create-principles-disciple 1.145.32 → 1.145.34

package/host-runtime/dist/cli-recovery-probe.d.ts

@@ -0,0 +1,30 @@
+import type { RecoveryCapabilityEvidence } from '@principles/core/runtime-v2';
+export declare const DEACTIVATE_DRY_RUN_PROBE_ACTIVATION_ID = "recovery-probe-nonexistent";
+/**
+ * Resolve the built pd CLI entry for the CURRENT environment. Both layouts
+ * place the sibling packages at the same relative depth: repo checkouts at
+ * `packages/host-runtime/dist` and installed runtimes at
+ * `~/.pd/runtime/host-runtime/dist`, each with `pd-cli/dist/index.js` two
+ * levels up. Returns null when no built entry exists (callers fail closed).
+ */
+export declare function resolveCliRecoveryEntry(): string | null;
+export interface CliRecoveryProbeOptions {
+    /** Absolute path to the built pd CLI entry (dist/index.js). */
+    cliEntry: string;
+    workspaceDir: string;
+    /** When supplied, the status listing must include this activation (workspace-targeting proof). */
+    expectedActivationId?: string;
+    /** Probe budget in ms (default 15s). A timeout fails the capability closed — tests on loaded machines may raise it. */
+    timeoutMs?: number;
+}
+/** `pd activation list --json` — the pd_status status surface, read-only. */
+export declare function probeCliActivationStatus(options: CliRecoveryProbeOptions): Promise<RecoveryCapabilityEvidence>;
+/**
+ * `pd activation deactivate --dry-run` — the REAL deactivate entry (parsing,
+ * workspace binding, target resolution, preconditions) without audit write or
+ * store mutation. The probe id does not exist, so the precondition outcome is
+ * an honest not-found while the entry itself is proven executable.
+ */
+export declare function probeCliDeactivateDryRun(options: CliRecoveryProbeOptions): Promise<RecoveryCapabilityEvidence>;
+/** Both CLI-channel capabilities plus explicit NOT-VERIFIED entries for the console channel (fail closed, never fabricated). */
+export declare function probeCliRecoveryCapabilities(options: CliRecoveryProbeOptions): Promise<RecoveryCapabilityEvidence[]>;

