create-principles-disciple 1.146.9 → 1.147.0

package/host-runtime/dist/index.d.ts

@@ -16,6 +16,8 @@ export * from './rule-implementation-runtime.js';
 export * from './production-pain-evidence.js';
 export * from './governance-observation-store.js';
 export * from './governance-signal-admission.js';
+export * from './signal-classifier.js';
+export * from './signal-stage2-cycle.js';
 export * from './host-liveness-contract.js';
 export * from './internalization-consumer-governance.js';
 export * from './internalization-consumer-cycle.js';

package/host-runtime/dist/index.js

@@ -26,6 +26,8 @@ export * from './rule-implementation-runtime.js';
 export * from './production-pain-evidence.js';
 export * from './governance-observation-store.js';
 export * from './governance-signal-admission.js';
+export * from './signal-classifier.js';
+export * from './signal-stage2-cycle.js';
 export * from './host-liveness-contract.js';
 // PRI-624 Slice C: shared internalization consumer execution (OpenClaw
 // auto-consumer + Companion workspace worker call the same cycle).

package/host-runtime/dist/signal-classifier.d.ts

@@ -0,0 +1,46 @@
+import { type LlmClassificationResult } from '@principles/core/runtime-v2';
+export interface SignalClassifierCallOptions {
+    /**
+     * Per-call timeout override. The worker passes the cycle's REMAINING
+     * aggregate budget so the real adapter request (startRun/poll deadline)
+     * uses that budget instead of relying on an outer Promise race.
+     */
+    readonly timeoutMs?: number;
+}
+export type SignalLlmClassifier = (text: string, options?: SignalClassifierCallOptions) => Promise<LlmClassificationResult | null>;
+export interface SignalClassifierProfile {
+    readonly provider: string;
+    readonly model: string;
+    readonly apiKeyEnv: string;
+    readonly timeoutMs: number;
+    readonly maxTokens?: number;
+    readonly baseUrl?: string;
+}
+export interface SignalClassifierLog {
+    (event: string, detail: string): void;
+}
+export interface CreateSignalClassifierOptions {
+    readonly log?: SignalClassifierLog;
+    readonly timeoutMs?: number;
+}
+/** Build the classifier from an already-resolved profile (no config I/O). */
+export declare function createSignalLlmClassifier(profile: SignalClassifierProfile, workspaceDir: string, options?: CreateSignalClassifierOptions): SignalLlmClassifier;
+export type SignalClassifierResolution = {
+    ok: true;
+    classifier: SignalLlmClassifier;
+    profile: SignalClassifierProfile;
+} | {
+    ok: false;
+    reason: string;
+    nextAction: string;
+    readiness: 'disabled' | 'needs_setup' | 'config_malformed';
+};
+/**
+ * Resolve the `signalCollector` internal agent's pi-ai profile from
+ * `.pd/config.yaml` and build the classifier. This is the ONE resolution path
+ * for the Codex/WorkBuddy workers and the OpenClaw plugin factory (which adds
+ * its own bounded warning on top).
+ */
+export declare function createSignalClassifierForWorkspace(workspaceDir: string, options?: CreateSignalClassifierOptions & {
+    readonly flagId?: string;
+}): SignalClassifierResolution;

