create-principles-disciple 1.145.32 → 1.145.33

package/host-runtime/dist/workspace-behavior-evidence.d.ts

@@ -7,18 +7,35 @@ export declare function createWorkspaceBehaviorEvidencePort(workspaceDir: string
  * database. The timestamp is the caller's pre-event cutoff; rows at or after
  * it are excluded so replayed/future calls cannot enter a live RuleContext.
  * This is read-only and never creates or migrates trajectory state.
+ *
+ * Review R2 (SPEC-RULECODE-HOST-PROMOTION-001): when `hostKind` is supplied,
+ * the reader partitions the window by PROVEN producer attribution
+ * (`tool_calls.host_kind`, stamped by each host's writer) instead of handing
+ * back every row: `rows` carries only rows stamped with that host,
+ * `otherHostRows` counts rows stamped with a different host (a cross-host
+ * session-id collision), and `unattributedRows` counts legacy rows with no
+ * stamp (written before the column existed — attribution is unprovable, not
+ * assumed). A database whose tool_calls predates the column entirely counts
+ * every row in the unattributed bucket. The caller decides the failure
+ * policy; this reader never guesses an attribution.
  */
+export interface WorkspaceRuleContextRowsResult {
+    rows: readonly RuleHostContextRow[];
+    truncated: boolean;
+    unscopedPriorRows: boolean;
+    /** Present only for attribution-aware reads: rows stamped with ANOTHER host (never zero-checked when hostKind is absent). */
+    otherHostRows?: number;
+    /** Present only for attribution-aware reads: legacy rows with no host stamp. */
+    unattributedRows?: number;
+}
 export declare function readWorkspaceRuleContextRowsBefore(workspaceDir: string, input: {
     sessionId: string;
     projectDir: string;
     beforeCreatedAt: string;
     excludeToolUseId: string;
     limit: number;
-}): {
-    rows: readonly RuleHostContextRow[];
-    truncated: boolean;
-    unscopedPriorRows: boolean;
-};
+    hostKind?: string;
+}): WorkspaceRuleContextRowsResult;
 /**
  * List only Codex sessions proven by normalized host evidence and a matching
  * project-scoped trajectory row. The trajectory schema has no host_kind on

package/host-runtime/dist/workspace-behavior-evidence.js

@@ -74,12 +74,6 @@ export function createWorkspaceBehaviorEvidencePort(workspaceDir, toolSemantics)
         },
     };
 }
-/**
- * Read one bounded, same-session history window from the canonical trajectory
- * database. The timestamp is the caller's pre-event cutoff; rows at or after
- * it are excluded so replayed/future calls cannot enter a live RuleContext.
- * This is read-only and never creates or migrates trajectory state.
- */
 export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
     const { sessionId, projectDir, beforeCreatedAt, excludeToolUseId, limit } = input;
     if (sessionId.trim().length === 0)
@@ -95,9 +89,21 @@ export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
     const db = new Database(path.join(workspaceDir, '.state', 'trajectory.db'), { readonly: true, fileMustExist: true });
     try {
         db.pragma('busy_timeout = 100');
+        const attributionAware = input.hostKind !== undefined;
+        // Select host_kind ONLY for attribution-aware reads on schemas that carry
+        // the column. A plain read (or a legacy schema without the column) keeps
+        // the historical column list — never a failing query.
+        const includeHostKind = attributionAware && (() => {
+            const columns = db.prepare('PRAGMA table_info(tool_calls)').all();
+            return Array.isArray(columns)
+                && columns.some((column) => record(column) && typeof column.name === 'string' && column.name === 'host_kind');
+        })();
         return db.transaction(() => {
-            const rows = db.prepare(`
-        SELECT id, tool_name, outcome, params_json
+            // Attribution-aware read: fetch one extra slot beyond the limit so the
+            // partition counts stay truthful about a truncated window's tail.
+            const selectColumns = includeHostKind ? 'id, tool_name, outcome, params_json, host_kind' : 'id, tool_name, outcome, params_json';
+            const fetched = db.prepare(`
+        SELECT ${selectColumns}
         FROM tool_calls
         WHERE session_id = ? AND project_dir = ? AND created_at < ? AND (tool_use_id IS NULL OR tool_use_id <> ?)
         ORDER BY created_at DESC, id DESC
@@ -108,12 +114,36 @@ export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
         WHERE session_id = ? AND project_dir IS NULL AND created_at < ?
           AND (tool_use_id IS NULL OR tool_use_id <> ?) LIMIT 1
       `).get(sessionId, beforeCreatedAt, excludeToolUseId);
-            if (!Array.isArray(rows))
+            if (!Array.isArray(fetched))
                 throw new Error('history_query_invalid');
+            if (!attributionAware) {
+                return {
+                    rows: fetched.slice(0, limit).reverse().map(contextRow),
+                    truncated: fetched.length > limit,
+                    unscopedPriorRows: unscoped !== undefined,
+                };
+            }
+            let otherHostRows = 0;
+            let unattributedRows = 0;
+            const matching = [];
+            for (const row of fetched) {
+                if (!record(row) || !Object.hasOwn(row, 'host_kind') || row.host_kind === null || row.host_kind === undefined) {
+                    // No stamp (or no column): unprovable — never guessed into the host.
+                    unattributedRows += 1;
+                    continue;
+                }
+                if (row.host_kind !== input.hostKind) {
+                    otherHostRows += 1;
+                    continue;
+                }
+                matching.push(row);
+            }
             return {
-                rows: rows.slice(0, limit).reverse().map(contextRow),
-                truncated: rows.length > limit,
+                rows: matching.slice(0, limit).reverse().map(contextRow),
+                truncated: fetched.length > limit,
                 unscopedPriorRows: unscoped !== undefined,
+                otherHostRows,
+                unattributedRows,
             };
         })();
     }