package/host-runtime/dist/cli-recovery-probe.js

@@ -0,0 +1,169 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 review round 4 (P1): per-capability
+ * CLI-channel reachability probes, shared by the pd-cli readiness path and
+ * the pd-console readiness assembly (both packages depend on host-runtime).
+ *
+ * Every probe executes the REAL pd CLI as a bounded subprocess against the
+ * TARGET workspace — static command lists, no shell, output capped, timeout
+ * enforced. Evidence is produced fresh on every call; nothing is cached and
+ * nothing destructive runs:
+ * - `pd_status`: `pd activation list --json` (read-only status surface);
+ * - `rulecode_deactivate`: `pd activation deactivate --activation-id
+ *   recovery-probe-nonexistent --dry-run --json` — the REAL deactivate entry
+ *   through real parsing, workspace binding, and target-resolution
+ *   preconditions, with the dry-run guard returning BEFORE any governance
+ *   audit write or store mutation. A nonexistent probe id keeps the
+ *   precondition honest without touching any real activation.
+ *
+ * Console-channel capabilities (`rulecode_global_pause`,
+ * `owner_review_access`) can never be verified from a CLI subprocess — the
+ * caller receives explicit NOT-VERIFIED entries for them instead of
+ * fabricated ok flags (fail closed; SPEC R4 §2.4.7).
+ */
+const PROBE_TIMEOUT_MS = 15_000;
+const MAX_STDOUT_BYTES = 1024 * 1024;
+export const DEACTIVATE_DRY_RUN_PROBE_ACTIVATION_ID = 'recovery-probe-nonexistent';
+/**
+ * Resolve the built pd CLI entry for the CURRENT environment. Both layouts
+ * place the sibling packages at the same relative depth: repo checkouts at
+ * `packages/host-runtime/dist` and installed runtimes at
+ * `~/.pd/runtime/host-runtime/dist`, each with `pd-cli/dist/index.js` two
+ * levels up. Returns null when no built entry exists (callers fail closed).
+ */
+export function resolveCliRecoveryEntry() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        path.resolve(here, '..', '..', 'pd-cli', 'dist', 'index.js'),
+        path.resolve(process.cwd(), 'packages', 'pd-cli', 'dist', 'index.js'),
+        path.resolve(process.cwd(), 'dist', 'index.js'),
+    ];
+    for (const candidate of candidates) {
+        try {
+            if (existsSync(candidate))
+                return candidate;
+        }
+        catch {
+            // probe the next candidate
+        }
+    }
+    return null;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function runCli(cliEntry, args, timeoutMs) {
+    return new Promise(resolve => {
+        // Static argv list — no shell, no interpolated command string.
+        const child = spawn(process.execPath, [cliEntry, ...args], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        let stdout = '';
+        let finished = false;
+        let timer;
+        const finish = (result) => {
+            if (finished)
+                return;
+            finished = true;
+            if (timer !== undefined)
+                clearTimeout(timer);
+            child.removeAllListeners();
+            resolve(result);
+        };
+        timer = setTimeout(() => {
+            child.kill();
+            finish({ ok: false, detail: 'cli probe timeout' });
+        }, timeoutMs);
+        child.stdout.on('data', (chunk) => {
+            if (stdout.length < MAX_STDOUT_BYTES)
+                stdout += chunk.toString('utf8');
+        });
+        child.stderr.on('data', () => { });
+        child.on('error', error => finish({ ok: false, detail: `spawn failed: ${error instanceof Error ? error.message : String(error)}` }));
+        child.on('close', code => {
+            if (code !== 0) {
+                finish({ ok: false, detail: `exited with code ${code}` });
+                return;
+            }
+            finish({ ok: true, stdout });
+        });
+    });
+}
+function pathResolved(value) {
+    const normalized = value.replace(/\\/g, '/');
+    let end = normalized.length;
+    while (end > 0 && normalized.charCodeAt(end - 1) === 47)
+        end -= 1;
+    return normalized.slice(0, end).toLowerCase();
+}
+function capability(capabilityId, evidence) {
+    return {
+        capabilityId,
+        ...evidence,
+    };
+}
+const CONSOLE_UNVERIFIABLE_DETAIL = 'console-channel control: verifying the HTTP-only recovery entry requires the Owner Console process; a CLI subprocess cannot produce this evidence';
+/** `pd activation list --json` — the pd_status status surface, read-only. */
+export async function probeCliActivationStatus(options) {
+    const run = await runCli(options.cliEntry, ['activation', 'list', '--json', '--workspace', options.workspaceDir], options.timeoutMs ?? PROBE_TIMEOUT_MS);
+    if (!run.ok)
+        return capability('pd_status', { channel: 'cli', ok: false, workspaceMatched: false, detail: `pd activation list: ${run.detail}` });
+    let parsed;
+    try {
+        parsed = JSON.parse(run.stdout);
+    }
+    catch {
+        return capability('pd_status', { channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd activation list: stdout is not parseable JSON' });
+    }
+    const activations = isRecord(parsed) && Array.isArray(parsed.activations) ? parsed.activations : undefined;
+    if (activations === undefined) {
+        return capability('pd_status', { channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd activation list: output carries no activations listing' });
+    }
+    if (options.expectedActivationId !== undefined) {
+        const listed = activations.some(entry => isRecord(entry) && entry.activationId === options.expectedActivationId);
+        if (!listed) {
+            return capability('pd_status', { channel: 'cli', ok: false, workspaceMatched: false, detail: `pd activation list: the target workspace listing does not include activation ${options.expectedActivationId}` });
+        }
+    }
+    return capability('pd_status', { channel: 'cli', ok: true, workspaceMatched: true });
+}
+/**
+ * `pd activation deactivate --dry-run` — the REAL deactivate entry (parsing,
+ * workspace binding, target resolution, preconditions) without audit write or
+ * store mutation. The probe id does not exist, so the precondition outcome is
+ * an honest not-found while the entry itself is proven executable.
+ */
+export async function probeCliDeactivateDryRun(options) {
+    const run = await runCli(options.cliEntry, ['activation', 'deactivate', '--activation-id', DEACTIVATE_DRY_RUN_PROBE_ACTIVATION_ID, '--dry-run', '--json', '--workspace', options.workspaceDir], options.timeoutMs ?? PROBE_TIMEOUT_MS);
+    if (!run.ok)
+        return capability('rulecode_deactivate', { channel: 'cli', ok: false, workspaceMatched: false, detail: `pd activation deactivate --dry-run: ${run.detail}` });
+    let parsed;
+    try {
+        parsed = JSON.parse(run.stdout);
+    }
+    catch {
+        return capability('rulecode_deactivate', { channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd activation deactivate --dry-run: stdout is not parseable JSON' });
+    }
+    if (!isRecord(parsed) || parsed.dryRun !== true || typeof parsed.workspaceDir !== 'string') {
+        return capability('rulecode_deactivate', { channel: 'cli', ok: false, workspaceMatched: false, detail: 'pd activation deactivate --dry-run: output is not a structured dry-run result' });
+    }
+    if (pathResolved(options.workspaceDir) !== pathResolved(String(parsed.workspaceDir))) {
+        return capability('rulecode_deactivate', { channel: 'cli', ok: false, workspaceMatched: false, detail: `pd activation deactivate --dry-run: bound to ${String(parsed.workspaceDir)}, not the governed workspace` });
+    }
+    return capability('rulecode_deactivate', { channel: 'cli', ok: true, workspaceMatched: true });
+}
+/** Both CLI-channel capabilities plus explicit NOT-VERIFIED entries for the console channel (fail closed, never fabricated). */
+export async function probeCliRecoveryCapabilities(options) {
+    const status = await probeCliActivationStatus(options);
+    const deactivate = await probeCliDeactivateDryRun(options);
+    return [
+        status,
+        deactivate,
+        capability('rulecode_global_pause', { channel: 'console', ok: false, workspaceMatched: false, detail: CONSOLE_UNVERIFIABLE_DETAIL }),
+        capability('owner_review_access', { channel: 'console', ok: false, workspaceMatched: false, detail: CONSOLE_UNVERIFIABLE_DETAIL }),
+    ];
+}

