create-principles-disciple 1.146.8 → 1.146.9

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
   "productVersion": "2.8.0",
-  "sourceCommit": "9ef8d607d51cea885249077634df3b4126919a0d"
+  "sourceCommit": "8e0cdc607ee5d25e0b66a0655a6e0ce033a1fe99"
 }

package/console/dist/server/models/ExaminerEvidenceModel.d.ts

@@ -0,0 +1,159 @@
+import type { ReceiptEvidenceCoverage } from '@principles/core/runtime-v2';
+import type { PromptInjectionRouteSummaryWire } from '../../shared/prompt-injection-contract.js';
+import type { PrincipleReceipts } from './ReceiptsConsoleModel.js';
+export interface ExaminerEvidenceDeliverySample {
+    evidenceId: string;
+    recordedAt: string;
+    sourceKind: string;
+    confirmation: string;
+    outcome: string;
+    targetKind: string;
+}
+export interface ExaminerEvidenceApplicationSample {
+    evidenceId: string;
+    recordedAt: string;
+    sourceKind: string;
+    proofMethod: string;
+    action: string;
+}
+export interface ExaminerEvidenceRecordSample {
+    evidenceId: string;
+    recordedAt: string;
+    sourceKind: string;
+    summary: string;
+}
+/** P1-3: per-kind pagination truth, passed through verbatim from the audit. */
+export interface ExaminerEvidenceKindPage {
+    hasMore: boolean;
+    nextCursor: {
+        recordedAt: string;
+        evidenceId: string;
+    } | null;
+}
+export interface ExaminerEvidenceAuditProjection {
+    status: 'ok' | 'degraded';
+    reason?: string;
+    nextAction?: string;
+    /** P1-3: LOADED counts (the audit page window) — never presented as totals. */
+    counts: {
+        deliveries: number;
+        applications: number;
+        episodes: number;
+        effects: number;
+        outcomes: number;
+    };
+    /** P1-3: pagination truth per kind — hasMore=true means MORE records exist. */
+    pages: Record<'delivery' | 'application' | 'behavior_episode' | 'effect' | 'outcome', ExaminerEvidenceKindPage>;
+    /** True when ANY kind reports hasMore — the UI shows a "more exist" band. */
+    anyHasMore: boolean;
+    /** Delivery confirmations observed in the audit window (never promoted). */
+    deliveryConfirmations: {
+        prepared: number;
+        submitted: number;
+        hostAccepted: number;
+        contextPresent: number;
+        runtimeLoaded: number;
+    };
+    /** Application proof split — agent claims are NOT runtime verification. */
+    applicationProof: {
+        agentClaimed: number;
+        runtimeVerified: number;
+    };
+    unresolvedReferences: number;
+    capabilityDeclarations: {
+        hostKind: string;
+        capability: string;
+        status: string;
+        maxConfirmation?: string;
+        note?: string;
+    }[];
+    samples: {
+        deliveries: ExaminerEvidenceDeliverySample[];
+        applications: ExaminerEvidenceApplicationSample[];
+        episodes: ExaminerEvidenceRecordSample[];
+        effects: ExaminerEvidenceRecordSample[];
+        outcomes: ExaminerEvidenceRecordSample[];
+    };
+    asOf: string | null;
+    coverage: ReceiptEvidenceCoverage | null;
+}
+export interface ExaminerPromptActivationRow {
+    activationId: string;
+    action: string;
+    status: string;
+    activatedAt: string | null;
+    deactivatedAt: string | null;
+    enforcement?: string;
+    warning?: string;
+}
+export interface ExaminerRuleCodeRow {
+    activationId: string;
+    action: string;
+    mode?: string;
+    status: string;
+    enforcement?: string;
+    targetRef: string;
+    warning?: string;
+}
+export interface ExaminerActivationProjection {
+    status: 'ok' | 'degraded';
+    reason?: string;
+    nextAction?: string;
+    prompt: ExaminerPromptActivationRow[];
+    ruleCode: ExaminerRuleCodeRow[];
+    promptInjectionRoute?: PromptInjectionRouteSummaryWire;
+}
+export interface ExaminerInjectionProjection {
+    status: 'available' | 'degraded';
