create-principles-disciple 1.145.32 → 1.145.33

package/host-runtime/dist/host-liveness-contract.js

@@ -8,18 +8,98 @@ export const OPENCLAW_HOST_LIVENESS_CONTRACT = {
     supportsShadowEvidence: true,
     outOfBandControls: ['activation_deactivate', 'global_rulecode_pause', 'owner_review_console'],
     protectedCapabilities: [
-        { capabilityId: 'pd_status', hostToolAliases: ['bash', 'exec_command'] },
-        { capabilityId: 'rulecode_deactivate', hostToolAliases: ['bash', 'exec_command'] },
-        { capabilityId: 'rulecode_global_pause', hostToolAliases: ['bash', 'exec_command'] },
+        // Review R1: `exec` is the ONLY shell tool name that reaches the OpenClaw
+        // hook face (constants/tools.ts PRI-741: `bash`/`exec_command` are
+        // config-level aliases that normalize away). Aliases and probes must use
+        // the real dispatched name or the neutral-probe replay rejects them.
+        { capabilityId: 'pd_status', hostToolAliases: ['exec'] },
+        { capabilityId: 'rulecode_deactivate', hostToolAliases: ['exec'] },
+        // Review R1: the global pause has NO pd CLI command — its real surface is
+        // the authenticated Owner Console route. Declaring a shell alias here
+        // would claim a recovery entry that does not exist.
+        { capabilityId: 'rulecode_global_pause', hostToolAliases: ['rulecode_global_pause'] },
         { capabilityId: 'owner_review_access', hostToolAliases: ['owner_review_access'] },
     ],
     neutralProbes: [
-        { probeId: 'probe-pd-status', capabilityId: 'pd_status', toolName: 'bash', params: { command: 'pd status' }, expectedDecision: 'allow' },
-        { probeId: 'probe-rule-deactivate', capabilityId: 'rulecode_deactivate', toolName: 'bash', params: { command: 'pd activation deactivate --activation-id test' }, expectedDecision: 'allow' },
-        { probeId: 'probe-global-pause', capabilityId: 'rulecode_global_pause', toolName: 'bash', params: { command: 'pd activation emergency-pause' }, expectedDecision: 'allow' },
-        { probeId: 'probe-owner-review', capabilityId: 'owner_review_access', toolName: 'owner_review_access', params: {}, expectedDecision: 'allow' },
+        // Review R1: probe commands are the REAL registered pd commands
+        // (verified against the recovery-control registry; `pd status` and
+        // `pd activation emergency-pause` do not exist and were removed).
+        { probeId: 'probe-pd-status', capabilityId: 'pd_status', toolName: 'exec', params: { command: 'pd activation list --json' }, expectedDecision: 'allow' },
+        { probeId: 'probe-rule-deactivate', capabilityId: 'rulecode_deactivate', toolName: 'exec', params: { command: 'pd activation deactivate --activation-id recovery-probe' }, expectedDecision: 'allow' },
+        // Review R3/P1: console-channel capabilities (global pause, owner review)
+        // carry NO probe — their recovery path never passes through the RuleHost
+        // gate, so a rule replay would misrepresent their verification. Their
+        // entry surfaces live in the recovery-control registry and their
+        // target-environment reachability is supplied by the readiness caller.
     ],
 };
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 B1: the Codex capability contract. Every
+ * tool alias below is the REAL Codex tool surface with in-repo evidence
+ * (`Bash` + `apply_patch`, locked by the shipped hooks matcher — see
+ * codex-adapter tool-semantics.ts). The out-of-band controls are the
+ * host-neutral `pd` CLI and the Web Console: they act on the workspace
+ * state directly, never through the Codex hook process, so a broken rule
+ * cannot lock them. This contract declares the mapping ONLY; shadow-event
+ * attribution, neutral-probe composition and Owner decision authority are
+ * enforced by the shared readiness pipeline, not by this constant
+ * (SPEC §11.2 — a constant alone must never turn a check green).
+ */
+export const CODEX_HOST_LIVENESS_CONTRACT = {
+    version: 'codex-v2@1',
+    supportsShadowEvidence: true,
+    outOfBandControls: ['activation_deactivate', 'global_rulecode_pause', 'owner_review_console'],
+    protectedCapabilities: [
+        { capabilityId: 'pd_status', hostToolAliases: ['Bash'] },
+        { capabilityId: 'rulecode_deactivate', hostToolAliases: ['Bash'] },
+        { capabilityId: 'rulecode_global_pause', hostToolAliases: ['rulecode_global_pause'] },
+        { capabilityId: 'owner_review_access', hostToolAliases: ['owner_review_access'] },
+    ],
+    neutralProbes: [
+        { probeId: 'probe-pd-status', capabilityId: 'pd_status', toolName: 'Bash', params: { command: 'pd activation list --json' }, expectedDecision: 'allow' },
+        { probeId: 'probe-rule-deactivate', capabilityId: 'rulecode_deactivate', toolName: 'Bash', params: { command: 'pd activation deactivate --activation-id recovery-probe' }, expectedDecision: 'allow' },
+        // Review R3/P1: console-channel capabilities (global pause, owner review)
+        // carry NO probe — their recovery path never passes through the RuleHost
+        // gate, so a rule replay would misrepresent their verification. Their
+        // entry surfaces live in the recovery-control registry and their
+        // target-environment reachability is supplied by the readiness caller.
+    ],
+};
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 C: the WorkBuddy capability contract.
+ * Tool aliases use WorkBuddy's REAL capitalized vocabulary (Read/Write/Edit/
+ * Bash — frozen Phase 0 fixtures + official hooks reference; see
+ * workbuddy-adapter tool-semantics.ts). Out-of-band controls are the same
+ * host-neutral `pd` CLI / Web Console pair, invoked outside the WorkBuddy
+ * hook channel (the hook failing closed with exit 2 on PreToolUse cannot
+ * prevent an Owner terminal or browser from reaching the workspace).
+ */
+export const WORKBUDDY_HOST_LIVENESS_CONTRACT = {
+    version: 'workbuddy-v1@1',
+    supportsShadowEvidence: true,
+    outOfBandControls: ['activation_deactivate', 'global_rulecode_pause', 'owner_review_console'],
+    protectedCapabilities: [
+        { capabilityId: 'pd_status', hostToolAliases: ['Bash'] },
+        { capabilityId: 'rulecode_deactivate', hostToolAliases: ['Bash'] },
+        { capabilityId: 'rulecode_global_pause', hostToolAliases: ['rulecode_global_pause'] },
+        { capabilityId: 'owner_review_access', hostToolAliases: ['owner_review_access'] },
+    ],
+    neutralProbes: [
+        { probeId: 'probe-pd-status', capabilityId: 'pd_status', toolName: 'Bash', params: { command: 'pd activation list --json' }, expectedDecision: 'allow' },
+        { probeId: 'probe-rule-deactivate', capabilityId: 'rulecode_deactivate', toolName: 'Bash', params: { command: 'pd activation deactivate --activation-id recovery-probe' }, expectedDecision: 'allow' },
+        // Review R3/P1: console-channel capabilities (global pause, owner review)
+        // carry NO probe — their recovery path never passes through the RuleHost
+        // gate, so a rule replay would misrepresent their verification. Their
+        // entry surfaces live in the recovery-control registry and their
+        // target-environment reachability is supplied by the readiness caller.
+    ],
+};
+/** The per-host contracts the resolver may hand out — one authority per host kind. */
+const HOST_LIVENESS_CONTRACTS = {
+    openclaw: OPENCLAW_HOST_LIVENESS_CONTRACT,
+    codex: CODEX_HOST_LIVENESS_CONTRACT,
+    workbuddy: WORKBUDDY_HOST_LIVENESS_CONTRACT,
+};
 /**
  * Existing durable provenance (Owner review round-4): `trajectory.db`
  * `pain_events.host_kind` records which host actually produced governance
@@ -107,41 +187,41 @@ export function readWorkspaceHostKindFacts(workspaceDir) {
     return { ok: true, declaredKinds, evidenceKinds, effectiveKinds };
 }
 /**
- * PRI-813: resolve the promotion host-liveness contract from the workspace's
- * REAL host state instead of unconditionally inheriting the OpenClaw
- * contract (which made Codex workspaces report runtime_compatibility /
- * runtime_shadow_evidence as passed — a false capability claim; the promotion
- * then only ever failed on sample count, hiding the unsupported truth).
+ * SPEC-RULECODE-HOST-PROMOTION-001 §4 (A): resolve the promotion host-liveness
+ * contract from the workspace's REAL host state. The historical "anything
+ * that is not Codex inherits OpenClaw" fork is REPLACED by an explicit
+ * five-way routing over openclaw / codex / workbuddy / unknown / multi-host:
+ *
+ * - nothing declared, no evidence, or OpenClaw-only traces → OpenClaw
+ *   contract (the documented historical default; SPEC §4.2 keeps this
+ *   compatibility semantics ONLY for workspaces with no non-OpenClaw
+ *   declaration or evidence — it must not extend to workspaces where
+ *   WorkBuddy has appeared);
+ * - durable evidence for a known non-OpenClaw host whose declaration file is
+ *   missing/corrupted → host_declaration_missing_for_configured_host
+ *   (generalized from Codex-only to every known host — SPEC §4.3: never
+ *   silently fall back to OpenClaw when the governing host's declaration
+ *   cannot be read);
+ * - more than one effective host kind → multi_host_promotion_ambiguous
+ *   (never guess a target host; SPEC §4.4);
+ * - exactly one known non-OpenClaw host (declared) → that host's contract;
+ * - an unknown declared host kind → promotion_host_unsupported (fail closed;
+ *   the declaration proves tool mapping only, never promotion capability —
+ *   SPEC §4.5).
  *
  * Two durable provenance sources, cross-checked (Owner review round-4):
  * 1. host declarations — `.pd/host-tool-semantics/<hostKind>.json`;
  * 2. trajectory.db `pain_events.host_kind` — which hosts actually produced
- *    governance evidence here (survives declaration deletion).
- *
- * Resolution rules (fail closed outside the one host with an approved
- * capability authority, and fail closed whenever Codex evidence exists but
- * its declaration is missing — never silently fall back to OpenClaw):
- * - no declaration AND no Codex evidence → OpenClaw contract (the historical
- *   governance default; a workspace where only OpenClaw ever ran — or no
- *   host ran — is exactly the legacy state, and existing workspaces rely
- *   on it);
- * - only openclaw declared and no Codex evidence → OPENCLAW_HOST_LIVENESS_CONTRACT;
- * - codex declared (alone) → promotion_host_unsupported (Codex promotion
- *   stays explicitly unsupported until an evidence-backed capability
- *   authority decision exists — no second host contract here);
- * - multiple hosts declared → multi_host_promotion_ambiguous (never guess a
- *   target host; the Owner decides host-selection policy separately);