package/host-runtime/dist/governance-signal-admission.js

@@ -319,6 +319,16 @@ function ensureGovernanceAdmissionSchema(db) {
                 if (!message.includes('duplicate column name'))
                     throw err;
             }
+            try {
+                // SPEC-RULECODE-HOST-PROMOTION-001 R2: additive producer host
+                // attribution; legacy rows stay NULL (unprovable, never backfilled).
+                db.exec('ALTER TABLE tool_calls ADD COLUMN host_kind TEXT');
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                if (!message.includes('duplicate column name'))
+                    throw err;
+            }
             db.exec('CREATE INDEX IF NOT EXISTS idx_tool_calls_session_tool_use_id ON tool_calls(session_id, tool_use_id)');
         }
     })();
@@ -642,13 +652,20 @@ function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
         // Same duplicate probes as the production handler: the host tool-call id
         // (CR-01) is the stable join key; the content-shape probe stays the
         // fallback for hosts/candidates without ids.
+        // Review R3/P2: admission dedup is host-scoped — a colliding row from
+        // another host is not this candidate's duplicate.
         if (candidate.toolUseId !== undefined
-            && db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ?').get(candidate.rootSessionId, candidate.toolUseId) !== undefined) {
+            && (candidate.hostKind !== undefined
+                ? db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ? AND host_kind = ?').get(candidate.rootSessionId, candidate.toolUseId, candidate.hostKind)
+                : db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ?').get(candidate.rootSessionId, candidate.toolUseId)) !== undefined) {
             duplicate = true;
             duplicateWithoutPain = db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) === undefined;
         }
-        else if (db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?')
-            .get(candidate.rootSessionId, candidate.toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview) !== undefined) {
+        else if ((candidate.hostKind !== undefined
+            ? db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ? AND host_kind = ?')
+                .get(candidate.rootSessionId, candidate.toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview, candidate.hostKind)
+            : db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?')
+                .get(candidate.rootSessionId, candidate.toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview)) !== undefined) {
             duplicate = true;
             duplicateWithoutPain = db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) === undefined;
         }
@@ -658,8 +675,8 @@ function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
             const projectDir = typeof candidate.projectDir === 'string' && path.isAbsolute(candidate.projectDir)
                 ? path.resolve(candidate.projectDir)
                 : null;
-            db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(candidate.rootSessionId, candidate.toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, nowIso, candidate.toolUseId ?? null, projectDir);
+            db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir, host_kind) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(candidate.rootSessionId, candidate.toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, nowIso, candidate.toolUseId ?? null, projectDir, candidate.hostKind);
             reason = `tool=${candidate.toolName}; error=${outcome.error ?? `exit=${outcome.exitCode}`}; path=${relativePath}`;
             db.prepare(`INSERT INTO pain_events (session_id, source, score, reason, severity, origin, confidence, text, canonical_pain_id, runtime_task_id, host_kind, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
                 .run(candidate.rootSessionId, sourceObservation.failureSource ?? 'tool_failure', painScore, reason, painScore >= 70 ? 'severe' : painScore >= 40 ? 'moderate' : 'mild', 'system_infer', null, null, painId, null, candidate.hostKind, nowIso);

