create-principles-disciple 1.145.6 → 1.145.7

package/host-runtime/dist/internalization-consumer-cycle.js

@@ -23,7 +23,7 @@
 import { createRuntimeStateHandle, InternalizationOrchestrator, DreamerRunner, PhilosopherRunner, ScribeRunner, ArtificerRunner, buildArtificerHostSemanticContext, EvaluatorRunner, RolloutReviewerRunner, DefaultDreamerValidator, DefaultPhilosopherValidator, DefaultScribeValidator, DefaultArtificerValidator, DefaultEvaluatorValidator, DefaultRolloutReviewerValidator, PiAiRuntimeAdapter, L2AgentLoopAdapter, ArtificerL2Adapter, buildL2PrincipleReaderFromLedger, OpenClawCliRuntimeAdapter, storeEmitter, createProductionGateDeps, resolveRuntimeConfigFromPdConfig, resolveRuntimeConfigForAgent, AGENT_NAME_FOR_TASK_KIND, isRuntimeConfigError, computeConsumerDecision, FULL_CHAIN_CONSUMER_RUNNER_KINDS, DEFAULT_CONSUMER_RUNNER_KINDS, InternalizationQueueReadModel, MVP_CORE_TASK_KINDS, SqliteConnection, SqliteReconciliationCursorStore, SUCCEEDED_TRANSITIONS_SCOPE, PrincipleTreeLedgerAdapter, 
 // PRI-714: resolve outputLanguage from the same effective config the
 // runners already receive (EP-07: canonical resolved value, not raw input).
-resolveOutputLanguage, hydratePITaskRecord, preflightArtificerOwnerEvidence, } from '@principles/core/runtime-v2';
+resolveOutputLanguage, hydratePITaskRecord, preflightArtificerOwnerEvidence, preflightArtificerIntentBasis, consumeSourceFaultBackoffSkip, advanceSourceFaultBackoff, } from '@principles/core/runtime-v2';
 import { loadLedger } from '@principles/core/principle-tree-ledger';
 import { loadPdConfigForPlugin, loadFeatureFlagFromConfig } from './pd-config.js';
 import { createEvaluatorRepairDeps, createRolloutGovernanceDeps } from './internalization-consumer-governance.js';
@@ -384,6 +384,21 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                             preflightSkipReason = 'code_rule_capability_disabled';
                             continue;
                         }
+                        // SPEC-RULECODE-QUALITY-001 §9 (Q21): a pending source-fault backoff
+                        // consumes one skip cycle per encounter — the task stays pending,
+                        // zero model cost, and the technical retry happens only after the
+                        // bounded 1-then-2-cycle backoff elapses (restart-durable).
+                        if (await consumeSourceFaultBackoffSkip(candidate.taskId, leasedPiTask, stateManager)) {
+                            const backoffInfo = JSON.stringify({
+                                reason: 'source_fault_backoff_skip',
+                                taskId: candidate.taskId,
+                                nextAction: 'Transient source fault backoff in effect; the task retries automatically at zero model cost.',
+                            });
+                            emitEvent('INTERNALIZATION_CONSUMER_SKIP', backoffInfo);
+                            logger.info(`[PD:${logLabel}] Artificer task ${candidate.taskId} skipped this cycle: source-fault backoff.`);
+                            preflightSkipReason = 'source_fault_backoff_skip';
+                            continue;
+                        }
                         artificerEvidence = await preflightArtificerOwnerEvidence({
                             taskId: candidate.taskId,
                             piTask: leasedPiTask,
@@ -415,16 +430,21 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                             // assembly at zero model cost), the runner is never constructed,
                             // and the preflight already emitted the structured degradation
                             // telemetry (reason=evidence_source_error, reviewPersisted=false).
+                            // SPEC-RULECODE-QUALITY-001 §9 (Q21/Q22): the transient fault now
+                            // advances the SHARED bounded source-fault backoff (restart-
+                            // durable counter; 3rd consecutive fault ends auto-retry in a
+                            // source_fault_persistent review terminal — never an Owner label).
+                            const persistentFault = await advanceSourceFaultBackoff({ taskId: candidate.taskId, piTask: leasedPiTask, stateManager }, `evidence source error: ${artificerEvidence.detail ?? 'trajectory store I/O fault'}`);
                             const storageInfo = JSON.stringify({
-                                reason: 'evidence_source_error',
+                                reason: persistentFault ? 'source_fault_persistent' : 'evidence_source_error',
                                 taskId: candidate.taskId,
                                 taskKind: candidate.taskKind,
                                 nextAction: artificerEvidence.nextAction,
                                 ...(artificerEvidence.detail !== undefined ? { detail: artificerEvidence.detail } : {}),
                             });
                             emitEvent('INTERNALIZATION_CONSUMER_SKIP', storageInfo);
-                            logger.warn(`[PD:${logLabel}] Artificer task ${candidate.taskId} skipped: evidence source error (storage fault preserved; task stays wake-eligible).`);
-                            preflightSkipReason = 'evidence_source_error';
+                            logger.warn(`[PD:${logLabel}] Artificer task ${candidate.taskId} skipped: evidence source error (storage fault preserved; task stays wake-eligible${persistentFault ? '; auto-retry ended after repeated faults' : ''}).`);
+                            preflightSkipReason = persistentFault ? 'source_fault_persistent' : 'evidence_source_error';
                             continue;
                         }
                         if (artificerEvidence.decision === 'blocked') {
@@ -444,6 +464,61 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                             preflightSkipReason = 'artificer_blocked_on_owner_evidence';
                             continue;
                         }
+                        // SPEC-RULECODE-QUALITY-001 A1 (Q01/Q20): intent-basis preflight —
+                        // evidence-ready is necessary but NOT sufficient. The scribe
+                        // artifact must carry a valid intentContract AND machine-readable
+                        // executionConditions, and every declared required trusted fact
+                        // must be resolvable through ports.trustedFacts. Any stop verdict
+                        // moves the task to needs_human_review with a stable reasonCode
+                        // and the runner is NEVER constructed (zero generation calls).
+                        // The gate re-derives from the scribe artifact every run — a
+                        // stored verification record is never a pass token.
+                        const intentBasis = await preflightArtificerIntentBasis({
+                            taskId: candidate.taskId,
+                            piTask: leasedPiTask,
+                            owner,
+                            workspaceDir,
+                            stateManager,
+                            eventEmitter: workspaceEmitter,
+                            ...(ports.trustedFacts !== undefined ? { trustedFacts: ports.trustedFacts } : {}),
+                        });
+                        if (intentBasis.decision === 'source_error') {
+                            // Q21: transient artifact-store fault — the preflight already
+                            // advanced the shared bounded backoff; task stays wake-eligible.
+                            emitEvent('INTERNALIZATION_CONSUMER_SKIP', JSON.stringify({
+                                reason: 'intent_source_error',
+                                taskId: candidate.taskId,
+                                nextAction: intentBasis.nextAction,
+                                detail: intentBasis.detail,
+                            }));
+                            logger.warn(`[PD:${logLabel}] Artificer task ${candidate.taskId} skipped: intent-basis source error (transient; bounded backoff applies).`);
+                            preflightSkipReason = 'intent_source_error';
+                            continue;
+                        }
+                        if (intentBasis.decision === 'source_fault_persistent') {
+                            emitEvent('INTERNALIZATION_CONSUMER_INTENT_BLOCKED', JSON.stringify({
+                                taskId: candidate.taskId,
+                                reasonCode: intentBasis.reasonCode,
+                                nextAction: intentBasis.nextAction,
+                                detail: intentBasis.detail,
+                                reviewPersisted: intentBasis.reviewPersisted,
+                            }));
+                            logger.warn(`[PD:${logLabel}] Artificer task ${candidate.taskId} blocked: repeated source faults ended auto-retry (${intentBasis.reasonCode}).`);
+                            preflightSkipReason = 'source_fault_persistent';
+                            continue;
+                        }
+                        if (intentBasis.decision === 'blocked') {
+                            emitEvent('INTERNALIZATION_CONSUMER_INTENT_BLOCKED', JSON.stringify({
+                                taskId: candidate.taskId,
+                                reasonCode: intentBasis.reasonCode,
+                                nextAction: intentBasis.nextAction,
+                                detail: intentBasis.detail,
+                                reviewPersisted: intentBasis.reviewPersisted,
+                            }));
+                            logger.warn(`[PD:${logLabel}] Artificer task ${candidate.taskId} blocked on intent basis (${intentBasis.reasonCode}, reviewPersisted=${intentBasis.reviewPersisted}).`);
+                            preflightSkipReason = 'artificer_blocked_on_intent_basis';
+                            continue;
+                        }
                     }
                 }
                 wakeResult = candidate;
@@ -643,6 +718,12 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                     ...(artificerEvidence !== null && artificerEvidence.decision === 'ready'
                         ? { behaviorExamplePack: artificerEvidence.pack }
                         : {}),
+                    // SPEC-RULECODE-QUALITY-001 A1 (Owner review P2): the SAME
+                    // trusted-facts port the intent preflight used must ride into the
+                    // runner so the defensive mirror sees the same fact resolutions —
+                    // without this, a port-resolved task would pass the entry gate and
+                    // then be refused by the runner's "provider absent" guard.
+                    ...(ports.trustedFacts !== undefined ? { trustedFacts: ports.trustedFacts } : {}),
                 }, 
                 // PRI-741: thread the host semantic projection into generation.
                 { ...runnerOptions, ...(artificerHostSemanticContext !== undefined ? { hostSemanticContext: artificerHostSemanticContext } : {}) });