- * - Codex evidence present but codex.json missing (deleted/corrupted —
- *   alone or alongside openclaw.json) → host_declaration_missing_for_configured_host
- *   (re-persist the declaration before promoting);
- * - declarations or provenance unreadable → fail closed with the reason.
+ *    governance evidence here (survives declaration deletion). Unknown-host
+ *    evidence rows are filtered by the facts reader (known-host filter) and
+ *    can never reach this resolver (SPEC §11.4).
  *
- * This function intentionally creates no Codex contract, no capability
- * registry, and no new store — it only routes the existing single authority
- * truthfully over state that already exists.
+ * This function creates no capability registry and no new store — it routes
+ * the existing per-host contract authorities truthfully over state that
+ * already exists.
  */
 export function resolvePromotionHostLiveness(workspaceDir) {
-    // Same two provenance sources and failure semantics as before, now via the
+    // Same two provenance sources and failure semantics as before, via the
     // shared facts reader (readWorkspaceHostKindFacts) so prompt-injection
     // route resolution and promotion liveness cannot drift apart.
     const facts = readWorkspaceHostKindFacts(workspaceDir);
@@ -152,9 +232,11 @@ export function resolvePromotionHostLiveness(workspaceDir) {
     }
     const { declaredKinds } = facts;
     const { effectiveKinds } = facts;
-    // The promotion host can only be the OpenClaw contract when nothing on the
-    // workspace — neither a declaration nor behavioral evidence — says Codex.
-    if (!effectiveKinds.includes('codex')) {
+    const nonOpenClawKinds = effectiveKinds.filter((kind) => kind !== 'openclaw');
+    // Historical compatibility default (SPEC §4.2): a workspace where nothing
+    // non-OpenClaw ever declared itself or produced evidence is exactly the
+    // legacy state, and existing workspaces rely on the OpenClaw contract.
+    if (nonOpenClawKinds.length === 0) {
         return {
             ok: true,
             hostKind: 'openclaw',
@@ -163,14 +245,29 @@ export function resolvePromotionHostLiveness(workspaceDir) {
             hostRuntimeVersion: OPENCLAW_HOST_LIVENESS_CONTRACT.version,
         };
     }
-    if (!declaredKinds.includes('codex')) {
-        // Codex evidence exists (declaration gone, or only openclaw.json
-        // remains) — the exact state where a silent OpenClaw fallback would
-        // resurrect the false capability PASS (Owner review round-4).
-        return promotionHostFailure('host_declaration_missing_for_configured_host', effectiveKinds, 'Codex evidence exists in this workspace but .pd/host-tool-semantics/codex.json is missing; re-run the Codex worker so it re-persists its declaration (or deactivate the Codex activation) before promoting');
+    // SPEC §4.3: durable evidence for a known non-OpenClaw host whose own
+    // declaration is gone (deleted/corrupted — alone or alongside openclaw.json)
+    // must fail closed with the precise reason; a silent OpenClaw fallback here
+    // would resurrect a false capability PASS (Owner review round-4, now
+    // generalized beyond Codex — a WorkBuddy-only workspace is the exact same
+    // misattribution class, SPEC §1.1 item 6).
+    const missingDeclarationKinds = facts.evidenceKinds.filter((kind) => kind !== 'openclaw' && !declaredKinds.includes(kind));
+    if (missingDeclarationKinds.length > 0) {
+        return promotionHostFailure('host_declaration_missing_for_configured_host', effectiveKinds, `durable evidence for host(s) ${missingDeclarationKinds.join(', ')} exists in this workspace but the matching .pd/host-tool-semantics/<hostKind>.json declaration is missing; re-run that host so it re-persists its declaration (or deactivate the activation) before promoting`);
+    }
+    if (effectiveKinds.length > 1) {
+        return promotionHostFailure('multi_host_promotion_ambiguous', effectiveKinds, `the workspace declares multiple hosts (${effectiveKinds.join(', ')}); promotion requires an unambiguous governing host — decide the promotion target host first`);
     }
-    if (declaredKinds.length > 1) {
-        return promotionHostFailure('multi_host_promotion_ambiguous', effectiveKinds, `the workspace declares multiple hosts (${declaredKinds.join(', ')}); promotion requires an unambiguous governing host — decide the promotion target host first`);
+    const [governingKind] = nonOpenClawKinds;
+    if (governingKind !== 'codex' && governingKind !== 'workbuddy') {
+        return promotionHostFailure('promotion_host_unsupported', effectiveKinds, `host '${governingKind}' has no approved promotion capability authority; promotion on this host is explicitly unsupported until an evidence-backed capability decision exists`);
     }
-    return promotionHostFailure('promotion_host_unsupported', effectiveKinds, `host '${declaredKinds[0]}' has no approved promotion capability authority; promotion on this host is explicitly unsupported until an evidence-backed capability decision exists`);
+    const contract = HOST_LIVENESS_CONTRACTS[governingKind];
+    return {
+        ok: true,
+        hostKind: governingKind,
+        hostKinds: declaredKinds,
+        hostContract: contract,
+        hostRuntimeVersion: contract.version,
+    };
 }

