create-principles-disciple 1.145.30 → 1.145.33

package/host-runtime/dist/production-pain-evidence.js

@@ -314,6 +314,22 @@ function ensureToolCallsProjectDirColumn(db) {
         // the prepared-statement readiness check below fails loud if absent.
     }
 }
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 R2: additive migration for producer host
+ * attribution. Legacy rows stay NULL — the WorkBuddy rule-context reader
+ * treats a NULL stamp as unprovable (never guessed), so no backfill exists.
+ */
+function ensureToolCallsHostKindColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(tool_calls)').all();
+    if (columns.some((row) => pragmaField(row, 'name') === 'host_kind'))
+        return;
+    try {
+        db.exec('ALTER TABLE tool_calls ADD COLUMN host_kind TEXT');
+    }
+    catch {
+        // Same concurrent-writer contract as the sibling migrations above.
+    }
+}
 /**
  * SPEC-CODEX-PAIN-CLOSURE-001 CR-01: upgrade the live-hook observation of a
  * tool call with the host-verified final result (exit code) read through the
@@ -342,9 +358,18 @@ export function recordVerifiedToolOutcomes(args) {
         if (!hasToolCalls)
             applyTrajectorySchemaBase(db);
         ensureToolCallsToolUseIdColumn(db);
-        const findByToolUseId = db.prepare('SELECT id, outcome FROM tool_calls WHERE session_id = ? AND tool_use_id = ? ORDER BY id LIMIT 1');
+        ensureToolCallsHostKindColumn(db);
+        // Review R3/P2: a KNOWN host's call identity includes its attribution.
+        // The lookup matches ONLY rows of the same host — a colliding row from
+        // another host (or an unattributed legacy row) is a DIFFERENT record: the
+        // caller inserts its own row instead of swallowing or claiming it.
+        // Callers without a hostKind keep the historical match-any semantics
+        // (explicit compat contract, asserted by tests).
+        const findByToolUseId = args.hostKind !== undefined
+            ? db.prepare('SELECT id, outcome FROM tool_calls WHERE session_id = ? AND tool_use_id = ? AND host_kind = ? ORDER BY id LIMIT 1')
+            : db.prepare('SELECT id, outcome FROM tool_calls WHERE session_id = ? AND tool_use_id = ? ORDER BY id LIMIT 1');
         const upgradeUnknown = db.prepare("UPDATE tool_calls SET outcome = ?, exit_code = ?, result_preview = COALESCE(?, result_preview) WHERE id = ? AND outcome = 'unknown'");
-        const insertVerified = db.prepare('INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
+        const insertVerified = db.prepare('INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, host_kind) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
         const upsertSession = db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at');
         const createdAt = new Date().toISOString();
         db.transaction(() => {
@@ -352,7 +377,9 @@ export function recordVerifiedToolOutcomes(args) {
                 if (typeof input.exitCode !== 'number' || !Number.isInteger(input.exitCode))
                     continue;
                 const finalOutcome = input.exitCode === 0 ? 'success' : 'failure';
-                const existing = findByToolUseId.get(args.sessionId, input.toolUseId);
+                const existing = (args.hostKind !== undefined
+                    ? findByToolUseId.get(args.sessionId, input.toolUseId, args.hostKind)
+                    : findByToolUseId.get(args.sessionId, input.toolUseId));
                 const boundedPreview = typeof input.outputPreview === 'string' && input.outputPreview.length > 0
                     ? input.outputPreview.slice(0, MAX_PREVIEW)
                     : null;
@@ -368,7 +395,7 @@ export function recordVerifiedToolOutcomes(args) {
                 }
                 upsertSession.run(args.sessionId, createdAt, createdAt);
                 const sanitizedParams = sanitizeToolParams(input.params ?? {}, args.workspaceDir);
-                const info = insertVerified.run(args.sessionId, input.toolName, finalOutcome, null, input.exitCode, null, null, null, null, stable(sanitizedParams), boundedPreview, createdAt, input.toolUseId);
+                const info = insertVerified.run(args.sessionId, input.toolName, finalOutcome, null, input.exitCode, null, null, null, null, stable(sanitizedParams), boundedPreview, createdAt, input.toolUseId, args.hostKind ?? null);
                 results.push({ status: 'inserted', id: Number(info.lastInsertRowid) });
             }
         })();
@@ -426,6 +453,7 @@ export function createProductionPainEvidenceHandler(options = {}) {
             db.pragma('busy_timeout = 5000');
             ensureToolCallsToolUseIdColumn(db);
             ensureToolCallsProjectDirColumn(db);
+            ensureToolCallsHostKindColumn(db);
             if (!hasCanonicalSchema(db)) {
                 db.close();
                 db = undefined;
@@ -520,20 +548,30 @@ export function createProductionPainEvidenceHandler(options = {}) {
                 // CR-01: the host tool-call id is the stable join key for the
                 // consent-gated transcript upgrade (recordVerifiedToolOutcomes);
                 // content-shape probing stays the fallback for hosts without ids.
+                // Review R3/P2: for a known host the identity is host-scoped — a
+                // colliding row from ANOTHER host (or an unattributed legacy row) is
+                // NOT this delivery's duplicate, so both hosts keep independent
+                // records instead of the second being swallowed.
                 if (event.context.toolCallId !== undefined
-                    && db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ?').get(event.context.sessionId, event.context.toolCallId) !== undefined) {
+                    && (options.hostKind !== undefined
+                        ? db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ? AND host_kind = ?').get(event.context.sessionId, event.context.toolCallId, options.hostKind)
+                        : db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ?').get(event.context.sessionId, event.context.toolCallId)) !== undefined) {
                     duplicate = true;
                     duplicateAdmitted = db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) !== undefined;
                     return;
                 }
-                if (db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?').get(event.context.sessionId, toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview)) {
+                // Review R3/P2: the content-shape fallback dedup is host-scoped the
+                // same way — identical content from two hosts is two records.
+                if ((options.hostKind !== undefined
+                    ? db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ? AND host_kind = ?').get(event.context.sessionId, toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview, options.hostKind)
+                    : db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?').get(event.context.sessionId, toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview)) !== undefined) {
                     duplicate = true;
                     duplicateAdmitted = db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) !== undefined;
                     return;
                 }
                 db.prepare(`INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at`).run(event.context.sessionId, createdAt, createdAt);
-                db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(event.context.sessionId, toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, createdAt, event.context.toolCallId ?? null, path.resolve(options.projectDir ?? event.context.workspaceDir));
+                db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir, host_kind) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                    .run(event.context.sessionId, toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, createdAt, event.context.toolCallId ?? null, path.resolve(options.projectDir ?? event.context.workspaceDir), options.hostKind ?? null);
                 if (admitted) {
                     // Raw observation only (Pain Diagnosis Persistence SPEC §8): the
                     // pain row must record WHAT happened, not WHY. Attribution

package/host-runtime/dist/production-rulehost-gate.js

@@ -350,21 +350,26 @@ export function createProductionRuleHostGate(options = {}) {
                             // evaluator replay; merely wiring history must not revive old
                             // activations. Live execution additionally needs the existing
                             // promotion decision's binding to this exact artifact snapshot.
-                            if (options.hostKind === 'codex') {
+                            // SPEC-RULECODE-HOST-PROMOTION-001 §11.3: the SAME qualification
+                            // gates every host with a V2 context path — WorkBuddy must not
+                            // auto-execute historical V2 artifacts stamped for another host
+                            // (the hostKinds binding below rejects them by the exact same
+                            // includes() check Codex uses).
+                            if (options.hostKind === 'codex' || options.hostKind === 'workbuddy') {
                                 const contract = content.ruleHostInputContract;
                                 const hosts = isRecord(contract) ? contract.hostKinds : undefined;
                                 let contentBindingVerified = digestCheck.outcome === 'verified';
                                 if (activationMode === 'shadow' && row.owner_approved === 1) {
                                     // Old databases remain readable without writing a migration
                                     // from this enforcement reader. A legacy approval without a
-                                    // content digest cannot grant Codex V2 execution eligibility.
+                                    // content digest cannot grant V2 execution eligibility.
                                     const approvalColumns = connection.getDb().prepare('PRAGMA table_info(approvals)').all();
                                     if (approvalColumns.some((column) => isRecord(column) && column.name === 'artifact_digest')) {
                                         const approval = connection.getDb().prepare(`
                       SELECT artifact_digest FROM approvals
                       WHERE artifact_id = ? AND channel = 'code_tool_hook' AND status = 'approved'
                       ORDER BY decided_at DESC LIMIT 1
-                    `).get(artifactId);
+                      `).get(artifactId);
                                         const approvalDigest = isRecord(approval) && typeof approval.artifact_digest === 'string'
                                             ? approval.artifact_digest : null;
                                         contentBindingVerified = verifyPiArtifactRowDigest(contentRow, contentJson, approvalDigest).outcome === 'verified';
@@ -375,9 +380,9 @@ export function createProductionRuleHostGate(options = {}) {
                                 }
                                 if (!isRecord(contract) || contract.version !== 1 || contract.contextVersion !== 2
                                     || !Array.isArray(hosts) || !hosts.every((host) => typeof host === 'string')
-                                    || !hosts.includes('codex') || row.owner_approved !== 1
+                                    || !hosts.includes(options.hostKind) || row.owner_approved !== 1
                                     || !contentBindingVerified) {
-                                    addWarning(warnings, `codex_rule_context_v2_unqualified: activation=${activationId}`, 'regenerate and replay this artifact for Codex, approve it for shadow observation, and use the existing Owner promotion flow for live execution');
+                                    addWarning(warnings, `${options.hostKind}_rule_context_v2_unqualified: activation=${activationId}`, `regenerate and replay this artifact for ${options.hostKind}, approve it for shadow observation, and use the existing Owner promotion flow for live execution`);
                                     continue;
                                 }
                             }
@@ -419,7 +424,18 @@ export function createProductionRuleHostGate(options = {}) {
                                     : context === UNAVAILABLE_RULE_CONTEXT
                                         ? (contextFault ?? 'provider_invalid')
                                         : 'history_unavailable';
-                                addWarning(warnings, `rule_context_v2_unavailable: ${fault} (activation=${activationId})`, 'enable and wire the host rule context provider, or regenerate the rule without context dependence');
+                                // SPEC-RULECODE-HOST-PROMOTION-001 R2: a schema-valid
+                                // unavailable context carries the provider's precise reason
+                                // (e.g. workbuddy_history_attribution_conflict) — surface it
+                                // in the warning instead of collapsing every legit
+                                // unavailability into one opaque class (rc-9).
+                                const preciseReason = context !== undefined
+                                    && context !== UNAVAILABLE_RULE_CONTEXT
+                                    && typeof context.history.unavailableReason === 'string'
+                                    && context.history.unavailableReason.length > 0
+                                    ? `:${context.history.unavailableReason}`
+                                    : '';
+                                addWarning(warnings, `rule_context_v2_unavailable: ${fault}${preciseReason} (activation=${activationId})`, 'enable and wire the host rule context provider, or regenerate the rule without context dependence');
                                 continue;
                             }
                             const inputContract = content.ruleHostInputContract;
@@ -547,6 +563,7 @@ export function createProductionRuleHostGate(options = {}) {
                                 ruleId: candidate.ruleId,
                                 activationId: candidate.implId,
                                 activationMode: 'shadow',
+                                ...(options.hostKind !== undefined ? { hostKind: options.hostKind } : {}),
                             });
                         }
                     }
@@ -604,6 +621,7 @@ export function createProductionRuleHostGate(options = {}) {
                     ...(result?.ruleId !== undefined ? { ruleId: result.ruleId } : {}),
                     ...(liveActivationId !== undefined ? { activationId: liveActivationId } : {}),
                     activationMode: 'live',
+                    ...(options.hostKind !== undefined ? { hostKind: options.hostKind } : {}),
                 },
                 ...shadowEvaluations,
             ];

package/host-runtime/dist/workbuddy-rule-context-provider.d.ts

@@ -0,0 +1,33 @@
+import { type ToolSemanticRegistry } from '@principles/core/runtime-v2';
+import type { RuleContextProvider } from './production-rulehost-gate.js';
+export interface WorkbuddyRuleContextProviderOptions {
+    /** The WorkBuddy governance workspace whose trajectory database is authoritative. */
+    workspaceDir: string;
+    /** The host project cwd the hook observed (payload cwd); history rows must have this exact stored scope. Absent on channels that carry none. */
+    projectDir?: string;
+    /** The existing `rulecode_context_v2` gate. */
+    enabled: boolean;
+    /** Timestamp captured immediately after decoding this hook event. */
+    cutoffAt: Date;
+    /** Host-authoritative current WorkBuddy call_id, excluded even on timestamp ties. */
+    currentToolCallId: string;
+    toolSemantics: ToolSemanticRegistry;
+}
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 C: the WorkBuddy RuleContext provider.
+ *
+ * It reads the SAME canonical trajectory store the shared afterToolCall
+ * production path writes for WorkBuddy (`tool_calls` rows carrying the
+ * host's natural session/call ids and the observed project cwd) — genuinely
+ * observable WorkBuddy data, never borrowed Codex history. WorkBuddy has no
+ * design-gate declaration entry point (the Codex-native attestation source
+ * is Codex-only), so this provider deliberately supplies NO designGate
+ * fact: a rule whose required facts include design_approval stays suspended
+ * on this host with the precise `rule_required_fact_unavailable` warning
+ * instead of inheriting another host's attestation.
+ *
+ * Disabled, unscoped or unverifiable sources return explicit unavailable
+ * contexts — v2 rules then suspend through the existing shared-gate
+ * contract, which is the honest state until the missing input exists.
+ */
+export declare function createWorkbuddyRuleContextProvider(options: WorkbuddyRuleContextProviderOptions): RuleContextProvider;

package/host-runtime/dist/workbuddy-rule-context-provider.js

@@ -0,0 +1,126 @@
+import path from 'node:path';
+import { computeBehaviorFacts, } from '@principles/core/runtime-v2';
+import { assembleBehaviorHistory } from './behavior-history.js';
+import { readWorkspaceRuleContextRowsBefore } from './workspace-behavior-evidence.js';
+const HISTORY_LIMIT = 100;
+const MAX_REASON_LENGTH = 240;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function unavailable(reason) {
+    const history = {
+        status: 'unavailable',
+        unavailableReason: reason.replace(/\s+/g, ' ').slice(0, MAX_REASON_LENGTH),
+        truncated: false,
+        calls: [],
+    };
+    return {
+        version: 2,
+        history,
+        facts: computeBehaviorFacts(history, null, null),
+    };
+}
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 C: the WorkBuddy RuleContext provider.
+ *
+ * It reads the SAME canonical trajectory store the shared afterToolCall
+ * production path writes for WorkBuddy (`tool_calls` rows carrying the
+ * host's natural session/call ids and the observed project cwd) — genuinely
+ * observable WorkBuddy data, never borrowed Codex history. WorkBuddy has no
+ * design-gate declaration entry point (the Codex-native attestation source
+ * is Codex-only), so this provider deliberately supplies NO designGate
+ * fact: a rule whose required facts include design_approval stays suspended
+ * on this host with the precise `rule_required_fact_unavailable` warning
+ * instead of inheriting another host's attestation.
+ *
+ * Disabled, unscoped or unverifiable sources return explicit unavailable
+ * contexts — v2 rules then suspend through the existing shared-gate
+ * contract, which is the honest state until the missing input exists.
+ */
+export function createWorkbuddyRuleContextProvider(options) {
+    const workspaceDir = path.resolve(options.workspaceDir);
+    const projectDir = options.projectDir !== undefined ? path.resolve(options.projectDir) : undefined;
+    return (request) => {
+        if (typeof request.sessionId !== 'string' || request.sessionId.trim().length === 0) {
+            return unavailable('session_id_invalid');
+        }
+        if (!options.enabled)