package/host-runtime/dist/signal-classifier.js

@@ -0,0 +1,167 @@
+/**
+ * Shared Stage-2 signal classifier factory (SPEC v0.3 §3.4 / B4).
+ *
+ * ONE implementation of the pi-ai classifier call for every host:
+ * OpenClaw's plugin factory, the Codex worker and the WorkBuddy worker all
+ * consume this instead of re-implementing startRun/pollRun/fetchOutput.
+ *
+ * The classifier contract is core-owned: `buildLlmPrompt`,
+ * `signal-classification-output-v1` and `resolveLlmClassificationPayload`
+ * come from `@principles/core/runtime-v2`. This module only owns acquisition:
+ * reading the signalCollector runtime profile and calling the adapter.
+ *
+ * No second model runtime is introduced (ADR-0029: pi-ai is the only backend).
+ */
+import path from 'node:path';
+import { PiAiRuntimeAdapter, SIGNAL_CLASSIFIER_SYSTEM_PROMPT, buildLlmPrompt, resolveLlmClassificationPayload, safeStringifyPreview, } from '@principles/core/runtime-v2';
+import { loadPdConfigForPlugin } from './pd-config.js';
+/** Build the classifier from an already-resolved profile (no config I/O). */
+export function createSignalLlmClassifier(profile, workspaceDir, options = {}) {
+    const timeoutMs = options.timeoutMs ?? profile.timeoutMs;
+    const adapter = new PiAiRuntimeAdapter({
+        provider: profile.provider,
+        model: profile.model,
+        apiKeyEnv: profile.apiKeyEnv,
+        timeoutMs,
+        maxTokens: profile.maxTokens,
+        baseUrl: profile.baseUrl,
+        workspace: workspaceDir,
+        // Stage-2 emits a 5-field JSON. json_mode_first avoids depending on the
+        // provider's tool-call support; one repair attempt bounds latency.
+        outputPathStrategy: 'json_mode_first',
+        maxRepairAttempts: 1,
+    });
+    return async (text, callOptions) => {
+        const prompt = buildLlmPrompt(text);
+        // v0.3.1 §2.2: the effective timeout is the worker's remaining budget,
+        // and it is handed to the adapter itself (not only to an outer race).
+        const effectiveTimeoutMs = callOptions?.timeoutMs ?? timeoutMs;
+        try {
+            const handle = await adapter.startRun({
+                agentSpec: { agentId: 'signal-collector', schemaVersion: '1' },
+                inputPayload: { prompt },
+                contextItems: [],
+                timeoutMs: effectiveTimeoutMs,
+                outputSchemaRef: 'signal-classification-output-v1',
+                systemPrompt: SIGNAL_CLASSIFIER_SYSTEM_PROMPT,
+            });
+            let status = await adapter.pollRun(handle.runId);
+            const deadline = performance.now() + effectiveTimeoutMs;
+            while (status.status === 'running' && performance.now() < deadline) {
+                await new Promise((resolve) => setTimeout(resolve, 500));
+                status = await adapter.pollRun(handle.runId);
+            }
+            if (status.status !== 'succeeded') {
+                options.log?.('SIGNAL_LLM_TIMEOUT', JSON.stringify({ status: status.status }));
+                return null;
+            }
+            const output = await adapter.fetchOutput(handle.runId);
+            const resolved = resolveLlmClassificationPayload(output?.payload);
+            if (resolved.path === 'structured' && resolved.value)
+                return resolved.value;
+            if ((resolved.path === 'legacy_string' || resolved.path === 'legacy_envelope') && resolved.value) {
+                options.log?.('SIGNAL_LLM_LEGACY_STRING_PAYLOAD', `adapter payload path=${resolved.path}`);
+                return resolved.value;
+            }
+            options.log?.('SIGNAL_LLM_PARSE_FAIL', `unusable classifier payload path=${resolved.path}: ${safeStringifyPreview(output?.payload)}`);
+            return null;
+        }
+        catch (error) {
+            options.log?.('SIGNAL_LLM_FAILED', String(error).slice(0, 200));
+            return null;