package/host-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.145.32",
+  "version": "1.145.33",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {
@@ -89,6 +89,6 @@
     "directory": "packages/create-principles-disciple"
   },
   "pd": {
-    "bundledPluginVersion": "2.2.6"
+    "bundledPluginVersion": "2.2.7"
   }
 }

package/pd-cli/dist/commands/recovery-reachability-probe.d.ts

@@ -0,0 +1,25 @@
+import type { RecoveryCapabilityEvidence } from '@principles/core/runtime-v2';
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 R3/R4: CLI-channel recovery reachability
+ * for the pd-cli readiness path. Thin wrapper — the real subprocess probes
+ * live in host-runtime (`probeCliRecoveryCapabilities`) so the Console
+ * readiness assembly reuses the SAME implementation. This wrapper only
+ * resolves the built pd CLI entry for the CURRENT environment and fails
+ * closed (all capabilities not-verified) when it cannot.
+ *
+ * Evidence semantics (R4/P1): the CLI subprocess channel can prove
+ * `pd_status` and `rulecode_deactivate` (real `--dry-run` validation path —
+ * no audit write, no mutation); the console-channel capabilities are
+ * reported NOT-VERIFIED with the precise reason — never fabricated as ok.
+ */
+export { DEACTIVATE_DRY_RUN_PROBE_ACTIVATION_ID } from '@principles/host-runtime';
+/**
+ * Probe the CLI-channel recovery capabilities against the target workspace.
+ * When `expectedActivationId` is supplied, pd_status additionally requires
+ * that activation to appear in the listing — proof the probe targeted the
+ * governed workspace, not merely some workspace.
+ */
+export declare function probeCliRecoveryReachability(workspaceDir: string, expectedActivationId?: string, options?: {
+    timeoutMs?: number;
+}): Promise<RecoveryCapabilityEvidence[]>;
+//# sourceMappingURL=recovery-reachability-probe.d.ts.map

package/pd-cli/dist/commands/recovery-reachability-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-reachability-probe.d.ts","sourceRoot":"","sources":["../../src/commands/recovery-reachability-probe.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,0BAA0B,CAAC;AAelF;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,YAAY,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAW/K"}