package/host-runtime/dist/index.d.ts

@@ -87,6 +87,8 @@ export declare function createProductionHostRuntime(options?: Partial<Pick<HostR
 export * from './behavior-example-pack-assembler.js';
 export * from './behavior-history.js';
 export * from './codex-rule-context-provider.js';
+export * from './cli-recovery-probe.js';
+export * from './workbuddy-rule-context-provider.js';
 export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
 export * from './explicit-owner-statement-prefix.js';
 export { listObservedDesignGateSessions } from './workspace-behavior-evidence.js';

package/host-runtime/dist/index.js

@@ -317,6 +317,8 @@ export function createProductionHostRuntime(options = {}) {
 export * from './behavior-example-pack-assembler.js';
 export * from './behavior-history.js';
 export * from './codex-rule-context-provider.js';
+export * from './cli-recovery-probe.js';
+export * from './workbuddy-rule-context-provider.js';
 export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
 export * from './explicit-owner-statement-prefix.js';
 export { listObservedDesignGateSessions } from './workspace-behavior-evidence.js';

package/host-runtime/dist/production-pain-evidence.d.ts

@@ -133,6 +133,8 @@ export declare function recordVerifiedToolOutcomes(args: {
     sessionId: string;
     outcomes: readonly VerifiedToolOutcomeInput[];
     painDatabaseFactory?: PainDatabaseFactory;
+    /** SPEC R2: producer host attribution stamped onto inserted rows (upgraded rows keep their original stamp). */
+    hostKind?: string;
 }): VerifiedToolOutcomeStatus[];
 /**
  * PRI-640: host attribution is supplied by the host adapter that constructs

package/host-runtime/dist/production-pain-evidence.js

@@ -314,6 +314,22 @@ function ensureToolCallsProjectDirColumn(db) {
         // the prepared-statement readiness check below fails loud if absent.
     }
 }
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 R2: additive migration for producer host
+ * attribution. Legacy rows stay NULL — the WorkBuddy rule-context reader
+ * treats a NULL stamp as unprovable (never guessed), so no backfill exists.
+ */
+function ensureToolCallsHostKindColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(tool_calls)').all();
+    if (columns.some((row) => pragmaField(row, 'name') === 'host_kind'))
+        return;
+    try {
+        db.exec('ALTER TABLE tool_calls ADD COLUMN host_kind TEXT');
+    }
+    catch {
+        // Same concurrent-writer contract as the sibling migrations above.
+    }
+}
 /**
  * SPEC-CODEX-PAIN-CLOSURE-001 CR-01: upgrade the live-hook observation of a
  * tool call with the host-verified final result (exit code) read through the
@@ -342,9 +358,18 @@ export function recordVerifiedToolOutcomes(args) {
         if (!hasToolCalls)
             applyTrajectorySchemaBase(db);
         ensureToolCallsToolUseIdColumn(db);
-        const findByToolUseId = db.prepare('SELECT id, outcome FROM tool_calls WHERE session_id = ? AND tool_use_id = ? ORDER BY id LIMIT 1');
+        ensureToolCallsHostKindColumn(db);
+        // Review R3/P2: a KNOWN host's call identity includes its attribution.
+        // The lookup matches ONLY rows of the same host — a colliding row from
+        // another host (or an unattributed legacy row) is a DIFFERENT record: the
+        // caller inserts its own row instead of swallowing or claiming it.
+        // Callers without a hostKind keep the historical match-any semantics
+        // (explicit compat contract, asserted by tests).
+        const findByToolUseId = args.hostKind !== undefined
+            ? db.prepare('SELECT id, outcome FROM tool_calls WHERE session_id = ? AND tool_use_id = ? AND host_kind = ? ORDER BY id LIMIT 1')
+            : db.prepare('SELECT id, outcome FROM tool_calls WHERE session_id = ? AND tool_use_id = ? ORDER BY id LIMIT 1');
         const upgradeUnknown = db.prepare("UPDATE tool_calls SET outcome = ?, exit_code = ?, result_preview = COALESCE(?, result_preview) WHERE id = ? AND outcome = 'unknown'");
-        const insertVerified = db.prepare('INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
+        const insertVerified = db.prepare('INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, host_kind) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
         const upsertSession = db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at');
         const createdAt = new Date().toISOString();
         db.transaction(() => {
@@ -352,7 +377,9 @@ export function recordVerifiedToolOutcomes(args) {
                 if (typeof input.exitCode !== 'number' || !Number.isInteger(input.exitCode))
                     continue;
                 const finalOutcome = input.exitCode === 0 ? 'success' : 'failure';
-                const existing = findByToolUseId.get(args.sessionId, input.toolUseId);
+                const existing = (args.hostKind !== undefined
+                    ? findByToolUseId.get(args.sessionId, input.toolUseId, args.hostKind)
+                    : findByToolUseId.get(args.sessionId, input.toolUseId));
                 const boundedPreview = typeof input.outputPreview === 'string' && input.outputPreview.length > 0
                     ? input.outputPreview.slice(0, MAX_PREVIEW)
                     : null;
@@ -368,7 +395,7 @@ export function recordVerifiedToolOutcomes(args) {
                 }
                 upsertSession.run(args.sessionId, createdAt, createdAt);
                 const sanitizedParams = sanitizeToolParams(input.params ?? {}, args.workspaceDir);
-                const info = insertVerified.run(args.sessionId, input.toolName, finalOutcome, null, input.exitCode, null, null, null, null, stable(sanitizedParams), boundedPreview, createdAt, input.toolUseId);
+                const info = insertVerified.run(args.sessionId, input.toolName, finalOutcome, null, input.exitCode, null, null, null, null, stable(sanitizedParams), boundedPreview, createdAt, input.toolUseId, args.hostKind ?? null);
                 results.push({ status: 'inserted', id: Number(info.lastInsertRowid) });
             }
         })();
@@ -426,6 +453,7 @@ export function createProductionPainEvidenceHandler(options = {}) {
             db.pragma('busy_timeout = 5000');
             ensureToolCallsToolUseIdColumn(db);
             ensureToolCallsProjectDirColumn(db);
+            ensureToolCallsHostKindColumn(db);
             if (!hasCanonicalSchema(db)) {
                 db.close();
                 db = undefined;
@@ -520,20 +548,30 @@ export function createProductionPainEvidenceHandler(options = {}) {
                 // CR-01: the host tool-call id is the stable join key for the
                 // consent-gated transcript upgrade (recordVerifiedToolOutcomes);
                 // content-shape probing stays the fallback for hosts without ids.
+                // Review R3/P2: for a known host the identity is host-scoped — a
+                // colliding row from ANOTHER host (or an unattributed legacy row) is
+                // NOT this delivery's duplicate, so both hosts keep independent
+                // records instead of the second being swallowed.
                 if (event.context.toolCallId !== undefined
-                    && db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ?').get(event.context.sessionId, event.context.toolCallId) !== undefined) {
+                    && (options.hostKind !== undefined
+                        ? db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ? AND host_kind = ?').get(event.context.sessionId, event.context.toolCallId, options.hostKind)
+                        : db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ?').get(event.context.sessionId, event.context.toolCallId)) !== undefined) {
                     duplicate = true;
                     duplicateAdmitted = db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) !== undefined;
                     return;
                 }
-                if (db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?').get(event.context.sessionId, toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview)) {
+                // Review R3/P2: the content-shape fallback dedup is host-scoped the
+                // same way — identical content from two hosts is two records.
+                if ((options.hostKind !== undefined
+                    ? db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ? AND host_kind = ?').get(event.context.sessionId, toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview, options.hostKind)
+                    : db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?').get(event.context.sessionId, toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview)) !== undefined) {
                     duplicate = true;
                     duplicateAdmitted = db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) !== undefined;
                     return;
                 }
                 db.prepare(`INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at`).run(event.context.sessionId, createdAt, createdAt);
-                db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(event.context.sessionId, toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, createdAt, event.context.toolCallId ?? null, path.resolve(options.projectDir ?? event.context.workspaceDir));
+                db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir, host_kind) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                    .run(event.context.sessionId, toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, createdAt, event.context.toolCallId ?? null, path.resolve(options.projectDir ?? event.context.workspaceDir), options.hostKind ?? null);
                 if (admitted) {
                     // Raw observation only (Pain Diagnosis Persistence SPEC §8): the
                     // pain row must record WHAT happened, not WHY. Attribution