package/host-runtime/dist/production-rulehost-gate.js

@@ -85,6 +85,13 @@ export function createProductionRuleHostGate(options = {}) {
         if (action.normalizedPath === null)
             return { decision: 'allow', source: event.source, metadata: { evaluatedLiveRules: 0 } };
         let context;
+        /**
+         * SPEC-RULECODE-QUALITY-001 A3 (Q10): the precise reason a v2 rule is
+         * suspended — carried into the skip warning so each fault kind (absent /
+         * undefined / invalid / failed / unavailable) is distinguishable in host
+         * telemetry instead of merging into one opaque 'unavailable'.
+         */
+        let contextFault;
         let enrichment = { currentGfi: 0, epTier: 0, bashRisk: 'unknown' };
         const request = {
             workspaceDir: event.context.workspaceDir, sessionId: event.context.sessionId,
@@ -110,6 +117,7 @@ export function createProductionRuleHostGate(options = {}) {
                 const candidate = await withinGateDeadline(options.ruleContextProvider(request), startedAt);
                 if (candidate === undefined) {
                     context = undefined;
+                    contextFault = 'provider_returned_undefined';
                 }
                 else {
                     const validation = validateRuleContextV2(candidate);
@@ -117,18 +125,27 @@ export function createProductionRuleHostGate(options = {}) {
                         context = candidate;
                     else {
                         context = UNAVAILABLE_RULE_CONTEXT;
+                        contextFault = 'provider_invalid';
                         addWarning(warnings, `rule_context_invalid: ${validation.errors.join('; ')}`, 'repair the host context provider');
                     }
                 }
             }
             catch (error) {
                 context = UNAVAILABLE_RULE_CONTEXT;
+                contextFault = 'provider_failed';
                 addWarning(warnings, `rule_context_provider_failed: ${error instanceof Error ? error.message : String(error)}`, 'inspect the host context provider and retry');
             }
         }
+        else {
+            contextFault = 'provider_absent';
+        }
         const dbPath = path.join(event.context.workspaceDir, '.pd', 'state.db');
         if (remainingGateMs(startedAt) <= 0) {
-            return { decision: 'allow', source: event.source, warnings: [boundedWarning('gate_deadline_exceeded', 'inspect host context providers and active RuleCode resource use')] };
+            // SPEC-RULECODE-QUALITY-001 Q24: a deadline-exhausted allow must be
+            // observable as "no rule executed" (evaluatedLiveRules=0), never read
+            // as successful governance — isolated probe finding (the early return
+            // previously carried no evaluation facts at all).
+            return { decision: 'allow', source: event.source, warnings: [boundedWarning('gate_deadline_exceeded', 'inspect host context providers and active RuleCode resource use')], metadata: { evaluatedLiveRules: 0 } };
         }
         if (!fs.existsSync(dbPath)) {
             // Security audit run-1 (gate-failopen-allow-on-state-corruption):
@@ -308,8 +325,28 @@ export function createProductionRuleHostGate(options = {}) {
                                 addWarning(warnings, `unsupported_context_version: ${String(content.requiresContextVersion)}`, 'regenerate the rule artifact for context version 2');
                                 continue;
                             }
-                            if (!context) {
-                                addWarning(warnings, 'rule_context_v2_unavailable', 'enable and wire the host rule context provider');
+                            // SPEC-RULECODE-QUALITY-001 A3 / §7.1 (Q10): MANDATORY runtime
+                            // suspension of context-dependent rules. A v2 rule may only
+                            // execute when the provider resolved a schema-valid context
+                            // whose history.status is 'available'. The old check (`!context`)
+                            // let the truthy UNAVAILABLE_RULE_CONTEXT sentinel (provider
+                            // invalid/thrown) and schema-valid unavailable contexts through,
+                            // so a v2 rule without its own self-protection still executed on
+                            // untrusted input. Skipping happens per-call, per-rule — healthy
+                            // sibling rules (v1 or well-fed v2) keep evaluating, and no
+                            // governance state changes. Intentional behavior change vs the
+                            // pre-fix "legal unavailable still executed" path.
+                            if (context === undefined || context.history.status !== 'available') {
+                                // Reference identity against the frozen sentinel distinguishes
+                                // "the provider faulted" from "the provider legitimately
+                                // declared history unavailable" (same wire shape, different
+                                // fault class — Q10 asserts them separately).
+                                const fault = context === undefined
+                                    ? (contextFault ?? 'provider_absent')
+                                    : context === UNAVAILABLE_RULE_CONTEXT
+                                        ? (contextFault ?? 'provider_invalid')
+                                        : 'history_unavailable';
+                                addWarning(warnings, `rule_context_v2_unavailable: ${fault} (activation=${activationId})`, 'enable and wire the host rule context provider, or regenerate the rule without context dependence');
                                 continue;
                             }
                         }

package/host-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.145.6",
+  "version": "1.145.7",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {