create-principles-disciple 1.146.8 → 1.146.9

package/console/lab/lib/challenge-openclaw-host.mjs

@@ -138,6 +138,23 @@ function probeOpenclawVersion(openclawBin, openclawPrefixArgs, versionProbe) {
   return version;
 }
 
+/**
+ * SPEC-PD-EXAMINER-001 v0.10.1 §12.3 — read-only CLI reachability probe for
+ * the Console host dry-run. Same local `--version` process as transport
+ * creation, but NEVER throws and never creates anything: the result is a
+ * structured verdict the dry-run can show as a Gate 2 prerequisite. The
+ * binary defaults to the FIXED literal 'openclaw'; callers that pass an
+ * executable path take responsibility for it (the console never does).
+ */
+export function probeOpenClawCli({ openclawBin = 'openclaw', openclawPrefixArgs = [], versionProbe = null } = {}) {
+  try {
+    const version = probeOpenclawVersion(openclawBin, openclawPrefixArgs, versionProbe);
+    return { ok: true, cliVersion: version, reason: null };
+  } catch (err) {
+    return { ok: false, cliVersion: null, reason: err && err.message ? err.message : String(err) };
+  }
+}
+
 /** Same suffix discipline as verifyF2ProbeEvidence.sameModel — a provider-
  *  prefixed model id ("zai/glm-5.3-flash") matches its bare id. */
 const sameModel = (a, b) => a === b || (typeof a === 'string' && typeof b === 'string' && (a.endsWith(`/${b}`) || b.endsWith(`/${a}`)));

package/console/lab/lib/challenge-runner.mjs

@@ -410,6 +410,7 @@ export async function runChallengeStudy({
   owner = 'challenge-runner',
   deps = {},
   execution = null,
+  admissionCheck = null,
 }) {
   const declaredMode = execution && execution.mode !== undefined ? execution.mode : 'offline-stub';
   if (!RUNNER_EXECUTION_MODES.includes(declaredMode)) {
@@ -452,6 +453,14 @@ export async function runChallengeStudy({
   // unchanged. Same run-scoped discipline as the unknown streak.
   let consecutiveCapacityFailures = 0;
   try {
+    // P1-3 (offline↔async single-active): the caller-injected admission check
+    // runs FIRST under this study write lock — before RUN_STARTED, before any
+    // attempt reservation and before any actor is constructed. A refusal here
+    // throws, the lock is released by the catch below, and the ledger keeps no
+    // half-started run.
+    if (typeof admissionCheck === 'function') {
+      await admissionCheck({ studyDir });
+    }
     // P1-4 server-enforced readiness: identity/path ownership are the caller's
     // gate (the console resolves the directory from its own enumeration and
     // verifies the write permission marker); the FROZEN study is re-verified

package/console/lab/lib/examiner-study.mjs

@@ -455,6 +455,7 @@ export function buildExaminerStudyManifest({
   invalidationPolicy,
   armPayloadHashes = null,
   authorizationRef = null,
+  productionSnapshotHash = null,
 }) {
   if (!text(studyId)) throw new Error('buildExaminerStudyManifest: studyId required');
   if (!/^[A-Z0-9][A-Z0-9-]*$/.test(studyId)) throw new Error(`buildExaminerStudyManifest: studyId '${studyId}' must be UPPER-CASE with digits/dashes`);
@@ -511,6 +512,11 @@ export function buildExaminerStudyManifest({
     analysisPlanHash: hashOfCanonical(analysisPlan),
     invalidationPolicyHash: hashOfCanonical(invalidationPolicy),
     authorizationRef,
+    // v0.10.1 P1-1: the frozen production snapshot rides INSIDE the manifest
+    // (and therefore inside the manifestHash → binding → anchor chain).
+    // Conditional like armPayloadHashes so a v0.9-shaped manifest stays
+    // byte-identical with the historical field set.
+    ...(productionSnapshotHash ? { productionSnapshotHash } : {}),
   };
   return { ...core, manifestHash: hashOfCanonical(core) };
 }
@@ -730,6 +736,36 @@ export function computeExaminerStudyBindings(studyDir) {
   if (hashes.examinerManifestHash?.value !== manifest.manifestHash) push('hashes.examinerManifestHash != manifest.manifestHash');
   if (hashes.pairAssignmentHash?.value !== pair.assignmentHash) push('hashes.pairAssignmentHash != pair assignment hash');
 