package/host-runtime/dist/host-liveness-contract.d.ts

@@ -1,9 +1,32 @@
 import type { HostLivenessContract } from '@principles/core/runtime-v2';
 /** Adapter-owned facts consumed by the non-bypassable RuleCode promotion gate. */
 export declare const OPENCLAW_HOST_LIVENESS_CONTRACT: HostLivenessContract;
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 B1: the Codex capability contract. Every
+ * tool alias below is the REAL Codex tool surface with in-repo evidence
+ * (`Bash` + `apply_patch`, locked by the shipped hooks matcher — see
+ * codex-adapter tool-semantics.ts). The out-of-band controls are the
+ * host-neutral `pd` CLI and the Web Console: they act on the workspace
+ * state directly, never through the Codex hook process, so a broken rule
+ * cannot lock them. This contract declares the mapping ONLY; shadow-event
+ * attribution, neutral-probe composition and Owner decision authority are
+ * enforced by the shared readiness pipeline, not by this constant
+ * (SPEC §11.2 — a constant alone must never turn a check green).
+ */
+export declare const CODEX_HOST_LIVENESS_CONTRACT: HostLivenessContract;
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 C: the WorkBuddy capability contract.
+ * Tool aliases use WorkBuddy's REAL capitalized vocabulary (Read/Write/Edit/
+ * Bash — frozen Phase 0 fixtures + official hooks reference; see
+ * workbuddy-adapter tool-semantics.ts). Out-of-band controls are the same
+ * host-neutral `pd` CLI / Web Console pair, invoked outside the WorkBuddy
+ * hook channel (the hook failing closed with exit 2 on PreToolUse cannot
+ * prevent an Owner terminal or browser from reaching the workspace).
+ */
+export declare const WORKBUDDY_HOST_LIVENESS_CONTRACT: HostLivenessContract;
 export type PromotionHostLivenessResolution = {
     ok: true;
-    hostKind: 'openclaw';
+    hostKind: 'openclaw' | 'codex' | 'workbuddy';
     /**
      * The workspace host DECLARATIONS this resolution is based on.
      * Empty array = nothing declared yet (the OpenClaw contract is the
@@ -51,37 +74,37 @@ export type WorkspaceHostKindFacts = {
 };
 export declare function readWorkspaceHostKindFacts(workspaceDir: string): WorkspaceHostKindFacts;
 /**
- * PRI-813: resolve the promotion host-liveness contract from the workspace's
- * REAL host state instead of unconditionally inheriting the OpenClaw
- * contract (which made Codex workspaces report runtime_compatibility /
- * runtime_shadow_evidence as passed — a false capability claim; the promotion
- * then only ever failed on sample count, hiding the unsupported truth).
+ * SPEC-RULECODE-HOST-PROMOTION-001 §4 (A): resolve the promotion host-liveness
+ * contract from the workspace's REAL host state. The historical "anything
+ * that is not Codex inherits OpenClaw" fork is REPLACED by an explicit
+ * five-way routing over openclaw / codex / workbuddy / unknown / multi-host:
+ *
+ * - nothing declared, no evidence, or OpenClaw-only traces → OpenClaw
+ *   contract (the documented historical default; SPEC §4.2 keeps this
+ *   compatibility semantics ONLY for workspaces with no non-OpenClaw
+ *   declaration or evidence — it must not extend to workspaces where
+ *   WorkBuddy has appeared);
+ * - durable evidence for a known non-OpenClaw host whose declaration file is
+ *   missing/corrupted → host_declaration_missing_for_configured_host
+ *   (generalized from Codex-only to every known host — SPEC §4.3: never
+ *   silently fall back to OpenClaw when the governing host's declaration
+ *   cannot be read);
+ * - more than one effective host kind → multi_host_promotion_ambiguous
+ *   (never guess a target host; SPEC §4.4);
+ * - exactly one known non-OpenClaw host (declared) → that host's contract;
+ * - an unknown declared host kind → promotion_host_unsupported (fail closed;
+ *   the declaration proves tool mapping only, never promotion capability —
+ *   SPEC §4.5).
  *
  * Two durable provenance sources, cross-checked (Owner review round-4):
  * 1. host declarations — `.pd/host-tool-semantics/<hostKind>.json`;
  * 2. trajectory.db `pain_events.host_kind` — which hosts actually produced
- *    governance evidence here (survives declaration deletion).
- *
- * Resolution rules (fail closed outside the one host with an approved
- * capability authority, and fail closed whenever Codex evidence exists but
- * its declaration is missing — never silently fall back to OpenClaw):
- * - no declaration AND no Codex evidence → OpenClaw contract (the historical
- *   governance default; a workspace where only OpenClaw ever ran — or no
- *   host ran — is exactly the legacy state, and existing workspaces rely
- *   on it);
- * - only openclaw declared and no Codex evidence → OPENCLAW_HOST_LIVENESS_CONTRACT;
- * - codex declared (alone) → promotion_host_unsupported (Codex promotion
- *   stays explicitly unsupported until an evidence-backed capability
- *   authority decision exists — no second host contract here);
- * - multiple hosts declared → multi_host_promotion_ambiguous (never guess a
- *   target host; the Owner decides host-selection policy separately);
- * - Codex evidence present but codex.json missing (deleted/corrupted —
- *   alone or alongside openclaw.json) → host_declaration_missing_for_configured_host
- *   (re-persist the declaration before promoting);
- * - declarations or provenance unreadable → fail closed with the reason.
+ *    governance evidence here (survives declaration deletion). Unknown-host
+ *    evidence rows are filtered by the facts reader (known-host filter) and
+ *    can never reach this resolver (SPEC §11.4).
  *
- * This function intentionally creates no Codex contract, no capability
- * registry, and no new store — it only routes the existing single authority
- * truthfully over state that already exists.
+ * This function creates no capability registry and no new store — it routes
+ * the existing per-host contract authorities truthfully over state that
+ * already exists.
  */
 export declare function resolvePromotionHostLiveness(workspaceDir: string): PromotionHostLivenessResolution;