package/pd-cli/dist/commands/recovery-reachability-probe.js

@@ -0,0 +1,50 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { probeCliRecoveryCapabilities } from '@principles/host-runtime';
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 R3/R4: CLI-channel recovery reachability
+ * for the pd-cli readiness path. Thin wrapper — the real subprocess probes
+ * live in host-runtime (`probeCliRecoveryCapabilities`) so the Console
+ * readiness assembly reuses the SAME implementation. This wrapper only
+ * resolves the built pd CLI entry for the CURRENT environment and fails
+ * closed (all capabilities not-verified) when it cannot.
+ *
+ * Evidence semantics (R4/P1): the CLI subprocess channel can prove
+ * `pd_status` and `rulecode_deactivate` (real `--dry-run` validation path —
+ * no audit write, no mutation); the console-channel capabilities are
+ * reported NOT-VERIFIED with the precise reason — never fabricated as ok.
+ */
+export { DEACTIVATE_DRY_RUN_PROBE_ACTIVATION_ID } from '@principles/host-runtime';
+function resolveCliEntry() {
+    // Built layout: dist/commands/<this>.js with the entry at dist/index.js.
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        path.resolve(here, '..', 'index.js'),
+        path.resolve(process.cwd(), 'dist', 'index.js'),
+    ];
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+/**
+ * Probe the CLI-channel recovery capabilities against the target workspace.
+ * When `expectedActivationId` is supplied, pd_status additionally requires
+ * that activation to appear in the listing — proof the probe targeted the
+ * governed workspace, not merely some workspace.
+ */
+export async function probeCliRecoveryReachability(workspaceDir, expectedActivationId, options) {
+    const cliEntry = resolveCliEntry();
+    if (cliEntry === null) {
+        return [
+            { capabilityId: 'pd_status', channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd CLI entry not found (built entry missing in this environment)' },
+            { capabilityId: 'rulecode_deactivate', channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd CLI entry not found (built entry missing in this environment)' },
+            { capabilityId: 'rulecode_global_pause', channel: 'console', ok: false, workspaceMatched: false, detail: 'console-channel control: verifying the HTTP-only recovery entry requires the Owner Console process; a CLI subprocess cannot produce this evidence' },
+            { capabilityId: 'owner_review_access', channel: 'console', ok: false, workspaceMatched: false, detail: 'console-channel control: verifying the HTTP-only recovery entry requires the Owner Console process; a CLI subprocess cannot produce this evidence' },
+        ];
+    }
+    return probeCliRecoveryCapabilities({ cliEntry, workspaceDir, ...(expectedActivationId !== undefined ? { expectedActivationId } : {}), ...(options?.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}) });
+}
+//# sourceMappingURL=recovery-reachability-probe.js.map

package/pd-cli/dist/commands/recovery-reachability-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-reachability-probe.js","sourceRoot":"","sources":["../../src/commands/recovery-reachability-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAGxE;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,0BAA0B,CAAC;AAElF,SAAS,eAAe;IACtB,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC;KAChD,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,YAAoB,EAAE,oBAA6B,EAAE,OAAgC;IACtI,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE;YAC7J,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE;YACvK,EAAE,YAAY,EAAE,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,mJAAmJ,EAAE;YAC9P,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,mJAAmJ,EAAE;SAC7P,CAAC;IACJ,CAAC;IACD,OAAO,4BAA4B,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1N,CAAC"}

package/pd-cli/dist/commands/runtime-activation.d.ts

@@ -29,7 +29,7 @@ export interface CollectedRuleCodeEventEntries {
  */
 export declare function collectRuleCodeEventEntries(workspaceDir: string): CollectedRuleCodeEventEntries;
 /** Exported for PRI-577 regression tests and reuse by promote evidence assembly. */
-export declare function readShadowSummaryForActivation(workspaceDir: string, activationId: string): PromotionEvidenceSnapshot['shadowSummary'];
+export declare function readShadowSummaryForActivation(workspaceDir: string, activationId: string, targetHostKind?: string): PromotionEvidenceSnapshot['shadowSummary'];
 interface ActivationDispatchOptions {
     workspace?: string;
     artifactId?: string;
@@ -44,6 +44,15 @@ interface ActivationDeactivateOptions {
     activationId?: string;
     reasonCode?: string;
     json?: boolean;
+    /**
+     * SPEC-RULECODE-HOST-PROMOTION-001 R4/P1: non-destructive validation path
+     * for the recovery reachability probe. Runs the REAL entry through real
+     * parsing, workspace binding, and target-resolution preconditions, then
+     * returns BEFORE the governance audit write and BEFORE any store mutation.
+     * Mutually exclusive with an actual deactivation by construction: the
+     * dry-run branch never reaches the deactivate call.
+     */
+    dryRun?: boolean;
 }
 export interface DeactivateResult {
     ok: boolean;