+        }
+    };
+}
+/**
+ * Resolve the `signalCollector` internal agent's pi-ai profile from
+ * `.pd/config.yaml` and build the classifier. This is the ONE resolution path
+ * for the Codex/WorkBuddy workers and the OpenClaw plugin factory (which adds
+ * its own bounded warning on top).
+ */
+export function createSignalClassifierForWorkspace(workspaceDir, options = {}) {
+    const configResult = loadPdConfigForPlugin(workspaceDir);
+    if (!configResult.ok) {
+        return {
+            ok: false,
+            readiness: 'config_malformed',
+            reason: `Config validation failed: ${configResult.errors.map((error) => error.reason).join('; ')}`,
+            nextAction: configResult.errors[0]?.nextAction ?? 'Fix .pd/config.yaml and retry',
+        };
+    }
+    const { config } = configResult.effective;
+    const flagId = options.flagId ?? 'signal_collector';
+    const agentName = 'signalCollector';
+    const feature = config.features[flagId];
+    if (!feature?.enabled) {
+        return {
+            ok: false,
+            readiness: 'disabled',
+            reason: `${flagId} is disabled in .pd/config.yaml`,
+            nextAction: `Enable it in the existing "features:" block as ${flagId}: {enabled: true}`,
+        };
+    }
+    const agent = config.internalAgents.agents[agentName];
+    if (!agent?.enabled) {
+        return {
+            ok: false,
+            readiness: 'disabled',
+            reason: `internalAgents.agents.${agentName}.enabled is false`,
+            nextAction: `Enable internalAgents > agents > ${agentName} > enabled: true`,
+        };
+    }
+    const runtimeProfileId = agent.runtimeProfile ?? config.internalAgents.defaultRuntime;
+    const profile = config.runtimeProfiles[runtimeProfileId];
+    if (!profile) {
+        return {
+            ok: false,
+            readiness: 'needs_setup',
+            reason: `Runtime profile '${runtimeProfileId}' not found`,
+            nextAction: `Add runtime profile '${runtimeProfileId}' to runtimeProfiles`,
+        };
+    }
+    if (profile.type !== 'pi-ai') {
+        return {
+            ok: false,
+            readiness: 'needs_setup',
+            reason: `Runtime profile '${runtimeProfileId}' is '${profile.type}', not pi-ai`,
+            nextAction: 'ADR-0029 requires a pi-ai runtime profile for signal classification',
+        };
+    }
+    if (!profile.apiKeyEnv) {
+        return {
+            ok: false,
+            readiness: 'needs_setup',
+            reason: `pi-ai profile '${runtimeProfileId}' missing apiKeyEnv`,
+            nextAction: `Add apiKeyEnv to runtime profile '${runtimeProfileId}'`,
+        };
+    }
+    if (!profile.provider || !profile.model) {
+        return {
+            ok: false,
+            readiness: 'needs_setup',
+            reason: `pi-ai profile '${runtimeProfileId}' missing provider/model`,
+            nextAction: `Set provider and model on runtime profile '${runtimeProfileId}'`,
+        };
+    }
+    if (!Object.hasOwn(process.env, profile.apiKeyEnv) || !process.env[profile.apiKeyEnv]) {
+        return {
+            ok: false,
+            readiness: 'needs_setup',
+            reason: `Environment variable '${profile.apiKeyEnv}' is not set or empty`,
+            nextAction: `Set the environment variable '${profile.apiKeyEnv}' with a valid API key`,
+        };
+    }
+    const resolved = {
+        provider: profile.provider,
+        model: profile.model,
+        apiKeyEnv: profile.apiKeyEnv,
+        timeoutMs: options.timeoutMs ?? profile.timeoutMs ?? 60_000,
+        ...(profile.maxTokens !== undefined ? { maxTokens: profile.maxTokens } : {}),
+        ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
+    };
+    return {
+        ok: true,
+        profile: resolved,
+        classifier: createSignalLlmClassifier(resolved, path.resolve(workspaceDir), options),
+    };
+}