package/host-runtime/dist/host-liveness-contract.js

@@ -8,18 +8,98 @@ export const OPENCLAW_HOST_LIVENESS_CONTRACT = {
     supportsShadowEvidence: true,
     outOfBandControls: ['activation_deactivate', 'global_rulecode_pause', 'owner_review_console'],
     protectedCapabilities: [
-        { capabilityId: 'pd_status', hostToolAliases: ['bash', 'exec_command'] },
-        { capabilityId: 'rulecode_deactivate', hostToolAliases: ['bash', 'exec_command'] },
-        { capabilityId: 'rulecode_global_pause', hostToolAliases: ['bash', 'exec_command'] },
+        // Review R1: `exec` is the ONLY shell tool name that reaches the OpenClaw
+        // hook face (constants/tools.ts PRI-741: `bash`/`exec_command` are
+        // config-level aliases that normalize away). Aliases and probes must use
+        // the real dispatched name or the neutral-probe replay rejects them.
+        { capabilityId: 'pd_status', hostToolAliases: ['exec'] },
+        { capabilityId: 'rulecode_deactivate', hostToolAliases: ['exec'] },
+        // Review R1: the global pause has NO pd CLI command — its real surface is
+        // the authenticated Owner Console route. Declaring a shell alias here
+        // would claim a recovery entry that does not exist.
+        { capabilityId: 'rulecode_global_pause', hostToolAliases: ['rulecode_global_pause'] },
         { capabilityId: 'owner_review_access', hostToolAliases: ['owner_review_access'] },
     ],
     neutralProbes: [
-        { probeId: 'probe-pd-status', capabilityId: 'pd_status', toolName: 'bash', params: { command: 'pd status' }, expectedDecision: 'allow' },
-        { probeId: 'probe-rule-deactivate', capabilityId: 'rulecode_deactivate', toolName: 'bash', params: { command: 'pd activation deactivate --activation-id test' }, expectedDecision: 'allow' },
-        { probeId: 'probe-global-pause', capabilityId: 'rulecode_global_pause', toolName: 'bash', params: { command: 'pd activation emergency-pause' }, expectedDecision: 'allow' },
-        { probeId: 'probe-owner-review', capabilityId: 'owner_review_access', toolName: 'owner_review_access', params: {}, expectedDecision: 'allow' },
+        // Review R1: probe commands are the REAL registered pd commands
+        // (verified against the recovery-control registry; `pd status` and
+        // `pd activation emergency-pause` do not exist and were removed).
+        { probeId: 'probe-pd-status', capabilityId: 'pd_status', toolName: 'exec', params: { command: 'pd activation list --json' }, expectedDecision: 'allow' },
+        { probeId: 'probe-rule-deactivate', capabilityId: 'rulecode_deactivate', toolName: 'exec', params: { command: 'pd activation deactivate --activation-id recovery-probe' }, expectedDecision: 'allow' },
+        // Review R3/P1: console-channel capabilities (global pause, owner review)
+        // carry NO probe — their recovery path never passes through the RuleHost
+        // gate, so a rule replay would misrepresent their verification. Their
+        // entry surfaces live in the recovery-control registry and their
+        // target-environment reachability is supplied by the readiness caller.
     ],
 };
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 B1: the Codex capability contract. Every
+ * tool alias below is the REAL Codex tool surface with in-repo evidence
+ * (`Bash` + `apply_patch`, locked by the shipped hooks matcher — see
+ * codex-adapter tool-semantics.ts). The out-of-band controls are the
+ * host-neutral `pd` CLI and the Web Console: they act on the workspace
+ * state directly, never through the Codex hook process, so a broken rule
+ * cannot lock them. This contract declares the mapping ONLY; shadow-event
+ * attribution, neutral-probe composition and Owner decision authority are
+ * enforced by the shared readiness pipeline, not by this constant
+ * (SPEC §11.2 — a constant alone must never turn a check green).
+ */
+export const CODEX_HOST_LIVENESS_CONTRACT = {
+    version: 'codex-v2@1',
+    supportsShadowEvidence: true,
+    outOfBandControls: ['activation_deactivate', 'global_rulecode_pause', 'owner_review_console'],
+    protectedCapabilities: [
+        { capabilityId: 'pd_status', hostToolAliases: ['Bash'] },
+        { capabilityId: 'rulecode_deactivate', hostToolAliases: ['Bash'] },
+        { capabilityId: 'rulecode_global_pause', hostToolAliases: ['rulecode_global_pause'] },
+        { capabilityId: 'owner_review_access', hostToolAliases: ['owner_review_access'] },
+    ],
+    neutralProbes: [
+        { probeId: 'probe-pd-status', capabilityId: 'pd_status', toolName: 'Bash', params: { command: 'pd activation list --json' }, expectedDecision: 'allow' },
+        { probeId: 'probe-rule-deactivate', capabilityId: 'rulecode_deactivate', toolName: 'Bash', params: { command: 'pd activation deactivate --activation-id recovery-probe' }, expectedDecision: 'allow' },
+        // Review R3/P1: console-channel capabilities (global pause, owner review)
+        // carry NO probe — their recovery path never passes through the RuleHost
+        // gate, so a rule replay would misrepresent their verification. Their
+        // entry surfaces live in the recovery-control registry and their
+        // target-environment reachability is supplied by the readiness caller.
+    ],
+};
+/**
+ * SPEC-RULECODE-HOST-PROMOTION-001 C: the WorkBuddy capability contract.