+    /** Present when no status could be computed at all (fail-loud, rc-9). */
+    globalReason?: string;
+    statuses: {
+        activationId: string;
+        status: string;
+        inCurrentWindow?: boolean;
+        costChars?: number;
+        budget?: number;
+        route?: string;
+        reason?: string;
+    }[];
+    budgetProvenance?: {
+        capacitySource?: string;
+        capacityStatus?: string;
+        contextWindowTokens?: number;
+        policyVersion?: string;
+        fallbackReason?: string;
+    };
+    warnings: string[];
+}
+export interface ExaminerPrincipleEvidence {
+    asOf: string;
+    principleId: string;
+    principle: {
+        id: string;
+        text: string;
+        status: string;
+        ruleCount: number;
+        derivedFromPainIds: string[];
+        evaluability: string;
+        painPreventedCount: number;
+        adherenceRate: number;
+        valueScore: number;
+        runtimeDeactivated?: boolean;
+        /** Asset status ≠ runtime activation — pinned for the UI (SPEC §4.1). */
+        ledgerStatusNote: string;
+    };
+    activation: ExaminerActivationProjection;
+    injection: ExaminerInjectionProjection;
+    receipts: PrincipleReceipts;
+    evidenceAudit: ExaminerEvidenceAuditProjection;
+}
+export declare class ExaminerEvidenceModel {
+    private readonly workspaceDir;
+    constructor(workspaceDir: string);
+    /**
+     * One principle's full production-evidence aggregate. The caller has
+     * already validated the principle id charset; a principle that is not in
+     * the ledger returns null (route answers 404 — never a fabricated entry).
+     */
+    getPrincipleEvidence(principleId: string): Promise<ExaminerPrincipleEvidence | null>;
+}

package/console/dist/server/models/ExaminerEvidenceModel.js

@@ -0,0 +1,274 @@
+/**
+ * SPEC-PD-EXAMINER-001 v0.10.1 §4/§5 — Examiner production-evidence read model.
+ *
+ * A pure DERIVED projection: composes the existing console models and the
+ * host-runtime production projection into ONE per-principle evidence
+ * aggregate for the Examiner Principle Evaluation page. It owns no storage,
+ * writes nothing, and creates no second evidence truth (P4) — every fact is
+ * read through the authority that already owns it:
+ *
+ *   ledger          PrinciplesConsoleModel (principle_training_state.json)
+ *   activations     ActivationsConsoleModel (state.db activations + artifacts)
+ *   prompt inject.  readPromptActivationInjectionStatuses (host-runtime,
+ *                   built on the SAME production projection the runtime uses)
+ *   receipts        ReceiptsConsoleModel (principle_applications + coverage)
+ *   evidence audit  ReceiptsConsoleModel.getEvidenceAudit
+ *                   (SqliteInterventionEvidenceStore.readAuditRelations)
+ *
+ * Honesty contract (SPEC §4.3/§5.5):
+ *   - Projection / Submitted / Presence / Context Present / Runtime Loaded
+ *     stay DISTINCT — nothing is promoted.
+ *   - `agent_claimed` never becomes `runtime_verified`.
+ *   - Unavailable evidence is reported as DEGRADED/UNAVAILABLE with reason
+ *     and nextAction — empty data is never presented as "zero events".
+ *   - RuleHost evidence is surfaced as its own lane; it is never counted as
+ *     prompt-consumption evidence.
+ */
+import { readPromptActivationInjectionStatuses } from '@principles/host-runtime';
+import { ReceiptsConsoleModel } from './ReceiptsConsoleModel.js';
+import { PrinciplesConsoleModel, CorePrincipleNotGovernedError } from './PrinciplesConsoleModel.js';
+import { ActivationsConsoleModel } from './ActivationsConsoleModel.js';
+/** Bounded per-kind sample shown on the evaluation page (audit stays paged). */
+const AUDIT_SAMPLE_LIMIT = 5;
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function stringOrUndefined(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+/**
+ * Bounded episode/effect/outcome sample summary from the payload (untrusted).
+ * Shortened by CODE POINTS — a UTF-16 slice can split a surrogate pair and
+ * render U+FFFD in the Owner-facing panel (EP-11).
+ */
+function recordSummary(payload) {
+    if (!isRecord(payload))
+        return '';
+    const candidate = payload.observationSummary ?? payload.actionSummary ?? payload.feedbackText ?? payload.resultSummary;
+    const text = typeof candidate === 'string' ? candidate : '';
+    const codePoints = Array.from(text);
+    return codePoints.length > 160 ? `${codePoints.slice(0, 157).join('')}…` : text;
+}
+export class ExaminerEvidenceModel {
+    workspaceDir;
+    constructor(workspaceDir) {
+        this.workspaceDir = workspaceDir;
+    }
+    /**
+     * One principle's full production-evidence aggregate. The caller has
+     * already validated the principle id charset; a principle that is not in
+     * the ledger returns null (route answers 404 — never a fabricated entry).
+     */
+    async getPrincipleEvidence(principleId) {
+        const asOf = new Date().toISOString();
+        // 1. Ledger facts (the authoritative principle asset source).
+        const principlesModel = new PrinciplesConsoleModel(this.workspaceDir);
+        let detailOutput;
+        try {
+            detailOutput = await principlesModel.getPrincipleDetail(principleId);
+        }
+        catch (error) {
+            // Core principles are not workspace-governed objects: they have no
+            // production-evidence aggregate here, so the route answers the same
+            // 404 as any other principle absent from the workspace ledger.
+            if (error instanceof CorePrincipleNotGovernedError)
+                return null;
+            throw error;
+        }
+        if (!detailOutput)
+            return null;
+        const detail = detailOutput.principle;
+        // 2. Activation lifecycle rows (prompt + RuleCode lanes) — full reuse of
+        //    the activations read model, filtered to this principle. A read error
+        //    degrades the ACTIVATION lane only: the ledger facts below still
+        //    answer, and the lane carries reason + nextAction (never "zero").
+        const activationsModel = new ActivationsConsoleModel(this.workspaceDir);
+        let activations;
+        try {
+            activations = await activationsModel.getActivations();
+        }
+        catch (error) {
+            activations = {
+                activations: [],
+                status: 'degraded',
+                reason: `activation read failed: ${error instanceof Error ? error.message : String(error)}`,
+                nextAction: 'check workspace .pd/state.db readability and the activation schema',
+            };
+        }
+        const rows = activations.activations.filter((row) => row.principleId === principleId);
+        const activation = {
+            status: activations.status,
+            reason: activations.reason,
+            nextAction: activations.nextAction,
+            promptInjectionRoute: activations.promptInjectionRoute,
+            prompt: rows
+                .filter((row) => row.channel === 'prompt')
+                .map((row) => ({
+                activationId: row.activationId,
+                action: row.action,
+                status: row.status,
+                activatedAt: row.activatedAt,
+                deactivatedAt: row.deactivatedAt,
+                enforcement: row.enforcement,
+                warning: row.warning,
+            })),
+            ruleCode: rows
+                .filter((row) => row.channel === 'code_tool_hook')
+                .map((row) => ({
+                activationId: row.activationId,
+                action: row.action,
+                mode: row.mode,
+                status: row.status,
+                enforcement: row.enforcement,
+                targetRef: row.targetRef,
+                warning: row.warning,
+            })),
+        };
+        // 3. Injection statuses from the SAME production projection the runtime
+        //    uses (route + budget provenance + per-activation single-item facts).
+        const injectionReport = await readPromptActivationInjectionStatuses({ workspaceDir: this.workspaceDir });
+        const targetStatuses = injectionReport.statuses.filter((row) => row.principleId === principleId);
+        const injection = {
+            status: injectionReport.globalReason ? 'degraded' : 'available',
+            globalReason: injectionReport.globalReason,
+            statuses: targetStatuses.map((row) => ({
+                activationId: row.activationId,
+                status: row.status,
+                inCurrentWindow: row.inCurrentWindow,
+                costChars: row.costChars,
+                budget: row.budget,
+                route: row.route,
+                reason: row.reason,
+            })),
+            budgetProvenance: injectionReport.budgetProvenance
+                ? {
+                    capacitySource: injectionReport.budgetProvenance.capacitySource,
+                    capacityStatus: injectionReport.budgetProvenance.capacityStatus,
+                    contextWindowTokens: injectionReport.budgetProvenance.contextWindowTokens,
+                    policyVersion: injectionReport.budgetProvenance.policyVersion,
+                    fallbackReason: injectionReport.budgetProvenance.fallbackReason,
+                }
+                : undefined,
+            warnings: injectionReport.warnings.slice(0, 20),
+        };
+        // 4. Receipts + 5. evidence audit through the existing receipts model.
+        const receiptsModel = new ReceiptsConsoleModel(this.workspaceDir);
+        const receipts = await receiptsModel.getPrincipleReceipts(principleId);
+        const audit = await receiptsModel.getEvidenceAudit({ type: 'principle', principleId });
+        const deliveryConfirmations = { prepared: 0, submitted: 0, hostAccepted: 0, contextPresent: 0, runtimeLoaded: 0 };
+        for (const record of audit.deliveries) {
+            const confirmation = stringOrUndefined(isRecord(record.payload) ? record.payload.confirmation : undefined);
+            if (confirmation === 'prepared')
+                deliveryConfirmations.prepared += 1;
+            else if (confirmation === 'submitted')
+                deliveryConfirmations.submitted += 1;
+            else if (confirmation === 'host_accepted')
+                deliveryConfirmations.hostAccepted += 1;
+            else if (confirmation === 'context_present')
+                deliveryConfirmations.contextPresent += 1;
+            else if (confirmation === 'runtime_loaded')
+                deliveryConfirmations.runtimeLoaded += 1;
+        }
+        const applicationProof = { agentClaimed: 0, runtimeVerified: 0 };
+        for (const record of audit.applications) {
+            const proof = stringOrUndefined(isRecord(record.payload) ? record.payload.proofMethod : undefined);
+            if (proof === 'runtime_verified')
+                applicationProof.runtimeVerified += 1;
+            else if (proof === 'agent_claimed')
+                applicationProof.agentClaimed += 1;
+        }
+        // P1-3: pagination truth rides through verbatim — the counts above are
+        // LOADED-window sizes, and hasMore per kind tells the Owner more records
+        // exist beyond this read.
+        const pages = {
+            delivery: { hasMore: audit.pages.delivery.hasMore, nextCursor: audit.pages.delivery.nextCursor },
+            application: { hasMore: audit.pages.application.hasMore, nextCursor: audit.pages.application.nextCursor },
+            behavior_episode: { hasMore: audit.pages.behavior_episode.hasMore, nextCursor: audit.pages.behavior_episode.nextCursor },
+            effect: { hasMore: audit.pages.effect.hasMore, nextCursor: audit.pages.effect.nextCursor },
+            outcome: { hasMore: audit.pages.outcome.hasMore, nextCursor: audit.pages.outcome.nextCursor },
+        };
+        const anyHasMore = Object.values(pages).some((page) => page.hasMore);
+        const evidenceAudit = {
+            status: audit.status,
+            reason: audit.reason,
+            nextAction: audit.nextAction,
+            counts: {
+                deliveries: audit.deliveries.length,
+                applications: audit.applications.length,
+                episodes: audit.episodes.length,
+                effects: audit.effects.length,
+                outcomes: audit.outcomes.length,
+            },
+            pages,
+            anyHasMore,
+            deliveryConfirmations,
+            applicationProof,
+            unresolvedReferences: audit.unresolvedReferences.length,
+            capabilityDeclarations: audit.capabilityDeclarations.slice(0, 12).map((declaration) => ({
+                hostKind: String(declaration.hostKind),
+                capability: String(declaration.capability),
+                status: String(declaration.status),
+                maxConfirmation: stringOrUndefined(declaration.maxConfirmation),
+                note: stringOrUndefined(declaration.note),
+            })),
+            samples: {
+                deliveries: audit.deliveries.slice(0, AUDIT_SAMPLE_LIMIT).map((record) => ({
+                    evidenceId: record.evidenceId,
+                    recordedAt: record.recordedAt,
+                    sourceKind: String(record.sourceKind),
+                    confirmation: stringOrUndefined(isRecord(record.payload) ? record.payload.confirmation : undefined) ?? 'unknown',
+                    outcome: stringOrUndefined(isRecord(record.payload) ? record.payload.outcome : undefined) ?? 'unknown',
+                    targetKind: stringOrUndefined(isRecord(record.payload) ? record.payload.targetKind : undefined) ?? 'unknown',
+                })),
+                applications: audit.applications.slice(0, AUDIT_SAMPLE_LIMIT).map((record) => ({
+                    evidenceId: record.evidenceId,
+                    recordedAt: record.recordedAt,
+                    sourceKind: String(record.sourceKind),
+                    proofMethod: stringOrUndefined(isRecord(record.payload) ? record.payload.proofMethod : undefined) ?? 'unknown',
+                    action: stringOrUndefined(isRecord(record.payload) ? record.payload.action : undefined) ?? 'unknown',
+                })),
+                episodes: audit.episodes.slice(0, AUDIT_SAMPLE_LIMIT).map((record) => ({
+                    evidenceId: record.evidenceId,
+                    recordedAt: record.recordedAt,
+                    sourceKind: String(record.sourceKind),
+                    summary: recordSummary(record.payload),
+                })),
+                effects: audit.effects.slice(0, AUDIT_SAMPLE_LIMIT).map((record) => ({
+                    evidenceId: record.evidenceId,
+                    recordedAt: record.recordedAt,
+                    sourceKind: String(record.sourceKind),
+                    summary: recordSummary(record.payload),
+                })),
+                outcomes: audit.outcomes.slice(0, AUDIT_SAMPLE_LIMIT).map((record) => ({
+                    evidenceId: record.evidenceId,
+                    recordedAt: record.recordedAt,
+                    sourceKind: String(record.sourceKind),
+                    summary: recordSummary(record.payload),
+                })),
+            },
+            asOf: audit.asOf,
+            coverage: audit.coverage ?? null,
+        };
+        return {
+            asOf,
+            principleId,
+            principle: {
+                id: detail.id,
+                text: detail.text,
+                status: detail.status,
+                ruleCount: detail.ruleCount,
+                derivedFromPainIds: detail.derivedFromPainIds,
+                evaluability: detail.evaluability,
+                painPreventedCount: detail.painPreventedCount,
+                adherenceRate: detail.adherenceRate,
+                valueScore: detail.valueScore,
+                runtimeDeactivated: detail.runtimeDeactivated,
+                ledgerStatusNote: 'ledger status is the ASSET lifecycle — it is not runtime activation; the runtime rows below are the activation truth',
+            },
+            activation,
+            injection,
+            receipts,
+            evidenceAudit,
+        };
+    }
+}

package/console/dist/server/models/ReceiptsConsoleModel.js

@@ -171,7 +171,21 @@ export class ReceiptsConsoleModel {
                     coverage: unreadCoverage('unavailable', 'ledger_table_missing', 'update_plugin'),
                 };
             }
-            throw err;
+            // An unreadable state.db (permissions, corruption) must degrade, not
+            // throw: the documented read-path contract is degraded-over-500, so the
+            // evidence route keeps its ledger facts and shows WHY receipts are absent.
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                status: 'degraded',
+                reason: `receipt ledger read failed: ${message}`,
+                nextAction: 'Run pd runtime diagnostics to check workspace .pd/state.db readability',
+                principleId,
+                effectCount: 0,
+                presenceCount: 0,
+                lastEffectAt: null,
+                events: [],
+                coverage: unreadCoverage('unavailable', 'receipt_read_failed', 'run_runtime_diagnostics'),
+            };
         }
         finally {
             conn.close();

package/console/dist/server/routes/examiner-executor.d.ts

@@ -149,8 +149,6 @@ export declare function writableRootProblem(roots: StudyRoots): string | null;
  * mutation — a check done only at startup is not evidence about now.