+            return unavailable('workbuddy_rule_context_disabled');
+        if (path.resolve(request.workspaceDir) !== workspaceDir)
+            return unavailable('workspace_scope_mismatch');
+        if (projectDir === undefined || !path.isAbsolute(projectDir)) {
+            return unavailable('workbuddy_project_scope_unavailable');
+        }
+        const raw = request.rawPayload;
+        const toolInput = isRecord(raw) && isRecord(raw.toolInput) ? raw.toolInput : null;
+        if (toolInput === null
+            || toolInput.toolName !== request.toolName
+            || !isRecord(toolInput.params)
+            || options.currentToolCallId.trim().length === 0) {
+            return unavailable('workbuddy_pre_tool_scope_mismatch');
+        }
+        const cutoff = options.cutoffAt;
+        if (!(cutoff instanceof Date) || !Number.isFinite(cutoff.getTime()))
+            return unavailable('history_cutoff_invalid');
+        try {
+            const historyRows = readWorkspaceRuleContextRowsBefore(workspaceDir, {
+                sessionId: request.sessionId,
+                projectDir,
+                beforeCreatedAt: cutoff.toISOString(),
+                excludeToolUseId: options.currentToolCallId,
+                limit: HISTORY_LIMIT,
+                // Review R2: consume ONLY rows PROVEN to be WorkBuddy's (stamped by
+                // this host's own writer). "Same workspace + same session id +
+                // same project" is NOT proof — a Codex session id colliding here
+                // must never lend its reads to a WorkBuddy read-before-write rule.
+                hostKind: 'workbuddy',
+            });
+            if (historyRows.unscopedPriorRows)
+                return unavailable('trajectory_project_scope_incomplete');
+            if ((historyRows.otherHostRows ?? 0) > 0) {
+                return unavailable('workbuddy_history_attribution_conflict');
+            }
+            if (historyRows.rows.length === 0) {
+                // Fail closed with the precise reason: legacy rows exist but cannot
+                // be PROVEN WorkBuddy's (never back-filled, never assumed).
+                if ((historyRows.unattributedRows ?? 0) > 0)
+                    return unavailable('workbuddy_history_attribution_unprovable');
+                return unavailable('no_prior_session_history');
+            }
+            if ((historyRows.unattributedRows ?? 0) > 0) {
+                // Mixed window: consuming only the proven subset could UNDERCOUNT
+                // prior reads (a hidden foreign read would flip priorReadOfTarget),
+                // so the window is unprovable as a whole — suspend precisely.
+                return unavailable('workbuddy_history_attribution_unprovable');
+            }
+            const history = assembleBehaviorHistory(historyRows.rows, historyRows.truncated, {
+                projectDir,
+                toolSemantics: options.toolSemantics,
+            });
+            // WorkBuddy exposes its shell as the Bash tool, and MCP-style tools may
+            // resolve to 'other' absent from this host's semantic registry. Either
+            // may read or mutate files, so target-read absence and exact action
+            // counts cannot be asserted from this partial semantic view (same
+            // conservative rule as the Codex provider).
+            const factsIncomplete = history.truncated || history.calls.some((call) => call.canonicalKind === 'execute' || call.canonicalKind === 'other');
+            const computedFacts = computeBehaviorFacts(history, factsIncomplete ? null : request.targetPath, null);
+            const facts = factsIncomplete
+                ? {
+                    priorReadOfTarget: 'unknown',
+                    readCount: null,
+                    writeCount: null,
+                    uniqueWritePathCount: null,
+                    sameActionBlockCount: null,
+                }
+                : computedFacts;
+            return {
+                version: 2,
+                history,
+                facts,
+            };
+        }
+        catch (error) {
+            return unavailable(`trajectory_history_unavailable:${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+}

package/host-runtime/dist/workspace-behavior-evidence.d.ts

@@ -7,18 +7,35 @@ export declare function createWorkspaceBehaviorEvidencePort(workspaceDir: string
  * database. The timestamp is the caller's pre-event cutoff; rows at or after
  * it are excluded so replayed/future calls cannot enter a live RuleContext.
  * This is read-only and never creates or migrates trajectory state.
+ *
+ * Review R2 (SPEC-RULECODE-HOST-PROMOTION-001): when `hostKind` is supplied,
+ * the reader partitions the window by PROVEN producer attribution
+ * (`tool_calls.host_kind`, stamped by each host's writer) instead of handing
+ * back every row: `rows` carries only rows stamped with that host,
+ * `otherHostRows` counts rows stamped with a different host (a cross-host
+ * session-id collision), and `unattributedRows` counts legacy rows with no
+ * stamp (written before the column existed — attribution is unprovable, not
+ * assumed). A database whose tool_calls predates the column entirely counts
+ * every row in the unattributed bucket. The caller decides the failure
+ * policy; this reader never guesses an attribution.
  */
+export interface WorkspaceRuleContextRowsResult {
+    rows: readonly RuleHostContextRow[];
+    truncated: boolean;
+    unscopedPriorRows: boolean;
+    /** Present only for attribution-aware reads: rows stamped with ANOTHER host (never zero-checked when hostKind is absent). */
+    otherHostRows?: number;
+    /** Present only for attribution-aware reads: legacy rows with no host stamp. */
+    unattributedRows?: number;
+}
 export declare function readWorkspaceRuleContextRowsBefore(workspaceDir: string, input: {
     sessionId: string;
     projectDir: string;
     beforeCreatedAt: string;
     excludeToolUseId: string;
     limit: number;
-}): {
-    rows: readonly RuleHostContextRow[];
-    truncated: boolean;
-    unscopedPriorRows: boolean;
-};
+    hostKind?: string;
+}): WorkspaceRuleContextRowsResult;
 /**
  * List only Codex sessions proven by normalized host evidence and a matching
  * project-scoped trajectory row. The trajectory schema has no host_kind on

package/host-runtime/dist/workspace-behavior-evidence.js

@@ -74,12 +74,6 @@ export function createWorkspaceBehaviorEvidencePort(workspaceDir, toolSemantics)
         },
     };
 }
-/**
- * Read one bounded, same-session history window from the canonical trajectory
- * database. The timestamp is the caller's pre-event cutoff; rows at or after
- * it are excluded so replayed/future calls cannot enter a live RuleContext.
- * This is read-only and never creates or migrates trajectory state.
- */
 export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
     const { sessionId, projectDir, beforeCreatedAt, excludeToolUseId, limit } = input;
     if (sessionId.trim().length === 0)
@@ -95,9 +89,21 @@ export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
     const db = new Database(path.join(workspaceDir, '.state', 'trajectory.db'), { readonly: true, fileMustExist: true });
     try {
         db.pragma('busy_timeout = 100');
+        const attributionAware = input.hostKind !== undefined;
+        // Select host_kind ONLY for attribution-aware reads on schemas that carry
+        // the column. A plain read (or a legacy schema without the column) keeps
+        // the historical column list — never a failing query.
+        const includeHostKind = attributionAware && (() => {
+            const columns = db.prepare('PRAGMA table_info(tool_calls)').all();
+            return Array.isArray(columns)
+                && columns.some((column) => record(column) && typeof column.name === 'string' && column.name === 'host_kind');
+        })();
         return db.transaction(() => {
-            const rows = db.prepare(`
-        SELECT id, tool_name, outcome, params_json
+            // Attribution-aware read: fetch one extra slot beyond the limit so the
+            // partition counts stay truthful about a truncated window's tail.
+            const selectColumns = includeHostKind ? 'id, tool_name, outcome, params_json, host_kind' : 'id, tool_name, outcome, params_json';
+            const fetched = db.prepare(`
+        SELECT ${selectColumns}
         FROM tool_calls
         WHERE session_id = ? AND project_dir = ? AND created_at < ? AND (tool_use_id IS NULL OR tool_use_id <> ?)
         ORDER BY created_at DESC, id DESC
@@ -108,12 +114,36 @@ export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
         WHERE session_id = ? AND project_dir IS NULL AND created_at < ?
           AND (tool_use_id IS NULL OR tool_use_id <> ?) LIMIT 1
       `).get(sessionId, beforeCreatedAt, excludeToolUseId);
-            if (!Array.isArray(rows))
+            if (!Array.isArray(fetched))
                 throw new Error('history_query_invalid');
+            if (!attributionAware) {
+                return {
+                    rows: fetched.slice(0, limit).reverse().map(contextRow),
+                    truncated: fetched.length > limit,
+                    unscopedPriorRows: unscoped !== undefined,
+                };
+            }
+            let otherHostRows = 0;
+            let unattributedRows = 0;
+            const matching = [];
+            for (const row of fetched) {
+                if (!record(row) || !Object.hasOwn(row, 'host_kind') || row.host_kind === null || row.host_kind === undefined) {
+                    // No stamp (or no column): unprovable — never guessed into the host.
+                    unattributedRows += 1;
+                    continue;
+                }
+                if (row.host_kind !== input.hostKind) {
+                    otherHostRows += 1;
+                    continue;
+                }
+                matching.push(row);
+            }
             return {
-                rows: rows.slice(0, limit).reverse().map(contextRow),
-                truncated: rows.length > limit,
+                rows: matching.slice(0, limit).reverse().map(contextRow),
+                truncated: fetched.length > limit,
                 unscopedPriorRows: unscoped !== undefined,
+                otherHostRows,
+                unattributedRows,
             };
         })();
     }

package/host-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.145.30",
+  "version": "1.145.33",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {
@@ -89,6 +89,6 @@
     "directory": "packages/create-principles-disciple"
   },
   "pd": {
-    "bundledPluginVersion": "2.2.5"
+    "bundledPluginVersion": "2.2.7"
   }
 }

package/pd-cli/dist/commands/recovery-reachability-probe.d.ts

@@ -0,0 +1,25 @@
+import type { RecoveryCapabilityEvidence } from '@principles/core/runtime-v2';
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 R3/R4: CLI-channel recovery reachability
+ * for the pd-cli readiness path. Thin wrapper — the real subprocess probes
+ * live in host-runtime (`probeCliRecoveryCapabilities`) so the Console
+ * readiness assembly reuses the SAME implementation. This wrapper only
+ * resolves the built pd CLI entry for the CURRENT environment and fails
+ * closed (all capabilities not-verified) when it cannot.
+ *
+ * Evidence semantics (R4/P1): the CLI subprocess channel can prove
+ * `pd_status` and `rulecode_deactivate` (real `--dry-run` validation path —
+ * no audit write, no mutation); the console-channel capabilities are
+ * reported NOT-VERIFIED with the precise reason — never fabricated as ok.
+ */
+export { DEACTIVATE_DRY_RUN_PROBE_ACTIVATION_ID } from '@principles/host-runtime';
+/**
+ * Probe the CLI-channel recovery capabilities against the target workspace.
+ * When `expectedActivationId` is supplied, pd_status additionally requires
+ * that activation to appear in the listing — proof the probe targeted the
+ * governed workspace, not merely some workspace.
+ */
+export declare function probeCliRecoveryReachability(workspaceDir: string, expectedActivationId?: string, options?: {
+    timeoutMs?: number;
+}): Promise<RecoveryCapabilityEvidence[]>;
+//# sourceMappingURL=recovery-reachability-probe.d.ts.map

package/pd-cli/dist/commands/recovery-reachability-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-reachability-probe.d.ts","sourceRoot":"","sources":["../../src/commands/recovery-reachability-probe.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,0BAA0B,CAAC;AAelF;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,YAAY,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAW/K"}

package/pd-cli/dist/commands/recovery-reachability-probe.js

@@ -0,0 +1,50 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { probeCliRecoveryCapabilities } from '@principles/host-runtime';
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 R3/R4: CLI-channel recovery reachability
+ * for the pd-cli readiness path. Thin wrapper — the real subprocess probes
+ * live in host-runtime (`probeCliRecoveryCapabilities`) so the Console
+ * readiness assembly reuses the SAME implementation. This wrapper only
+ * resolves the built pd CLI entry for the CURRENT environment and fails
+ * closed (all capabilities not-verified) when it cannot.
+ *
+ * Evidence semantics (R4/P1): the CLI subprocess channel can prove
+ * `pd_status` and `rulecode_deactivate` (real `--dry-run` validation path —
+ * no audit write, no mutation); the console-channel capabilities are
+ * reported NOT-VERIFIED with the precise reason — never fabricated as ok.
+ */
+export { DEACTIVATE_DRY_RUN_PROBE_ACTIVATION_ID } from '@principles/host-runtime';
+function resolveCliEntry() {
+    // Built layout: dist/commands/<this>.js with the entry at dist/index.js.
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        path.resolve(here, '..', 'index.js'),
+        path.resolve(process.cwd(), 'dist', 'index.js'),
+    ];
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+/**
+ * Probe the CLI-channel recovery capabilities against the target workspace.
+ * When `expectedActivationId` is supplied, pd_status additionally requires
+ * that activation to appear in the listing — proof the probe targeted the
+ * governed workspace, not merely some workspace.
+ */
+export async function probeCliRecoveryReachability(workspaceDir, expectedActivationId, options) {
+    const cliEntry = resolveCliEntry();
+    if (cliEntry === null) {
+        return [
+            { capabilityId: 'pd_status', channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd CLI entry not found (built entry missing in this environment)' },
+            { capabilityId: 'rulecode_deactivate', channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd CLI entry not found (built entry missing in this environment)' },
+            { capabilityId: 'rulecode_global_pause', channel: 'console', ok: false, workspaceMatched: false, detail: 'console-channel control: verifying the HTTP-only recovery entry requires the Owner Console process; a CLI subprocess cannot produce this evidence' },
+            { capabilityId: 'owner_review_access', channel: 'console', ok: false, workspaceMatched: false, detail: 'console-channel control: verifying the HTTP-only recovery entry requires the Owner Console process; a CLI subprocess cannot produce this evidence' },
+        ];
+    }
+    return probeCliRecoveryCapabilities({ cliEntry, workspaceDir, ...(expectedActivationId !== undefined ? { expectedActivationId } : {}), ...(options?.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}) });
+}
+//# sourceMappingURL=recovery-reachability-probe.js.map