+ * Tool aliases use WorkBuddy's REAL capitalized vocabulary (Read/Write/Edit/
+ * Bash — frozen Phase 0 fixtures + official hooks reference; see
+ * workbuddy-adapter tool-semantics.ts). Out-of-band controls are the same
+ * host-neutral `pd` CLI / Web Console pair, invoked outside the WorkBuddy
+ * hook channel (the hook failing closed with exit 2 on PreToolUse cannot
+ * prevent an Owner terminal or browser from reaching the workspace).
+ */
+export const WORKBUDDY_HOST_LIVENESS_CONTRACT = {
+    version: 'workbuddy-v1@1',
+    supportsShadowEvidence: true,
+    outOfBandControls: ['activation_deactivate', 'global_rulecode_pause', 'owner_review_console'],
+    protectedCapabilities: [
+        { capabilityId: 'pd_status', hostToolAliases: ['Bash'] },
+        { capabilityId: 'rulecode_deactivate', hostToolAliases: ['Bash'] },
+        { capabilityId: 'rulecode_global_pause', hostToolAliases: ['rulecode_global_pause'] },
+        { capabilityId: 'owner_review_access', hostToolAliases: ['owner_review_access'] },
+    ],
+    neutralProbes: [
+        { probeId: 'probe-pd-status', capabilityId: 'pd_status', toolName: 'Bash', params: { command: 'pd activation list --json' }, expectedDecision: 'allow' },
+        { probeId: 'probe-rule-deactivate', capabilityId: 'rulecode_deactivate', toolName: 'Bash', params: { command: 'pd activation deactivate --activation-id recovery-probe' }, expectedDecision: 'allow' },
+        // Review R3/P1: console-channel capabilities (global pause, owner review)
+        // carry NO probe — their recovery path never passes through the RuleHost
+        // gate, so a rule replay would misrepresent their verification. Their
+        // entry surfaces live in the recovery-control registry and their
+        // target-environment reachability is supplied by the readiness caller.
+    ],
+};
+/** The per-host contracts the resolver may hand out — one authority per host kind. */
+const HOST_LIVENESS_CONTRACTS = {
+    openclaw: OPENCLAW_HOST_LIVENESS_CONTRACT,
+    codex: CODEX_HOST_LIVENESS_CONTRACT,
+    workbuddy: WORKBUDDY_HOST_LIVENESS_CONTRACT,
+};
 /**
  * Existing durable provenance (Owner review round-4): `trajectory.db`
  * `pain_events.host_kind` records which host actually produced governance
@@ -107,41 +187,41 @@ export function readWorkspaceHostKindFacts(workspaceDir) {
     return { ok: true, declaredKinds, evidenceKinds, effectiveKinds };
 }
 /**
- * PRI-813: resolve the promotion host-liveness contract from the workspace's
- * REAL host state instead of unconditionally inheriting the OpenClaw
- * contract (which made Codex workspaces report runtime_compatibility /
- * runtime_shadow_evidence as passed — a false capability claim; the promotion
- * then only ever failed on sample count, hiding the unsupported truth).
+ * SPEC-RULECODE-HOST-PROMOTION-001 §4 (A): resolve the promotion host-liveness
+ * contract from the workspace's REAL host state. The historical "anything
+ * that is not Codex inherits OpenClaw" fork is REPLACED by an explicit
+ * five-way routing over openclaw / codex / workbuddy / unknown / multi-host:
+ *
+ * - nothing declared, no evidence, or OpenClaw-only traces → OpenClaw
+ *   contract (the documented historical default; SPEC §4.2 keeps this
+ *   compatibility semantics ONLY for workspaces with no non-OpenClaw
+ *   declaration or evidence — it must not extend to workspaces where
+ *   WorkBuddy has appeared);
+ * - durable evidence for a known non-OpenClaw host whose declaration file is
+ *   missing/corrupted → host_declaration_missing_for_configured_host
+ *   (generalized from Codex-only to every known host — SPEC §4.3: never
+ *   silently fall back to OpenClaw when the governing host's declaration
+ *   cannot be read);
+ * - more than one effective host kind → multi_host_promotion_ambiguous
+ *   (never guess a target host; SPEC §4.4);
+ * - exactly one known non-OpenClaw host (declared) → that host's contract;
+ * - an unknown declared host kind → promotion_host_unsupported (fail closed;
+ *   the declaration proves tool mapping only, never promotion capability —
+ *   SPEC §4.5).
  *
  * Two durable provenance sources, cross-checked (Owner review round-4):
  * 1. host declarations — `.pd/host-tool-semantics/<hostKind>.json`;
  * 2. trajectory.db `pain_events.host_kind` — which hosts actually produced
- *    governance evidence here (survives declaration deletion).
- *
- * Resolution rules (fail closed outside the one host with an approved
- * capability authority, and fail closed whenever Codex evidence exists but
- * its declaration is missing — never silently fall back to OpenClaw):
- * - no declaration AND no Codex evidence → OpenClaw contract (the historical
- *   governance default; a workspace where only OpenClaw ever ran — or no
- *   host ran — is exactly the legacy state, and existing workspaces rely
- *   on it);
- * - only openclaw declared and no Codex evidence → OPENCLAW_HOST_LIVENESS_CONTRACT;
- * - codex declared (alone) → promotion_host_unsupported (Codex promotion
- *   stays explicitly unsupported until an evidence-backed capability
- *   authority decision exists — no second host contract here);
- * - multiple hosts declared → multi_host_promotion_ambiguous (never guess a
- *   target host; the Owner decides host-selection policy separately);