package/host-runtime/dist/signal-stage2-cycle.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Bounded Stage-2 correction review step shared by the Codex and WorkBuddy
+ * workers (SPEC v0.3 §4.4.7 / v0.3.1 §2).
+ *
+ * Contract:
+ * - runs at the END of the worker cycle (never ahead of the Diagnostician);
+ * - at most 2 candidates per cycle;
+ * - one aggregate wall-clock budget (default 60s), checked before each
+ *   candidate and clamped into the single classification timeout;
+ * - serial, CAS-claimed candidates; no new worker process, no new flag.
+ *
+ * The classifier itself comes from `createSignalClassifierForWorkspace`
+ * (B4). A missing classifier does NOT fail the cycle: candidates with a
+ * durable review result are still settled without any LLM call.
+ */
+import type { SignalLlmClassifier } from './signal-classifier.js';
+export interface Stage2CorrectionCycleReport {
+    readonly ok: boolean;
+    readonly classifier: 'used' | 'unavailable' | 'disabled';
+    readonly claimed: number;
+    readonly admitted: number;
+    readonly resolvedNone: number;
+    readonly abandoned: number;
+    readonly stillPending: number;
+    readonly skipped: number;
+    readonly expired: number;
+    readonly durationMs: number;
+    readonly reason?: string;
+    readonly nextAction?: string;
+    readonly degradations: readonly string[];
+}
+export interface Stage2CorrectionCycleInput {
+    readonly workspaceDir: string;
+    readonly classifier: SignalLlmClassifier | null;
+    readonly classifierState?: 'used' | 'unavailable' | 'disabled';
+    readonly maxCandidates?: number;
+    readonly aggregateBudgetMs?: number;
+    readonly classificationTimeoutMs?: number;
+    readonly now?: Date;
+    readonly onEvent?: (event: string, payloadJson: string) => void;
+}
+export declare function runStage2CorrectionCycle(input: Stage2CorrectionCycleInput): Promise<Stage2CorrectionCycleReport>;