package/host-runtime/dist/production-rulehost-gate.js

@@ -350,21 +350,26 @@ export function createProductionRuleHostGate(options = {}) {
                             // evaluator replay; merely wiring history must not revive old
                             // activations. Live execution additionally needs the existing
                             // promotion decision's binding to this exact artifact snapshot.
-                            if (options.hostKind === 'codex') {
+                            // SPEC-RULECODE-HOST-PROMOTION-001 §11.3: the SAME qualification
+                            // gates every host with a V2 context path — WorkBuddy must not
+                            // auto-execute historical V2 artifacts stamped for another host
+                            // (the hostKinds binding below rejects them by the exact same
+                            // includes() check Codex uses).
+                            if (options.hostKind === 'codex' || options.hostKind === 'workbuddy') {
                                 const contract = content.ruleHostInputContract;
                                 const hosts = isRecord(contract) ? contract.hostKinds : undefined;
                                 let contentBindingVerified = digestCheck.outcome === 'verified';
                                 if (activationMode === 'shadow' && row.owner_approved === 1) {
                                     // Old databases remain readable without writing a migration
                                     // from this enforcement reader. A legacy approval without a
-                                    // content digest cannot grant Codex V2 execution eligibility.
+                                    // content digest cannot grant V2 execution eligibility.
                                     const approvalColumns = connection.getDb().prepare('PRAGMA table_info(approvals)').all();
                                     if (approvalColumns.some((column) => isRecord(column) && column.name === 'artifact_digest')) {
                                         const approval = connection.getDb().prepare(`
                       SELECT artifact_digest FROM approvals
                       WHERE artifact_id = ? AND channel = 'code_tool_hook' AND status = 'approved'
                       ORDER BY decided_at DESC LIMIT 1
-                    `).get(artifactId);
+                      `).get(artifactId);
                                         const approvalDigest = isRecord(approval) && typeof approval.artifact_digest === 'string'
                                             ? approval.artifact_digest : null;
                                         contentBindingVerified = verifyPiArtifactRowDigest(contentRow, contentJson, approvalDigest).outcome === 'verified';
@@ -375,9 +380,9 @@ export function createProductionRuleHostGate(options = {}) {
                                 }
                                 if (!isRecord(contract) || contract.version !== 1 || contract.contextVersion !== 2
                                     || !Array.isArray(hosts) || !hosts.every((host) => typeof host === 'string')
-                                    || !hosts.includes('codex') || row.owner_approved !== 1
+                                    || !hosts.includes(options.hostKind) || row.owner_approved !== 1
                                     || !contentBindingVerified) {
-                                    addWarning(warnings, `codex_rule_context_v2_unqualified: activation=${activationId}`, 'regenerate and replay this artifact for Codex, approve it for shadow observation, and use the existing Owner promotion flow for live execution');
+                                    addWarning(warnings, `${options.hostKind}_rule_context_v2_unqualified: activation=${activationId}`, `regenerate and replay this artifact for ${options.hostKind}, approve it for shadow observation, and use the existing Owner promotion flow for live execution`);
                                     continue;
                                 }
                             }
@@ -419,7 +424,18 @@ export function createProductionRuleHostGate(options = {}) {
                                     : context === UNAVAILABLE_RULE_CONTEXT
                                         ? (contextFault ?? 'provider_invalid')
                                         : 'history_unavailable';
-                                addWarning(warnings, `rule_context_v2_unavailable: ${fault} (activation=${activationId})`, 'enable and wire the host rule context provider, or regenerate the rule without context dependence');
+                                // SPEC-RULECODE-HOST-PROMOTION-001 R2: a schema-valid
+                                // unavailable context carries the provider's precise reason
+                                // (e.g. workbuddy_history_attribution_conflict) — surface it
+                                // in the warning instead of collapsing every legit
+                                // unavailability into one opaque class (rc-9).
+                                const preciseReason = context !== undefined
+                                    && context !== UNAVAILABLE_RULE_CONTEXT
+                                    && typeof context.history.unavailableReason === 'string'
+                                    && context.history.unavailableReason.length > 0
+                                    ? `:${context.history.unavailableReason}`
+                                    : '';
+                                addWarning(warnings, `rule_context_v2_unavailable: ${fault}${preciseReason} (activation=${activationId})`, 'enable and wire the host rule context provider, or regenerate the rule without context dependence');
                                 continue;
                             }
                             const inputContract = content.ruleHostInputContract;
@@ -547,6 +563,7 @@ export function createProductionRuleHostGate(options = {}) {
                                 ruleId: candidate.ruleId,
                                 activationId: candidate.implId,
                                 activationMode: 'shadow',
+                                ...(options.hostKind !== undefined ? { hostKind: options.hostKind } : {}),
                             });
                         }
                     }
@@ -604,6 +621,7 @@ export function createProductionRuleHostGate(options = {}) {
                     ...(result?.ruleId !== undefined ? { ruleId: result.ruleId } : {}),
                     ...(liveActivationId !== undefined ? { activationId: liveActivationId } : {}),
                     activationMode: 'live',
+                    ...(options.hostKind !== undefined ? { hostKind: options.hostKind } : {}),
                 },
                 ...shadowEvaluations,
             ];

package/host-runtime/dist/workbuddy-rule-context-provider.d.ts

@@ -0,0 +1,33 @@
+import { type ToolSemanticRegistry } from '@principles/core/runtime-v2';
+import type { RuleContextProvider } from './production-rulehost-gate.js';
+export interface WorkbuddyRuleContextProviderOptions {
+    /** The WorkBuddy governance workspace whose trajectory database is authoritative. */
+    workspaceDir: string;
+    /** The host project cwd the hook observed (payload cwd); history rows must have this exact stored scope. Absent on channels that carry none. */
+    projectDir?: string;
+    /** The existing `rulecode_context_v2` gate. */
+    enabled: boolean;
+    /** Timestamp captured immediately after decoding this hook event. */
+    cutoffAt: Date;
+    /** Host-authoritative current WorkBuddy call_id, excluded even on timestamp ties. */
+    currentToolCallId: string;
+    toolSemantics: ToolSemanticRegistry;
+}
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 C: the WorkBuddy RuleContext provider.
+ *
+ * It reads the SAME canonical trajectory store the shared afterToolCall
+ * production path writes for WorkBuddy (`tool_calls` rows carrying the
+ * host's natural session/call ids and the observed project cwd) — genuinely
+ * observable WorkBuddy data, never borrowed Codex history. WorkBuddy has no
+ * design-gate declaration entry point (the Codex-native attestation source
+ * is Codex-only), so this provider deliberately supplies NO designGate
+ * fact: a rule whose required facts include design_approval stays suspended
+ * on this host with the precise `rule_required_fact_unavailable` warning
+ * instead of inheriting another host's attestation.
+ *
+ * Disabled, unscoped or unverifiable sources return explicit unavailable
+ * contexts — v2 rules then suspend through the existing shared-gate
+ * contract, which is the honest state until the missing input exists.
+ */
+export declare function createWorkbuddyRuleContextProvider(options: WorkbuddyRuleContextProviderOptions): RuleContextProvider;

package/host-runtime/dist/workbuddy-rule-context-provider.js

@@ -0,0 +1,126 @@
+import path from 'node:path';
+import { computeBehaviorFacts, } from '@principles/core/runtime-v2';
+import { assembleBehaviorHistory } from './behavior-history.js';
+import { readWorkspaceRuleContextRowsBefore } from './workspace-behavior-evidence.js';
+const HISTORY_LIMIT = 100;
+const MAX_REASON_LENGTH = 240;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function unavailable(reason) {
+    const history = {
+        status: 'unavailable',
+        unavailableReason: reason.replace(/\s+/g, ' ').slice(0, MAX_REASON_LENGTH),
+        truncated: false,
+        calls: [],
+    };
+    return {
+        version: 2,
+        history,
+        facts: computeBehaviorFacts(history, null, null),
+    };
+}
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 C: the WorkBuddy RuleContext provider.
+ *
+ * It reads the SAME canonical trajectory store the shared afterToolCall
+ * production path writes for WorkBuddy (`tool_calls` rows carrying the
+ * host's natural session/call ids and the observed project cwd) — genuinely
+ * observable WorkBuddy data, never borrowed Codex history. WorkBuddy has no
+ * design-gate declaration entry point (the Codex-native attestation source
+ * is Codex-only), so this provider deliberately supplies NO designGate
+ * fact: a rule whose required facts include design_approval stays suspended
+ * on this host with the precise `rule_required_fact_unavailable` warning
+ * instead of inheriting another host's attestation.
+ *
+ * Disabled, unscoped or unverifiable sources return explicit unavailable
+ * contexts — v2 rules then suspend through the existing shared-gate
+ * contract, which is the honest state until the missing input exists.
+ */
+export function createWorkbuddyRuleContextProvider(options) {
+    const workspaceDir = path.resolve(options.workspaceDir);
+    const projectDir = options.projectDir !== undefined ? path.resolve(options.projectDir) : undefined;
+    return (request) => {
+        if (typeof request.sessionId !== 'string' || request.sessionId.trim().length === 0) {
+            return unavailable('session_id_invalid');
+        }
+        if (!options.enabled)
+            return unavailable('workbuddy_rule_context_disabled');
+        if (path.resolve(request.workspaceDir) !== workspaceDir)
+            return unavailable('workspace_scope_mismatch');
+        if (projectDir === undefined || !path.isAbsolute(projectDir)) {
+            return unavailable('workbuddy_project_scope_unavailable');
+        }
+        const raw = request.rawPayload;
+        const toolInput = isRecord(raw) && isRecord(raw.toolInput) ? raw.toolInput : null;
+        if (toolInput === null
+            || toolInput.toolName !== request.toolName
+            || !isRecord(toolInput.params)
+            || options.currentToolCallId.trim().length === 0) {
+            return unavailable('workbuddy_pre_tool_scope_mismatch');
+        }
+        const cutoff = options.cutoffAt;
+        if (!(cutoff instanceof Date) || !Number.isFinite(cutoff.getTime()))
+            return unavailable('history_cutoff_invalid');
+        try {
+            const historyRows = readWorkspaceRuleContextRowsBefore(workspaceDir, {
+                sessionId: request.sessionId,
+                projectDir,
+                beforeCreatedAt: cutoff.toISOString(),
+                excludeToolUseId: options.currentToolCallId,
+                limit: HISTORY_LIMIT,
+                // Review R2: consume ONLY rows PROVEN to be WorkBuddy's (stamped by
+                // this host's own writer). "Same workspace + same session id +
+                // same project" is NOT proof — a Codex session id colliding here
+                // must never lend its reads to a WorkBuddy read-before-write rule.
+                hostKind: 'workbuddy',
+            });
+            if (historyRows.unscopedPriorRows)
+                return unavailable('trajectory_project_scope_incomplete');
+            if ((historyRows.otherHostRows ?? 0) > 0) {
+                return unavailable('workbuddy_history_attribution_conflict');
+            }
+            if (historyRows.rows.length === 0) {
+                // Fail closed with the precise reason: legacy rows exist but cannot
+                // be PROVEN WorkBuddy's (never back-filled, never assumed).
+                if ((historyRows.unattributedRows ?? 0) > 0)
+                    return unavailable('workbuddy_history_attribution_unprovable');
+                return unavailable('no_prior_session_history');
+            }
+            if ((historyRows.unattributedRows ?? 0) > 0) {
+                // Mixed window: consuming only the proven subset could UNDERCOUNT
+                // prior reads (a hidden foreign read would flip priorReadOfTarget),
+                // so the window is unprovable as a whole — suspend precisely.
+                return unavailable('workbuddy_history_attribution_unprovable');
+            }
+            const history = assembleBehaviorHistory(historyRows.rows, historyRows.truncated, {
+                projectDir,
+                toolSemantics: options.toolSemantics,
+            });
+            // WorkBuddy exposes its shell as the Bash tool, and MCP-style tools may
+            // resolve to 'other' absent from this host's semantic registry. Either
+            // may read or mutate files, so target-read absence and exact action
+            // counts cannot be asserted from this partial semantic view (same
+            // conservative rule as the Codex provider).
+            const factsIncomplete = history.truncated || history.calls.some((call) => call.canonicalKind === 'execute' || call.canonicalKind === 'other');
+            const computedFacts = computeBehaviorFacts(history, factsIncomplete ? null : request.targetPath, null);
+            const facts = factsIncomplete
+                ? {
+                    priorReadOfTarget: 'unknown',
+                    readCount: null,
+                    writeCount: null,
+                    uniqueWritePathCount: null,
+                    sameActionBlockCount: null,
+                }
+                : computedFacts;
+            return {
+                version: 2,
+                history,
+                facts,
+            };
+        }
+        catch (error) {
+            return unavailable(`trajectory_history_unavailable:${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+}