  */
 export declare function writableStudyDirProblem(roots: StudyRoots, studyDir: string): string | null;
-/** Study status projection (manifest + ledger settlement counts + report status). */
-export declare function studyStatusPayload(studyDir: string): Record<string, unknown>;
 /** Read-only Report V2 payload + replay verification. */
 export declare function studyReportPayload(modules: LabModules, studyDir: string): Record<string, unknown> | null;
 export declare class ExaminerPreflightBlockedError extends Error {
@@ -179,7 +177,9 @@ export declare function preflightCheck(modules: LabModules, studyDir: string, co
  * before RUN_STARTED — but a blocker here means the runner is not called at
  * all, so no attempt is reserved and no actor is created.
  */
-export declare function offlineStudyPass(modules: LabModules, studyDir: string, context?: StudyDirContext): Promise<{
+export declare function offlineStudyPass(modules: LabModules, studyDir: string, context?: StudyDirContext, admissionCheck?: (input: {
+    studyDir: string;
+}) => void | Promise<void>): Promise<{
     units: Record<string, unknown>[];
 }>;
 export declare function reportMaterialize(modules: LabModules, studyDir: string, now: string, context: StudyDirContext | undefined, canWrite: () => {
@@ -217,6 +217,26 @@ export type CreateStudyInputs = {
     }[];
     repetitionsPerCase: number;
 };
+/**
+ * v0.10.1 host-backed inputs (SPEC §4/§6/§7): the frozen production snapshot,
+ * the runtime-derived RuleCode facts and the real pain lineage. All gathered
+ * by the caller (examiner-study-inputs) from existing authorities; this layer
+ * only freezes them into the study directory. Suite CASES are compiled here
+ * with the minted study handle (case ids are study-scoped).
+ */
+export type HostBackedStudyInputs = {
+    productionSnapshot: Record<string, unknown>;
+    ruleCodeFacts: {
+        ruleCodes: {
+            ruleCodeId: string;
+            principleId: string;
+            baselineState: 'ON' | 'OFF';
+        }[];
+        principleRuleCodeIndependence: boolean | null;
+        targetRuleCodeCount: number;
+    };
+    painRefs: string[];
+};
 /** Server-minted study handle + directory (crypto-random; never request-derived). */
 export declare function mintStudyHandle(roots: StudyRoots): {
     studyId: string;
@@ -241,6 +261,10 @@ export declare function materializeConsoleStudy(modules: LabModules, labRoot: st
         ruleCount?: number;
     }[];
     repetitionsPerCase: number;
+    /** v0.10.1: catalog suite key (validated by the caller against the fixed list). */
+    suiteKey?: string;
+    /** v0.10.1: host-backed inputs (production snapshot / RuleCode facts / pain refs). */
+    hostBacked?: HostBackedStudyInputs;
 }): Promise<{
     studyId: string;
     targetPrincipleId: string;
@@ -253,8 +277,20 @@ export declare function materializeConsoleStudy(modules: LabModules, labRoot: st
  * receives already-validated server data only. Synthetic calibration cases
  * with SYNTHETIC_OFFLINE gold provenance — offline contract validation,
  * never real-host behavior.
+ *
+ * v0.10.1: when `hostBacked` inputs are supplied, the study freezes the
+ * caller-selected suite cases, the RUNTIME-derived RuleCode facts and the
+ * real pain lineage, and `production-snapshot.json` records where the A/B
+ * starting point differs from production (SPEC §4.4/§6.4). The frozen
+ * binding files the lab verifies are unchanged — the snapshot is an
+ * additional frozen fact, hashed by nothing that the runner recomputes, so
+ * appending it after writeExaminerStudyArtifacts keeps every existing
+ * verification intact (events.jsonl rides the same discipline).
  */
-export declare function materializeOfflineStudy(modules: LabModules, labRoot: string, inputs: CreateStudyInputs): Promise<{
+export declare function materializeOfflineStudy(modules: LabModules, labRoot: string, inputs: CreateStudyInputs & {
+    suiteKey?: string;
+    hostBacked?: HostBackedStudyInputs;
+}): Promise<{
     manifest: Record<string, unknown>;
     pairAssignment: Record<string, unknown>;
 }>;