package/pd-cli/dist/commands/runtime-activation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-activation.d.ts","sourceRoot":"","sources":["../../src/commands/runtime-activation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsEzC,OAAO,KAAK,EAA4C,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAuBvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAwC,CAAC;AAExG,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,6BAA6B,CA0B/F;AAED,oFAAoF;AACpF,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAIrI;AAED,UAAU,yBAAyB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA2FD,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8IpG;AAID,UAAU,2BAA2B;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,iCAAiC,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoGxG;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+KlG;AAID,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,mBAAmB,CAAC;IACvD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,yBAAyB,GAC/B,0BAA0B,CAwB5B;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoO5F;AAID,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6O5F;AAUD,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mGAAmG;IACnG,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,WAAW,CAAC;IAChD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAYD,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4X3F;AAOD,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CA8BhF;AAMD,wBAAgB,0CAA0C,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAgBnF;AAED,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAgB7E;AAED,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAoBjF;AAED,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAwBhF"}
+{"version":3,"file":"runtime-activation.d.ts","sourceRoot":"","sources":["../../src/commands/runtime-activation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsEzC,OAAO,KAAK,EAA4C,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAwBvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAwC,CAAC;AAExG,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,6BAA6B,CA0B/F;AAED,oFAAoF;AACpF,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAO9J;AAED,UAAU,yBAAyB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA2FD,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8IpG;AAID,UAAU,2BAA2B;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,iCAAiC,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgJxG;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsMlG;AAID,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,mBAAmB,CAAC;IACvD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,yBAAyB,GAC/B,0BAA0B,CAwB5B;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoO5F;AAID,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6O5F;AAUD,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mGAAmG;IACnG,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,WAAW,CAAC;IAChD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAYD,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4X3F;AAOD,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CA8BhF;AAMD,wBAAgB,0CAA0C,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAkBnF;AAED,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAgB7E;AAED,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAoBjF;AAED,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAwBhF"}

package/pd-cli/dist/commands/runtime-activation.js

@@ -35,6 +35,7 @@ function buildLedgerIdentityDeps(workspaceDir, connection, getArtifactById) {
 }
 import { resolveOwnerIdentity, defaultOwnerIdentityHomeDir } from '@principles/core/runtime-v2';
 import { resolvePromotionHostLiveness } from '@principles/host-runtime';
+import { probeCliRecoveryReachability } from './recovery-reachability-probe.js';
 import { authorizeGovernanceAction, writeGovernanceAction } from 'principles-disciple/governance-audit';
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../services/pd-config-loader.js';
@@ -110,11 +111,14 @@ export function collectRuleCodeEventEntries(workspaceDir) {
     return { entries, sourceDirsFound };
 }
 /** Exported for PRI-577 regression tests and reuse by promote evidence assembly. */
-export function readShadowSummaryForActivation(workspaceDir, activationId) {
+export function readShadowSummaryForActivation(workspaceDir, activationId, targetHostKind) {
     const { entries, sourceDirsFound } = collectRuleCodeEventEntries(workspaceDir);
     if (sourceDirsFound === 0)
         return unavailableShadowSummary();
-    return summarizeRuleCodeShadowEvents(entries, activationId);
+    // SPEC-RULECODE-HOST-PROMOTION-001 B3: per-host attribution — with a
+    // resolved promotion host, only that host's samples count toward the
+    // threshold (legacy unattributed rows count toward none).
+    return summarizeRuleCodeShadowEvents(entries, activationId, targetHostKind);
 }
 function mapRolloutDecision(reviewDecision) {
     // P0-E (MVP_CORE_LOOP_CONTRACT INV-04): needs_revision 绝不映射 require_approval。
@@ -356,6 +360,55 @@ export async function handleRuntimeActivationDeactivate(opts) {
         return;
     }
     const workspaceDir = opts.workspace ? path.resolve(opts.workspace) : resolveWorkspaceDir();
+    // SPEC R4/P1: the dry-run branch initializes the workspace READ-ONLY and
+    // returns before the governance audit write and before any store mutation —
+    // a reachability probe must leave zero governance traces.
+    if (opts.dryRun === true) {
+        const stateManagerDryRun = new RuntimeStateManager({ workspaceDir, readonly: true });
+        let dryRunResult;
+        try {
+            await stateManagerDryRun.initialize();
+            const targetExists = stateManagerDryRun.connection.getDb()
+                .prepare('SELECT 1 FROM activations WHERE activation_id = ? LIMIT 1')
+                .get(opts.activationId) !== undefined;
+            dryRunResult = {
+                ok: true,
+                activationId: opts.activationId,
+                reason: 'dry_run_ok',
+                nextAction: targetExists
+                    ? 'Dry run only — nothing was deactivated. Re-run without --dry-run to deactivate.'
+                    : 'Dry run only — nothing was deactivated. The activation id does not exist in this workspace (expected for a reachability probe).',
+            };
+            if (opts.json) {
+                console.log(JSON.stringify({ ...dryRunResult, dryRun: true, workspaceDir, targetExists }, null, 2));
+            }
+            else {
+                console.log(`Dry run: validation ok — ${opts.activationId}`);
+                console.log(`  reason: ${dryRunResult.reason}`);
+                console.log(`  nextAction: ${dryRunResult.nextAction}`);
+            }
+        }
+        catch (err) {
+            dryRunResult = {
+                ok: false,
+                activationId: opts.activationId,
+                reason: `dry_run_failed: ${err instanceof Error ? err.message : String(err)}`,
+                nextAction: 'Check workspace directory and DB integrity. Try `pd runtime diagnostics`.',
+            };
+            if (opts.json)
+                console.log(JSON.stringify(dryRunResult, null, 2));
+            else {
+                console.error(`Error: ${dryRunResult.reason}`);
+                console.error(`Next action: ${dryRunResult.nextAction}`);
+            }
+        }
+        finally {
+            await stateManagerDryRun.close();
+        }
+        if (!dryRunResult.ok)
+            process.exitCode = 1;
+        return;
+    }
     const stateManager = new RuntimeStateManager({ workspaceDir });
     try {
         await stateManager.initialize();
@@ -542,7 +595,30 @@ export async function handleRuntimeActivationPromote(opts) {
                                 && actor.authentication.method === 'cli_owner_credential',
                             safetyControlsEnabled: isFeatureEnabled(flags, 'rulecode_safety_controls'),
                             hostContract: promotionHost.ok ? promotionHost.hostContract : null,
+                            // SPEC-RULECODE-HOST-PROMOTION-001 B: bind the check to the
+                            // resolver's contract version — a wrong-host contract fails
+                            // runtime_compatibility instead of passing as-is.
+                            ...(promotionHost.ok ? { expectedHostContractVersion: promotionHost.hostRuntimeVersion } : {}),
                             existingLiveArtifacts: liveArtifacts,
+                            // Review R3/P1 + R4/P1: composition through the production
+                            // boundary + per-evaluation PER-CAPABILITY reachability. The
+                            // CLI process proves the two CLI-channel capabilities with real
+                            // subprocesses (status listing; deactivate --dry-run) and
+                            // reports the console-channel capabilities as explicitly NOT
+                            // verified — promoting through the CLI therefore fails
+                            // emergency_controls (fail closed) until the Owner Console
+                            // process supplies its own channel evidence.
+                            projectDir: workspaceDir,
+                            ...(workspaceToolSemantics ? { toolSemantics: workspaceToolSemantics } : {}),
+                            recoveryReachability: await (async () => {
+                                const capabilities = await probeCliRecoveryReachability(workspaceDir, activationId);
+                                return {
+                                    source: 'cli-status-probe',
+                                    ok: capabilities.every(capability => capability.ok),
+                                    workspaceMatched: capabilities.every(capability => capability.workspaceMatched),
+                                    capabilities,
+                                };
+                            })(),
                             validateProductionArtifact: value => writer.canActivate(value),
                         });
                     },
@@ -555,7 +631,7 @@ export async function handleRuntimeActivationPromote(opts) {
                             expectedArtifactDigest: request.expectedArtifactDigest,
                             ownerIdentity: actor,
                             hostRuntimeVersion: promotionHost.ok ? promotionHost.hostRuntimeVersion : promotionHost.reason,
-                            shadowSummary: readShadowSummaryForActivation(workspaceDir, activationId),
+                            shadowSummary: readShadowSummaryForActivation(workspaceDir, activationId, promotionHost.ok ? promotionHost.hostKind : undefined),
                         });
                     },
                     newEvaluationId: () => `readiness-${randomUUID()}`,
@@ -1536,9 +1612,11 @@ export function registerRuntimeActivationDeactivateCommand(parent) {
         .option('--reason-code <code>', 'Structured governance reason code (default: cli_deactivate_requested)')
         .option('-w, --workspace <path>', 'Workspace directory')
         .option('--json', 'Output raw JSON')
+        .option('--dry-run', 'Validate the deactivation entry without deactivating (recovery reachability probe; no audit write, no mutation)')
         .action(async (opts) => {
         await handleRuntimeActivationDeactivate({
             activationId: opts.activationId,
+            dryRun: opts.dryRun,
             workspace: opts.workspace,
             reasonCode: opts.reasonCode,
             json: opts.json,