create-principles-disciple 1.145.32 → 1.145.34

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
   "productVersion": "2.4.0",
-  "sourceCommit": "e521227eda1422f6f53934b204d0fd384bf76cdd"
+  "sourceCommit": "ad6954c8d1ef4140ea7c9a03f3419ab742cb7c92"
 }

package/codex-adapter/dist/ingestion/ingestion.js

@@ -168,7 +168,9 @@ function ingestTranscriptDelta({ fallbackRootSessionId, canonicalPath, identity,
     // and the next Stop retries instead of silently losing the verified facts.
     const verifiedOutcomes = collectVerifiedToolOutcomes(decoded.observations);
     if (verifiedOutcomes.length > 0) {
-        const verified = recordVerifiedToolOutcomes({ workspaceDir, sessionId: rootSessionId, outcomes: verifiedOutcomes });
+        // SPEC-RULECODE-HOST-PROMOTION-001 R2: stamp the producing host on the
+        // inserted rows so attribution-aware readers can prove provenance.
+        const verified = recordVerifiedToolOutcomes({ workspaceDir, sessionId: rootSessionId, outcomes: verifiedOutcomes, hostKind: 'codex' });
         const failed = verified.find((result) => result.status === 'unavailable');
         if (failed !== undefined) {
             const reason = failed.reason === 'trajectory_db_not_found' ? 'verified_outcome_db_unavailable' : `verified_outcome_write_failed:${failed.reason.split(':', 2)[1] ?? ''}`;

package/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/codex-adapter",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Codex CLI host adapter for Principles Disciple — implements HostAdapter interface for OpenAI Codex CLI's stdin/stdout JSON hook model (ADR-0020).",
   "type": "module",
   "main": "./dist/index.js",

package/console/dist/server/models/ActivationsConsoleModel.d.ts

@@ -152,7 +152,12 @@ export declare class ActivationsConsoleModel {
     private readonly governanceAuditWriter;
     constructor(workspaceDir: string, governanceAuditWriter?: GovernanceAuditWriter);
     getActivations(targetHost?: PromptInjectionTargetHost): Promise<ActivationsResponse>;
-    getOwnerReview(activationId: string, ownerIdentityConfigured?: boolean, ownerActor?: OwnerPromotionActor): Promise<RuleCodeOwnerReview>;
+    getOwnerReview(activationId: string, ownerIdentityConfigured?: boolean, options?: {
+        ownerActor?: OwnerPromotionActor;
+        routeContext?: {
+            servedThroughAuthenticatedConsoleRoute: boolean;
+        };
+    }): Promise<RuleCodeOwnerReview>;
     continueObserving(activationId: string, input: OwnerMutationInput): Promise<{
         decisionId: string;
     }>;
@@ -173,7 +178,19 @@ export declare class ActivationsConsoleModel {
         artifactDigest: string;
         controlVersion: number;
         confirmed: boolean;
-    }, input: OwnerMutationInput): Promise<OwnerPromotionResult>;
+    }, input: OwnerMutationInput & {
+        routeContext?: {
+            servedThroughAuthenticatedConsoleRoute: boolean;
+        };
+    }): Promise<OwnerPromotionResult>;
+    /**
+     * SPEC R4/P1: non-destructive write-capability probe for the global-pause
+     * substrate. Inserts a probe pause row inside an explicit transaction,
+     * verifies it, ROLLS BACK, then asserts the table is unchanged (no probe
+     * row, same row count). Pure substrate evidence for THIS workspace — the
+     * browser-to-HTTP entry path is deliberately not claimed.
+     */
+    private probePauseSubstrate;
     private withMutableRuleCode;
     private requireOwnerDecisionFeature;
     deactivateActivation(activationId: string): Promise<{