package/pd-cli/dist/commands/recovery-reachability-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-reachability-probe.js","sourceRoot":"","sources":["../../src/commands/recovery-reachability-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAGxE;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,0BAA0B,CAAC;AAElF,SAAS,eAAe;IACtB,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC;KAChD,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,YAAoB,EAAE,oBAA6B,EAAE,OAAgC;IACtI,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE;YAC7J,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE;YACvK,EAAE,YAAY,EAAE,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,mJAAmJ,EAAE;YAC9P,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,mJAAmJ,EAAE;SAC7P,CAAC;IACJ,CAAC;IACD,OAAO,4BAA4B,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1N,CAAC"}

package/pd-cli/dist/commands/runtime-activation.d.ts

@@ -29,7 +29,7 @@ export interface CollectedRuleCodeEventEntries {
  */
 export declare function collectRuleCodeEventEntries(workspaceDir: string): CollectedRuleCodeEventEntries;
 /** Exported for PRI-577 regression tests and reuse by promote evidence assembly. */
-export declare function readShadowSummaryForActivation(workspaceDir: string, activationId: string): PromotionEvidenceSnapshot['shadowSummary'];
+export declare function readShadowSummaryForActivation(workspaceDir: string, activationId: string, targetHostKind?: string): PromotionEvidenceSnapshot['shadowSummary'];
 interface ActivationDispatchOptions {
     workspace?: string;
     artifactId?: string;
@@ -44,6 +44,15 @@ interface ActivationDeactivateOptions {
     activationId?: string;
     reasonCode?: string;
     json?: boolean;
+    /**
+     * SPEC-RULECODE-HOST-PROMOTION-001 R4/P1: non-destructive validation path
+     * for the recovery reachability probe. Runs the REAL entry through real
+     * parsing, workspace binding, and target-resolution preconditions, then
+     * returns BEFORE the governance audit write and BEFORE any store mutation.
+     * Mutually exclusive with an actual deactivation by construction: the
+     * dry-run branch never reaches the deactivate call.
+     */
+    dryRun?: boolean;
 }
 export interface DeactivateResult {
     ok: boolean;

package/pd-cli/dist/commands/runtime-activation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-activation.d.ts","sourceRoot":"","sources":["../../src/commands/runtime-activation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsEzC,OAAO,KAAK,EAA4C,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAuBvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAwC,CAAC;AAExG,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,6BAA6B,CA0B/F;AAED,oFAAoF;AACpF,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAIrI;AAED,UAAU,yBAAyB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA2FD,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8IpG;AAID,UAAU,2BAA2B;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,iCAAiC,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoGxG;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+KlG;AAID,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,mBAAmB,CAAC;IACvD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,yBAAyB,GAC/B,0BAA0B,CAwB5B;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoO5F;AAID,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6O5F;AAUD,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mGAAmG;IACnG,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,WAAW,CAAC;IAChD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAYD,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4X3F;AAOD,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CA8BhF;AAMD,wBAAgB,0CAA0C,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAgBnF;AAED,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAgB7E;AAED,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAoBjF;AAED,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAwBhF"}
+{"version":3,"file":"runtime-activation.d.ts","sourceRoot":"","sources":["../../src/commands/runtime-activation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsEzC,OAAO,KAAK,EAA4C,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAwBvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAwC,CAAC;AAExG,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,6BAA6B,CA0B/F;AAED,oFAAoF;AACpF,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAO9J;AAED,UAAU,yBAAyB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA2FD,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8IpG;AAID,UAAU,2BAA2B;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,iCAAiC,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgJxG;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsMlG;AAID,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,mBAAmB,CAAC;IACvD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,yBAAyB,GAC/B,0BAA0B,CAwB5B;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoO5F;AAID,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6O5F;AAUD,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mGAAmG;IACnG,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,WAAW,CAAC;IAChD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAYD,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4X3F;AAOD,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CA8BhF;AAMD,wBAAgB,0CAA0C,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAkBnF;AAED,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAgB7E;AAED,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAoBjF;AAED,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAwBhF"}