- * - Codex evidence present but codex.json missing (deleted/corrupted —
- *   alone or alongside openclaw.json) → host_declaration_missing_for_configured_host
- *   (re-persist the declaration before promoting);
- * - declarations or provenance unreadable → fail closed with the reason.
+ *    governance evidence here (survives declaration deletion). Unknown-host
+ *    evidence rows are filtered by the facts reader (known-host filter) and
+ *    can never reach this resolver (SPEC §11.4).
  *
- * This function intentionally creates no Codex contract, no capability
- * registry, and no new store — it only routes the existing single authority
- * truthfully over state that already exists.
+ * This function creates no capability registry and no new store — it routes
+ * the existing per-host contract authorities truthfully over state that
+ * already exists.
  */
 export function resolvePromotionHostLiveness(workspaceDir) {
-    // Same two provenance sources and failure semantics as before, now via the
+    // Same two provenance sources and failure semantics as before, via the
     // shared facts reader (readWorkspaceHostKindFacts) so prompt-injection
     // route resolution and promotion liveness cannot drift apart.
     const facts = readWorkspaceHostKindFacts(workspaceDir);
@@ -152,9 +232,11 @@ export function resolvePromotionHostLiveness(workspaceDir) {
     }
     const { declaredKinds } = facts;
     const { effectiveKinds } = facts;
-    // The promotion host can only be the OpenClaw contract when nothing on the
-    // workspace — neither a declaration nor behavioral evidence — says Codex.
-    if (!effectiveKinds.includes('codex')) {
+    const nonOpenClawKinds = effectiveKinds.filter((kind) => kind !== 'openclaw');
+    // Historical compatibility default (SPEC §4.2): a workspace where nothing
+    // non-OpenClaw ever declared itself or produced evidence is exactly the
+    // legacy state, and existing workspaces rely on the OpenClaw contract.
+    if (nonOpenClawKinds.length === 0) {
         return {
             ok: true,
             hostKind: 'openclaw',
@@ -163,14 +245,29 @@ export function resolvePromotionHostLiveness(workspaceDir) {
             hostRuntimeVersion: OPENCLAW_HOST_LIVENESS_CONTRACT.version,
         };
     }
-    if (!declaredKinds.includes('codex')) {
-        // Codex evidence exists (declaration gone, or only openclaw.json
-        // remains) — the exact state where a silent OpenClaw fallback would
-        // resurrect the false capability PASS (Owner review round-4).
-        return promotionHostFailure('host_declaration_missing_for_configured_host', effectiveKinds, 'Codex evidence exists in this workspace but .pd/host-tool-semantics/codex.json is missing; re-run the Codex worker so it re-persists its declaration (or deactivate the Codex activation) before promoting');
+    // SPEC §4.3: durable evidence for a known non-OpenClaw host whose own
+    // declaration is gone (deleted/corrupted — alone or alongside openclaw.json)
+    // must fail closed with the precise reason; a silent OpenClaw fallback here
+    // would resurrect a false capability PASS (Owner review round-4, now
+    // generalized beyond Codex — a WorkBuddy-only workspace is the exact same
+    // misattribution class, SPEC §1.1 item 6).
+    const missingDeclarationKinds = facts.evidenceKinds.filter((kind) => kind !== 'openclaw' && !declaredKinds.includes(kind));
+    if (missingDeclarationKinds.length > 0) {
+        return promotionHostFailure('host_declaration_missing_for_configured_host', effectiveKinds, `durable evidence for host(s) ${missingDeclarationKinds.join(', ')} exists in this workspace but the matching .pd/host-tool-semantics/<hostKind>.json declaration is missing; re-run that host so it re-persists its declaration (or deactivate the activation) before promoting`);
+    }
+    if (effectiveKinds.length > 1) {
+        return promotionHostFailure('multi_host_promotion_ambiguous', effectiveKinds, `the workspace declares multiple hosts (${effectiveKinds.join(', ')}); promotion requires an unambiguous governing host — decide the promotion target host first`);
     }
-    if (declaredKinds.length > 1) {
-        return promotionHostFailure('multi_host_promotion_ambiguous', effectiveKinds, `the workspace declares multiple hosts (${declaredKinds.join(', ')}); promotion requires an unambiguous governing host — decide the promotion target host first`);
+    const [governingKind] = nonOpenClawKinds;
+    if (governingKind !== 'codex' && governingKind !== 'workbuddy') {
+        return promotionHostFailure('promotion_host_unsupported', effectiveKinds, `host '${governingKind}' has no approved promotion capability authority; promotion on this host is explicitly unsupported until an evidence-backed capability decision exists`);
     }
-    return promotionHostFailure('promotion_host_unsupported', effectiveKinds, `host '${declaredKinds[0]}' has no approved promotion capability authority; promotion on this host is explicitly unsupported until an evidence-backed capability decision exists`);
+    const contract = HOST_LIVENESS_CONTRACTS[governingKind];
+    return {
+        ok: true,
+        hostKind: governingKind,
+        hostKinds: declaredKinds,
+        hostContract: contract,
+        hostRuntimeVersion: contract.version,
+    };
 }

package/host-runtime/dist/index.d.ts

@@ -87,6 +87,8 @@ export declare function createProductionHostRuntime(options?: Partial<Pick<HostR
 export * from './behavior-example-pack-assembler.js';
 export * from './behavior-history.js';
 export * from './codex-rule-context-provider.js';
+export * from './cli-recovery-probe.js';
+export * from './workbuddy-rule-context-provider.js';
 export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
 export * from './explicit-owner-statement-prefix.js';
 export { listObservedDesignGateSessions } from './workspace-behavior-evidence.js';

package/host-runtime/dist/index.js

@@ -317,6 +317,8 @@ export function createProductionHostRuntime(options = {}) {
 export * from './behavior-example-pack-assembler.js';
 export * from './behavior-history.js';
 export * from './codex-rule-context-provider.js';
+export * from './cli-recovery-probe.js';
+export * from './workbuddy-rule-context-provider.js';
 export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
 export * from './explicit-owner-statement-prefix.js';
 export { listObservedDesignGateSessions } from './workspace-behavior-evidence.js';

package/host-runtime/dist/production-pain-evidence.d.ts

@@ -133,6 +133,8 @@ export declare function recordVerifiedToolOutcomes(args: {
     sessionId: string;
     outcomes: readonly VerifiedToolOutcomeInput[];
     painDatabaseFactory?: PainDatabaseFactory;
+    /** SPEC R2: producer host attribution stamped onto inserted rows (upgraded rows keep their original stamp). */
+    hostKind?: string;
 }): VerifiedToolOutcomeStatus[];
 /**
  * PRI-640: host attribution is supplied by the host adapter that constructs