package/console/dist/server/models/ActivationsConsoleModel.js

@@ -112,7 +112,8 @@ export function collectRuleCodeEventEntries(workspaceDir) {
     }
     return { entries, sourceDirsFound };
 }
-function readRuleCodeTelemetry(workspaceDir, activationId, decisions) {
+function readRuleCodeTelemetry(workspaceDir, activationId, options) {
+    const { decisions } = options;
     const countCircuitTrips = (minimumTime) => decisions.filter(decision => decision.decision === 'safety_isolate' && Date.parse(decision.decidedAt) >= minimumTime).length;
     const now = Date.now();
     const unavailableWindow = (minimumTime) => ({ eligible: null, matched: null, blocked: null, unhealthy: null, circuitTrips: countCircuitTrips(minimumTime), toolDistribution: null });
@@ -154,7 +155,11 @@ function readRuleCodeTelemetry(workspaceDir, activationId, decisions) {
         const filePath = typeof entry.data.filePath === 'string' ? entry.data.filePath : '';
         representativeSamples.push({ toolName: entry.data.toolName, decision: entry.data.decision, pathCategory: path.extname(filePath) || (filePath ? 'workspace_path' : 'no_path') });
     }
-    return { shadowSummary: summarizeRuleCodeShadowEvents(entries, activationId), metrics: { last24Hours: summarizeWindow(now - 24 * 60 * 60 * 1000), last7Days: summarizeWindow(now - 7 * 24 * 60 * 60 * 1000), representativeSamples } };
+    // SPEC-RULECODE-HOST-PROMOTION-001 B3: the promotion shadow summary counts
+    // only samples attributed to the workspace's resolved promotion host —
+    // another host's samples (and pre-attribution legacy rows) can never
+    // satisfy this host's readiness threshold.
+    return { shadowSummary: summarizeRuleCodeShadowEvents(entries, activationId, options.promotionHostKind), metrics: { last24Hours: summarizeWindow(now - 24 * 60 * 60 * 1000), last7Days: summarizeWindow(now - 7 * 24 * 60 * 60 * 1000), representativeSamples } };
 }
 export class ActivationsConsoleModel {
     workspaceDir;
@@ -439,7 +444,7 @@ export class ActivationsConsoleModel {
             catch { /* best-effort */ }
         }
     }
-    async getOwnerReview(activationId, ownerIdentityConfigured = false, ownerActor) {
+    async getOwnerReview(activationId, ownerIdentityConfigured = false, options) {
         const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: true });
         try {
             const activationStore = new SqliteActivationStateStore(conn);
@@ -457,7 +462,63 @@ export class ActivationsConsoleModel {
                 throw new Error(`Artifact not found for activation: ${activation.artifactId}`);
             const digest = `sha256:${createHash('sha256').update(JSON.stringify(artifact), 'utf8').digest('hex')}`;
             const decisions = await safetyStore.listDecisions(activationId);
-            const telemetry = readRuleCodeTelemetry(this.workspaceDir, activationId, decisions);
+            // PRI-813: the promotion host contract follows the workspace's REAL
+            // host declarations — a Codex (or multi-host) workspace no longer
+            // inherits the OpenClaw capability claim (fail closed, null contract).
+            // Resolved BEFORE telemetry so the shadow summary can attribute samples
+            // to the SAME host the readiness checks will run against
+            // (SPEC-RULECODE-HOST-PROMOTION-001 B3).
+            const promotionHost = resolvePromotionHostLiveness(this.workspaceDir);
+            // Review R4/P1: PER-CAPABILITY target-environment evidence, produced
+            // fresh for THIS evaluation (never cached). Each entry states exactly
+            // what it proved — no evidence is reused across capabilities:
+            // - pd_status / rulecode_deactivate: the REAL pd CLI subprocess probes
+            //   (shared host-runtime implementation; the status listing must
+            //   contain this activation; deactivate runs its real --dry-run
+            //   validation path — no audit write, no mutation);
+            // - rulecode_global_pause: the durable pause substrate of THIS
+            //   workspace is writable — a transaction-rollback probe inserts a
+            //   probe pause row, verifies it, rolls back, and asserts the table is
+            //   unchanged afterwards. Substrate evidence only; the browser-to-HTTP
+            //   entry path remains e2e/isolated-route-test evidence and is NOT
+            //   claimed here;
+            // - owner_review_access: THIS readiness evaluation is being served
+            //   through a real authenticated Console HTTP route (the owner-review
+            //   GET or the promote POST passed the signal down) — the entry exists,
+            //   dispatches, authenticates, and binds to this workspace, observed
+            //   right now.
+            const recoveryCapabilities = [];
+            try {
+                const { resolveCliRecoveryEntry, probeCliActivationStatus, probeCliDeactivateDryRun } = await import('@principles/host-runtime');
+                const cliEntry = resolveCliRecoveryEntry();
+                if (cliEntry === null) {
+                    recoveryCapabilities.push({ capabilityId: 'pd_status', channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd CLI entry not found in this environment' }, { capabilityId: 'rulecode_deactivate', channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd CLI entry not found in this environment' });
+                }
+                else {
+                    recoveryCapabilities.push(await probeCliActivationStatus({ cliEntry, workspaceDir: this.workspaceDir, expectedActivationId: activationId }), await probeCliDeactivateDryRun({ cliEntry, workspaceDir: this.workspaceDir }));
+                }
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                recoveryCapabilities.push({ capabilityId: 'pd_status', channel: 'cli', ok: false, workspaceMatched: false, detail: `cli probe failed: ${detail}` }, { capabilityId: 'rulecode_deactivate', channel: 'cli', ok: false, workspaceMatched: false, detail: `cli probe failed: ${detail}` });
+            }
+            recoveryCapabilities.push(this.probePauseSubstrate());
+            recoveryCapabilities.push({
+                capabilityId: 'owner_review_access',
+                channel: 'console',
+                ok: options?.routeContext?.servedThroughAuthenticatedConsoleRoute === true,
+                workspaceMatched: options?.routeContext?.servedThroughAuthenticatedConsoleRoute === true,
+                detail: options?.routeContext?.servedThroughAuthenticatedConsoleRoute === true
+                    ? undefined
+                    : 'this readiness evaluation was not served through an authenticated Console HTTP route (direct model call); the owner-review entry is therefore not evidenced',
+            });
+            const recoveryStoreProbe = {
+                source: 'console-route-served',
+                ok: recoveryCapabilities.every(capability => capability.ok),
+                workspaceMatched: recoveryCapabilities.every(capability => capability.workspaceMatched),
+                capabilities: recoveryCapabilities,
+            };
+            const telemetry = readRuleCodeTelemetry(this.workspaceDir, activationId, { decisions, promotionHostKind: promotionHost.ok ? promotionHost.hostKind : undefined });
             const flags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
             // PRI-634-F R3 (SPEC P1-1): promotion readiness evaluates through the
             // SAME workspace host-declaration resolver as CLI/Approvals — the bare
@@ -465,10 +526,6 @@ export class ActivationsConsoleModel {
             // provenance degrades to the legacy readiness behavior (read-model
             // probe, not a mutation), consistent with the CLI readiness writer.
             const toolSemantics = resolveWorkspaceHostToolSemantics(this.workspaceDir);
-            // PRI-813: the promotion host contract follows the workspace's REAL
-            // host declarations — a Codex (or multi-host) workspace no longer
-            // inherits the OpenClaw capability claim (fail closed, null contract).
-            const promotionHost = resolvePromotionHostLiveness(this.workspaceDir);
             const writer = new RuleHostWriter({
                 gateDeps: createProductionGateDeps({
                     projectDir: this.workspaceDir,
@@ -496,7 +553,23 @@ export class ActivationsConsoleModel {
                         ownerIdentityConfigured,
                         safetyControlsEnabled: isFeatureEnabled(flags, 'rulecode_safety_controls'),
                         hostContract: promotionHost.ok ? promotionHost.hostContract : null,
+                        // SPEC-RULECODE-HOST-PROMOTION-001 B: the contract version the
+                        // resolver handed out — a shape-valid contract of the WRONG host
+                        // version must fail runtime_compatibility, not pass as-is.
+                        ...(promotionHost.ok ? { expectedHostContractVersion: promotionHost.hostRuntimeVersion } : {}),
                         existingLiveArtifacts: liveArtifacts,
+                        // Review R3/P1: composition executes through the production
+                        // boundary and needs the same root the replay normalizes against.
+                        projectDir: this.workspaceDir,
+                        ...(toolSemantics.ok ? { toolSemantics: toolSemantics.registry } : {}),
+                        // Review R3/P1: console-side target-environment reachability —
+                        // prove the recovery controls' DURABLE SUBSTRATE is reachable
+                        // from this process by reading the same safety store the pause
+                        // handler writes (non-destructive). The authenticated owner
+                        // review route serving this very request is the entry evidence
+                        // for this surface; the Owner-browser → HTTP entry path is
+                        // e2e/isolated-test evidence, deliberately NOT claimed here.
+                        recoveryReachability: recoveryStoreProbe,
                         validateProductionArtifact: candidate => writer.canActivate(candidate),
                     });
                 },
@@ -509,7 +582,7 @@ export class ActivationsConsoleModel {
                         expectedArtifactDigest: digest,
                         // Bind the real authenticated actor; null (not a placeholder) when
                         // the review is read without an Owner session.
-                        ownerIdentity: ownerActor ?? null,
+                        ownerIdentity: options?.ownerActor ?? null,
                         hostRuntimeVersion: promotionHost.ok ? promotionHost.hostRuntimeVersion : promotionHost.reason,
                         shadowSummary: telemetry.shadowSummary,
                     });
@@ -640,7 +713,7 @@ export class ActivationsConsoleModel {
         }
     }
     async promoteRuleCode(activationId, expected, input) {
-        const review = await this.getOwnerReview(activationId, input.actor.principal.kind === 'configured_owner' && input.actor.authentication.method === 'console_token', input.actor);
+        const review = await this.getOwnerReview(activationId, input.actor.principal.kind === 'configured_owner' && input.actor.authentication.method === 'console_token', { ownerActor: input.actor, routeContext: input.routeContext });
         const flags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
         const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
         try {
@@ -673,6 +746,47 @@ export class ActivationsConsoleModel {
             catch { /* best effort */ }
         }
     }
+    /**
+     * SPEC R4/P1: non-destructive write-capability probe for the global-pause
+     * substrate. Inserts a probe pause row inside an explicit transaction,
+     * verifies it, ROLLS BACK, then asserts the table is unchanged (no probe
+     * row, same row count). Pure substrate evidence for THIS workspace — the
+     * browser-to-HTTP entry path is deliberately not claimed.
+     */
+    probePauseSubstrate() {
+        const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
+        try {
+            const db = conn.getDb();
+            const probeId = `recovery-probe-${randomUUID()}`;
+            const before = db.prepare('SELECT COUNT(*) AS n FROM global_rulecode_pauses').get();
+            db.exec('BEGIN IMMEDIATE');
+            try {
+                db.prepare("INSERT INTO global_rulecode_pauses (pause_id, status, incident_decision_id, release_decision_id, affected_activation_ids, paused_at, released_at, version) VALUES (?, 'paused', ?, NULL, '[]', ?, NULL, 1)")
+                    .run(probeId, `probe-${probeId}`, new Date().toISOString());
+                const inserted = db.prepare('SELECT pause_id FROM global_rulecode_pauses WHERE pause_id = ?').get(probeId);
+                if (inserted === undefined)
+                    throw new Error('probe pause row not visible inside the transaction');
+            }
+            finally {
+                db.exec('ROLLBACK');
+            }
+            const after = db.prepare('SELECT COUNT(*) AS n FROM global_rulecode_pauses').get();
+            const probeLeftover = db.prepare('SELECT pause_id FROM global_rulecode_pauses WHERE pause_id = ?').get(probeId);
+            if (probeLeftover !== undefined || before.n !== after.n) {
+                return { capabilityId: 'rulecode_global_pause', channel: 'console', ok: false, workspaceMatched: true, detail: 'rollback probe left state behind — substrate evidence rejected' };
+            }
+            return { capabilityId: 'rulecode_global_pause', channel: 'console', ok: true, workspaceMatched: true };
+        }
+        catch (error) {
+            return { capabilityId: 'rulecode_global_pause', channel: 'console', ok: false, workspaceMatched: true, detail: `pause substrate probe failed: ${error instanceof Error ? error.message : String(error)}` };
+        }
+        finally {
+            try {
+                conn.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
     async withMutableRuleCode(activationId, action) {
         const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
         try {

package/console/dist/server/models/OwnerDecisionConsoleModel.d.ts

@@ -35,7 +35,9 @@ export declare class OwnerDecisionConsoleModel {
      * 派生当前真实可执行的 Owner 决策列表（INV-01 / SPEC §27 badge 的唯一来源）。
      * N = items.length — 不是 candidate 数、不是 NHR 总数、不是 failed 数。
      */
-    listOwnerDecisionItems(): Promise<OwnerDecisionListResult>;
+    listOwnerDecisionItems(routeContext?: {
+        servedThroughAuthenticatedConsoleRoute: boolean;
+    }): Promise<OwnerDecisionListResult>;
     /**
      * failed-tasks 列表分流字段: 该 NHR 任务是否 decision-capable
      * (decision-capable → 前往治理焦点；technical → Recover)。

package/console/dist/server/models/OwnerDecisionConsoleModel.js

@@ -188,7 +188,7 @@ export class OwnerDecisionConsoleModel {
      * 派生当前真实可执行的 Owner 决策列表（INV-01 / SPEC §27 badge 的唯一来源）。
      * N = items.length — 不是 candidate 数、不是 NHR 总数、不是 failed 数。
      */
-    async listOwnerDecisionItems() {
+    async listOwnerDecisionItems(routeContext) {
         const stateDbPath = path.join(this.workspaceDir, '.pd', 'state.db');
         if (!fs.existsSync(stateDbPath)) {
             return { items: [], total: 0, generatedAt: new Date().toISOString() };
@@ -267,7 +267,11 @@ export class OwnerDecisionConsoleModel {
                     const artifactId = typeof row.artifact_id === 'string' ? row.artifact_id : '';
                     const activationId = typeof row.activation_id === 'string' ? row.activation_id : '';
                     try {
-                        const review = await activationModel.getOwnerReview(activationId, true);
+                        // SPEC R4/P1: this projection runs inside the real authenticated
+                        // owner-decisions GET route — the route signal evidences the
+                        // Console HTTP surface for the visibility evaluation; promotion
+                        // still re-evaluates at the real owner-review/promote entry.
+                        const review = await activationModel.getOwnerReview(activationId, true, { routeContext });
                         if (review.readiness.status !== 'ready' && review.readiness.status !== 'evidence_insufficient')
                             continue;
                     }

package/console/dist/server/routes/activations.js

@@ -167,7 +167,10 @@ export async function handleActivationsRoute(req, res, workspaceDir, subPath, au
             else {
                 if (!body.artifactId || !body.artifactDigest || body.controlVersion === undefined || body.confirmed !== true)
                     throw new Error('Promotion requires artifactId, artifactDigest, controlVersion, and confirmed=true');
-                const result = await model.promoteRuleCode(activationId, { artifactId: body.artifactId, artifactDigest: body.artifactDigest, controlVersion: body.controlVersion, confirmed: body.confirmed }, input);
+                // SPEC R4/P1: the authenticated promote POST is likewise a real
+                // Console HTTP entry — the readiness evaluation it triggers carries
+                // the route-served signal for owner_review_access.
+                const result = await model.promoteRuleCode(activationId, { artifactId: body.artifactId, artifactDigest: body.artifactDigest, controlVersion: body.controlVersion, confirmed: body.confirmed }, { ...input, routeContext: { servedThroughAuthenticatedConsoleRoute: true } });
                 if (!result.ok) {
                     sendError(res, 409, result.reasonCode, result.summary, { failedChecks: result.failedChecks, nextAction: result.nextAction });
                     return;
@@ -197,7 +200,9 @@ export async function handleActivationsRoute(req, res, workspaceDir, subPath, au
             return;
         }
         try {
-            sendSuccess(res, await getModel(workspaceDir).getOwnerReview(activationId, authority?.ownerActor !== null && authority?.ownerActor !== undefined, authority?.ownerActor ?? undefined));
+            // SPEC R4/P1: this real authenticated GET is the owner_review_access
+            // entry evidence — pass the route signal into the readiness assembly.
+            sendSuccess(res, await getModel(workspaceDir).getOwnerReview(activationId, authority?.ownerActor !== null && authority?.ownerActor !== undefined, { ownerActor: authority?.ownerActor ?? undefined, routeContext: { servedThroughAuthenticatedConsoleRoute: true } }));
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);

package/console/dist/server/routes/owner-decisions.js

@@ -163,7 +163,7 @@ export async function handleOwnerDecisionsRoute(req, res, ctx) {
             return;
         }
         try {
-            const result = await getModel(workspaceDir).listOwnerDecisionItems();
+            const result = await getModel(workspaceDir).listOwnerDecisionItems({ servedThroughAuthenticatedConsoleRoute: true });
             sendSuccess(res, result);
         }
         catch (err) {

package/core/dist/runtime-v2/activation/index.d.ts

@@ -19,6 +19,12 @@ export { evaluateRuleCodeSafetyCircuit, initialRuleCodeSafetyCircuitState } from
 export type { RuleCodeSafetySample, RuleCodeSafetyCircuitState, RuleCodeSafetyTripReason } from './rulecode-safety-circuit-breaker.js';
 export { collectOpenClawPromotionChecks } from './openclaw-promotion-checks.js';
 export type { HostLivenessContract } from './openclaw-promotion-checks.js';
+export type { RecoveryReachabilityEvidence, RecoveryCapabilityEvidence, RecoveryCapabilityCoverage } from './openclaw-promotion-checks.js';
+export { validateRecoveryCapabilityCoverage } from './openclaw-promotion-checks.js';
+export { RECOVERY_CONTROL_SURFACES, validateRecoveryControlSurfaces } from './recovery-control-surfaces.js';
+export type { RecoveryControlCapability, RecoveryControlSurface, RecoveryControlValidation } from './recovery-control-surfaces.js';
+export { verifyRecoveryProbeComposition } from './recovery-composition.js';
+export type { RecoveryCompositionArtifact, RecoveryCompositionInput, RecoveryCompositionProbe, RecoveryCompositionResult } from './recovery-composition.js';
 export { summarizeRuleCodeShadowEvents } from './rulecode-shadow-summary.js';
 export type { RuleCodeShadowSummary } from './rulecode-shadow-summary.js';
 export { buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity, verifyPiArtifactRowDigest } from './promotion-evidence-snapshot.js';

package/core/dist/runtime-v2/activation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,0BAA0B,EAC1B,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAC3H,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAExH,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC9K,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,YAAY,EACV,yBAAyB,EAAE,oBAAoB,EAAE,wBAAwB,EACzE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,oBAAoB,EACtF,gCAAgC,GACjC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AACtH,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,YAAY,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACxH,YAAY,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACvI,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC5J,YAAY,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEjJ,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAK1E,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAInG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAI1G,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,2BAA2B,EAC3B,QAAQ,IAAI,gBAAgB,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,aAAa,EACb,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAEhD,YAAY,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,6CAA6C,EAC7C,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,0BAA0B,EAC1B,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAC3H,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAExH,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC9K,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,YAAY,EACV,yBAAyB,EAAE,oBAAoB,EAAE,wBAAwB,EACzE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,oBAAoB,EACtF,gCAAgC,GACjC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AACtH,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,YAAY,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACxH,YAAY,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACvI,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,YAAY,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC3I,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAC5G,YAAY,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AACnI,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,YAAY,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC5J,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC5J,YAAY,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEjJ,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAK1E,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAInG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAI1G,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,2BAA2B,EAC3B,QAAQ,IAAI,gBAAgB,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,aAAa,EACb,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAEhD,YAAY,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,6CAA6C,EAC7C,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC"}

package/core/dist/runtime-v2/activation/index.js

@@ -11,6 +11,9 @@ export { REQUIRED_PROMOTION_CHECK_IDS, evaluateRuleCodePromotionReadiness } from
 export { PromotionReadinessReader } from './promotion-readiness-reader.js';
 export { evaluateRuleCodeSafetyCircuit, initialRuleCodeSafetyCircuitState } from './rulecode-safety-circuit-breaker.js';
 export { collectOpenClawPromotionChecks } from './openclaw-promotion-checks.js';
+export { validateRecoveryCapabilityCoverage } from './openclaw-promotion-checks.js';
+export { RECOVERY_CONTROL_SURFACES, validateRecoveryControlSurfaces } from './recovery-control-surfaces.js';
+export { verifyRecoveryProbeComposition } from './recovery-composition.js';
 export { summarizeRuleCodeShadowEvents } from './rulecode-shadow-summary.js';
 export { buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity, verifyPiArtifactRowDigest } from './promotion-evidence-snapshot.js';
 export { ApprovalQueue, decideAutoPromotion } from './approval-queue.js';

package/core/dist/runtime-v2/activation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/index.ts"],"names":[],"mappings":"AAiCA,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,2EAA2E;AAC3E,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAG3H,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAMpF,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AAEtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAExH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAG5J,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpF,4EAA4E;AAC5E,0EAA0E;AAC1E,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEnG,oEAAoE;AACpE,4EAA4E;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAG7E,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,cAAc,GACf,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EACL,2BAA2B,EAC3B,QAAQ,IAAI,gBAAgB,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,aAAa,EACb,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAShD,4EAA4E;AAC5E,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,6CAA6C,EAC7C,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/index.ts"],"names":[],"mappings":"AAiCA,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,2EAA2E;AAC3E,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAG3H,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAMpF,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AAEtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAExH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAGhF,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAE5G,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAE3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAG5J,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpF,4EAA4E;AAC5E,0EAA0E;AAC1E,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEnG,oEAAoE;AACpE,4EAA4E;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAG7E,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,cAAc,GACf,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EACL,2BAA2B,EAC3B,QAAQ,IAAI,gBAAgB,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,aAAa,EACb,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAShD,4EAA4E;AAC5E,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,6CAA6C,EAC7C,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,2BAA2B,CAAC"}