+  // --- production snapshot (v0.10.1 §4.4/§6.4) ------------------------------
+  // The frozen production baseline is PART of the preregistration evidence:
+  // when the file exists it is hash-bound to the manifest and the binding; a
+  // missing file beside a manifest that declares a snapshot hash is drift;
+  // no file AND no manifest field is the v0.9 legacy shape (verified studies
+  // keep recomputing the exact historical binding). The snapshot content
+  // carries no self-hash, so the chain snapshot→manifestHash→binding→anchor
+  // has no cycle.
+  let productionSnapshotHash = null;
+  const snapshotPath = path.join(studyDir, 'production-snapshot.json');
+  if (fs.existsSync(snapshotPath)) {
+    let snapshotParsed;
+    try {
+      snapshotParsed = JSON.parse(fs.readFileSync(snapshotPath, 'utf8'));
+    } catch (e) {
+      push(`production-snapshot.json is not valid JSON: ${e.message}`);
+      snapshotParsed = null;
+    }
+    if (snapshotParsed !== null && typeof snapshotParsed === 'object' && !Array.isArray(snapshotParsed)) {
+      productionSnapshotHash = hashOfCanonical(snapshotParsed);
+      if (manifest.productionSnapshotHash !== productionSnapshotHash) {
+        push('production-snapshot.json hash != manifest.productionSnapshotHash — the frozen production baseline was modified after freezing');
+      }
+    } else if (snapshotParsed !== null) {
+      push('production-snapshot.json must be a JSON object');
+    }
+  } else if (manifest.productionSnapshotHash !== undefined) {
+    push('manifest.productionSnapshotHash declared but production-snapshot.json is missing — the frozen production baseline cannot be verified');
+  }
+
   const binding = {
     schema: PREREG_BINDING_SCHEMA,
     studyId: manifest.studyId ?? null,
@@ -749,6 +785,9 @@ export function computeExaminerStudyBindings(studyDir) {
     // definition after freezing (even with every file re-hashed) moves this.
     primaryEndpointHash: hashOfCanonical(manifest.primaryEndpoint ?? null),
     armPayloadHashes,
+    // P1-1: present ONLY when the study freezes a production snapshot — the
+    // v0.9 historical binding field set stays byte-identical otherwise.
+    ...(productionSnapshotHash ? { productionSnapshotHash } : {}),
     plannedPairs: manifest.plannedPairs ?? null,
     repetitionsPerCase: manifest.repetitionsPerCase ?? null,
   };
@@ -961,9 +1000,19 @@ export function writeExaminerStudyArtifacts(input) {
     analysisPlan, invalidationPolicy, hostManifest, modelManifest,
     scorerVersion, seed, repetitionsPerCase, authorizationRef = null,
     goldProvenance = 'SYNTHETIC_OFFLINE',
+    productionSnapshot = null,
   } = input;
   if (!studyDir || typeof studyDir !== 'string') throw new Error('writeExaminerStudyArtifacts: studyDir required');
   if (fs.existsSync(studyDir)) throw new Error(`writeExaminerStudyArtifacts: '${studyDir}' already exists — a study identity is created once; overwriting is refused (create a NEW study id instead)`);
+  // P1-1/rc-1: the production snapshot arrives as external runtime data. Freeze
+  // it as the JSON it will be STORED as: canonical hashing keeps object keys
+  // whose value is `undefined`, while JSON serialization drops them — hashing
+  // the raw in-memory object would disagree with the file on disk and report
+  // false drift. Binding verification hashes the written bytes; the manifest
+  // must hash the same representation.
+  const frozenProductionSnapshot = productionSnapshot === null
+    ? null
+    : JSON.parse(JSON.stringify(productionSnapshot));
   const frozenArea = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'challenge-studies');
   const resolved = path.resolve(studyDir);
   const norm = (p) => (process.platform === 'win32' ? p.toLowerCase() : p);
@@ -1011,6 +1060,9 @@ export function writeExaminerStudyArtifacts(input) {
     invalidationPolicy,
     armPayloadHashes: { control: armPayloads.arms.control.payloadHash, treatment: armPayloads.arms.treatment.payloadHash },
     authorizationRef,
+    // P1-1: the snapshot is gathered BEFORE the freeze and rides the full
+    // manifest → binding → anchor chain (no post-freeze append can touch it).
+    ...(frozenProductionSnapshot !== null ? { productionSnapshotHash: hashOfCanonical(frozenProductionSnapshot) } : {}),
   });
   const prereg = {
     studyId: input.studyId,
@@ -1046,6 +1098,9 @@ export function writeExaminerStudyArtifacts(input) {
   writeJson('scoring-contract.json', scoringContract);
   writeJson('principle-frozen.json', principleFrozen);
   writeJson('pain-mechanism-mapping.json', mapping);
+  // P1-1: the production baseline freezes WITH the study (inside the binding
+  // verification below) — not as a post-freeze append.
+  if (frozenProductionSnapshot !== null) writeJson('production-snapshot.json', frozenProductionSnapshot);
   writeJson('input-manifest.json', { expectedSourceHashes: { principleContentHash: hashOfCanonical(principleFrozen.contentJson) } });
   writeJson('hashes.json', {
     preregistrationHash: { value: hashOfCanonical(prereg) },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.146.8",
+  "version": "1.146.9",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {
@@ -98,5 +98,5 @@
   "pd": {
     "bundledPluginVersion": "2.2.13"
   },
-  "gitHead": "9ef8d607d51cea885249077634df3b4126919a0d"
+  "gitHead": "8e0cdc607ee5d25e0b66a0655a6e0ce033a1fe99"
 }

package/release-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.146.8",
+  "version": "1.146.9",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {