bounded one-shot SOURCE correction (PRI-1047) — the
+ * capability that applies when the binding revision budget is spent and the
+ * Artificer stopped for a source-material defect. CAS inputs come from the
+ * server-computed sourceCorrection preview; the server re-validates all of it. */
+export function correctRuleSource(candidateId, body) {
+    return request(`/api/v1/governance/rule-candidate-bindings/${encodeURIComponent(candidateId)}/source-correct-once`, { method: 'POST', body: JSON.stringify(body) }, validateBindingRevise);
+}
 async function fetchWorkspaces() {
     return request("/api/workspaces", undefined, validateWorkspaceList);
 }