package/core/dist/runtime-v2/activation/openclaw-promotion-checks.d.ts

@@ -1,4 +1,5 @@
 import type { PIArtifactSnapshot } from './activation-types.js';
+import type { ToolSemanticRegistry } from '../internalization/tool-semantic-registry.js';
 import type { PromotionReadinessCheck } from './promotion-readiness-evaluator.js';
 export interface HostLivenessContract {
     version: string;
@@ -20,11 +21,85 @@ interface OpenClawPromotionCheckInput {
     ownerIdentityConfigured: boolean;
     safetyControlsEnabled: boolean;
     hostContract: unknown;
+    /**
+     * SPEC-RULECODE-HOST-PROMOTION-001 B: the contract version the workspace
+     * host resolver handed out for THIS promotion target. The shape validator
+     * only accepts a contract whose version matches — a Codex (or WorkBuddy)
+     * workspace can no longer present the OpenClaw legacy contract (or vice
+     * versa) as its capability authority. Defaults to the OpenClaw legacy
+     * version so pre-existing callers keep their exact behavior.
+     */
+    expectedHostContractVersion?: string;
     existingLiveArtifacts: readonly PIArtifactSnapshot[];
+    /**
+     * Review R3/P1: composition verification executes through the production
+     * boundary (same hardened evaluator + mergeDecisions as the shared gate)
+     * and needs the project root for path normalization, exactly like the
+     * golden-trace replay does.
+     */
+    projectDir?: string;
+    toolSemantics?: ToolSemanticRegistry;
+    /**
+     * Review R3/P1: target-environment reachability evidence for the recovery
+     * controls, produced per readiness evaluation by the CALLER through a
+     * bounded, non-destructive probe (never cached, never destructive):
+     * - CLI channel: the caller spawns the real read-only status command and
+     *   verifies it executes, parses, and reflects the TARGET workspace;
+     * - console channel: the caller proves the control's durable substrate is
+     *   reachable from this process (and the authenticated review route served
+     *   this request) — the full HTTP entry path from the Owner's browser is
+     *   e2e/isolated-test evidence, not something a server can self-assert.
+     * Absent or failed evidence keeps emergency_controls FAILED — a registry
+     * proof in code is not an environment health fact.
+     */
+    recoveryReachability?: RecoveryReachabilityEvidence;
     validateProductionArtifact(artifact: PIArtifactSnapshot): Promise<{
         ok: boolean;
     }>;
 }
+export interface RecoveryReachabilityEvidence {
+    source: 'cli-status-probe' | 'console-store-probe' | 'console-route-served';
+    ok: boolean;
+    /** The probe was observed to target the workspace this readiness run governs. */
+    workspaceMatched: boolean;
+    /** Bounded, structured detail for the failed case (rc-9). */
+    detail?: string;
+    /**
+     * Review R4/P1: PER-CAPABILITY evidence. One aggregate probe can never
+     * certify the whole recovery surface — a successful status query says
+     * nothing about the deactivate entry, and a readable pause store says
+     * nothing about the pause ROUTE. emergency_controls requires one valid,
+     * current, workspace-matched entry for EVERY capability in the
+     * recovery-control registry: missing, duplicate, unknown, channel-mismatched,
+     * or failed entries fail the check (fail closed).
+     */
+    capabilities?: readonly RecoveryCapabilityEvidence[];
+}
+export interface RecoveryCapabilityEvidence {
+    capabilityId: string;
+    channel: 'cli' | 'console';
+    ok: boolean;
+    workspaceMatched: boolean;
+    /** Bounded reason when ok/workspaceMatched is false (rc-9). */
+    detail?: string;
+}
+export type RecoveryCapabilityCoverage = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'recovery_capability_evidence_incomplete' | 'recovery_reachability_unverified';
+    detail: string;
+};
+/**
+ * Review R4/P1: validate the per-capability evidence matrix against the
+ * recovery-control registry. Required: every registry capability present
+ * EXACTLY once, channel matching the registry, ok AND workspace-matched.
+ * Duplicates, unknown ids, missing entries, or channel mismatches are
+ * coverage failures; entries that ran but failed (or targeted another
+ * workspace) are reachability failures. Never cached — the caller produces
+ * this evidence fresh for every readiness evaluation.
+ */
+export declare function validateRecoveryCapabilityCoverage(capabilities: readonly RecoveryCapabilityEvidence[] | undefined): RecoveryCapabilityCoverage;
 export declare function collectOpenClawPromotionChecks(artifact: PIArtifactSnapshot, input: OpenClawPromotionCheckInput): Promise<PromotionReadinessCheck[]>;
 export {};
 //# sourceMappingURL=openclaw-promotion-checks.d.ts.map

package/core/dist/runtime-v2/activation/openclaw-promotion-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openclaw-promotion-checks.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/openclaw-promotion-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAElF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,SAAS,CAAC,uBAAuB,GAAG,uBAAuB,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC3G,qBAAqB,EAAE,SAAS;QAC9B,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,EAAE,CAAC;IACJ,aAAa,EAAE,SAAS;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,EAAE,CAAC;CACL;AAED,UAAU,2BAA2B;IACnC,uBAAuB,EAAE,OAAO,CAAC;IACjC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;IACtB,qBAAqB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD,0BAA0B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACpF;AA4FD,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAmCpC"}
+{"version":3,"file":"openclaw-promotion-checks.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/openclaw-promotion-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAIlF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,SAAS,CAAC,uBAAuB,GAAG,uBAAuB,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC3G,qBAAqB,EAAE,SAAS;QAC9B,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,EAAE,CAAC;IACJ,aAAa,EAAE,SAAS;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,EAAE,CAAC;CACL;AAED,UAAU,2BAA2B;IACnC,uBAAuB,EAAE,OAAO,CAAC;IACjC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,qBAAqB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;IACpD,0BAA0B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,kBAAkB,GAAG,qBAAqB,GAAG,sBAAsB,CAAC;IAC5E,EAAE,EAAE,OAAO,CAAC;IACZ,iFAAiF;IACjF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,yCAAyC,GAAG,kCAAkC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1H;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,EAAE,SAAS,0BAA0B,EAAE,GAAG,SAAS,GAC9D,0BAA0B,CAsC5B;AA+ED,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CA0FpC"}