package/host-runtime/dist/signal-stage2-cycle.js

@@ -0,0 +1,184 @@
+import { claimPendingCorrectionCandidates, recordPendingCorrectionReview, releasePendingCorrectionClaim, settlePendingCorrection, } from './governance-signal-admission.js';
+const DEFAULT_MAX_CANDIDATES = 2;
+const DEFAULT_AGGREGATE_BUDGET_MS = 60_000;
+const DEFAULT_CLASSIFICATION_TIMEOUT_MS = 60_000;
+function withTimeout(promise, timeoutMs) {
+    if (timeoutMs <= 0)
+        return Promise.resolve(null);
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(null), timeoutMs);
+        void promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, () => {
+            clearTimeout(timer);
+            resolve(null);
+        });
+    });
+}
+function emptyReport(classifier, reason, nextAction) {
+    return {
+        ok: reason === undefined,
+        classifier,
+        claimed: 0,
+        admitted: 0,
+        resolvedNone: 0,
+        abandoned: 0,
+        stillPending: 0,
+        skipped: 0,
+        expired: 0,
+        durationMs: 0,
+        ...(reason !== undefined ? { reason } : {}),
+        ...(nextAction !== undefined ? { nextAction } : {}),
+        degradations: [],
+    };
+}
+export async function runStage2CorrectionCycle(input) {
+    const classifierState = input.classifierState ?? (input.classifier === null ? 'unavailable' : 'used');
+    // Monotonic clock for the aggregate budget; wall clock stays for DB/TTL.
+    const startedAt = performance.now();
+    const now = input.now ?? new Date();
+    const maxCandidates = Math.min(Math.max(input.maxCandidates ?? DEFAULT_MAX_CANDIDATES, 1), DEFAULT_MAX_CANDIDATES);
+    const budgetMs = Math.max(0, input.aggregateBudgetMs ?? DEFAULT_AGGREGATE_BUDGET_MS);
+    const classificationTimeoutMs = Math.max(0, input.classificationTimeoutMs ?? DEFAULT_CLASSIFICATION_TIMEOUT_MS);
+    const claimedResult = claimPendingCorrectionCandidates({ workspaceDir: input.workspaceDir, limit: maxCandidates, now });
+    if (!claimedResult.ok) {
+        return {
+            ...emptyReport(classifierState, claimedResult.reason, claimedResult.nextAction),
+            durationMs: Math.round(performance.now() - startedAt),
+            degradations: [claimedResult.reason],
+        };
+    }
+    let admitted = 0;
+    let resolvedNone = 0;
+    let abandoned = 0;
+    let stillPending = 0;
+    let skipped = 0;
+    const degradations = [];
+    /**
+     * Release our claim when classification has NOT started. The release is
+     * guarded inside gsa (never clears a durable reviewResult, CAS on the
+     * fencing token), so a concurrent worker's state cannot be touched.
+     */
+    const releaseClaim = (candidate) => {
+        if (candidate.claimToken === null)
+            return;
+        const released = releasePendingCorrectionClaim({
+            workspaceDir: input.workspaceDir,
+            logicalObservationKey: candidate.logicalObservationKey,
+            claimToken: candidate.claimToken,
+        });
+        if (!released.ok) {
+            degradations.push(`${candidate.logicalObservationKey}:claim_release_failed:${released.reason}`);
+        }
+    };
+    const tally = (outcome) => {
+        if (outcome.disposition === 'admitted')
+            admitted += 1;
+        else if (outcome.disposition === 'resolved_none')
+            resolvedNone += 1;
+        else if (outcome.disposition === 'abandoned')
+            abandoned += 1;
+        else if (outcome.disposition === 'pending')
+            stillPending += 1;
+        else
+            skipped += 1;
+    };
+    for (const candidate of claimedResult.candidates) {
+        const elapsed = performance.now() - startedAt;
+        const remaining = budgetMs - elapsed;
+        if (remaining <= 0) {
+            releaseClaim(candidate);
+            skipped += 1;
+            continue;
+        }
+        try {
+            let review = candidate.reviewResult;
+            if (review === null) {
+                if (input.classifier === null) {
+                    // No LLM configured/available: release the claim (no attempt
+                    // consumed) so a later cycle can retry immediately. NOT a verdict.
+                    releaseClaim(candidate);
+                    skipped += 1;
+                    continue;
+                }
+                const timeoutMs = Math.max(1, Math.min(classificationTimeoutMs, remaining));
+                // The remaining budget goes INTO the adapter request as well as the
+                // outer race (v0.3.1 §2.2); an outer timeout does not cancel a
+                // provider request that the adapter does not support cancelling.
+                const llm = await withTimeout(input.classifier(candidate.text, { timeoutMs }), timeoutMs);
+                const { claimToken } = candidate;
+                if (claimToken === null) {
+                    // A freshly claimed candidate always carries a token; its absence
+                    // means the claim was consumed elsewhere — do not write without it.
+                    degradations.push(`${candidate.logicalObservationKey}:claim_token_missing`);
+                    skipped += 1;
+                    continue;
+                }
+                const recorded = recordPendingCorrectionReview({
+                    workspaceDir: input.workspaceDir,
+                    logicalObservationKey: candidate.logicalObservationKey,
+                    claimToken,
+                    llmResult: llm,
+                    now,
+                });
+                if (!recorded.ok) {
+                    // Nothing durable was written; release so the next cycle retries
+                    // instead of waiting out the claim TTL.
+                    releaseClaim(candidate);
+                    degradations.push(`${candidate.logicalObservationKey}:${recorded.reason}`);
+                    skipped += 1;
+                    continue;
+                }
+                if (recorded.disposition === 'concurrent_loss') {
+                    skipped += 1;
+                    continue;
+                }
+                // Read the freshly persisted verdict through the settle step; the
+                // recorded verdict is durable even if a later step throws.
+            }
+            const settled = await settlePendingCorrection({
+                workspaceDir: input.workspaceDir,
+                logicalObservationKey: candidate.logicalObservationKey,
+                // Fencing token only when this cycle holds the claim; crash recovery
+                // of an already durable reviewResult settles without one.
+                ...(candidate.claimToken !== null ? { claimToken: candidate.claimToken } : {}),
+                now,
+            });
+            if (!settled.ok) {
+                degradations.push(`${candidate.logicalObservationKey}:${settled.reason}`);
+                skipped += 1;
+                continue;
+            }
+            tally(settled);
+            input.onEvent?.('SIGNAL_STAGE2_SETTLED', JSON.stringify({
+                logicalObservationKey: candidate.logicalObservationKey,
+                disposition: settled.disposition,
+                reason: settled.reason,
+            }));
+        }
+        catch (error) {
+            // Guarded release: a durable reviewResult is never cleared here.
+            releaseClaim(candidate);
+            const detail = error instanceof Error ? error.message.slice(0, 160) : String(error).slice(0, 160);
+            degradations.push(`${candidate.logicalObservationKey}:stage2_failed:${detail}`);
+            skipped += 1;
+        }
+    }
+    return {
+        ok: degradations.length === 0,
+        classifier: classifierState,
+        claimed: claimedResult.candidates.length,
+        admitted,
+        resolvedNone,
+        abandoned,
+        stillPending,
+        skipped,
+        expired: claimedResult.expired,
+        durationMs: Math.round(performance.now() - startedAt),
+        ...(degradations.length > 0
+            ? { reason: 'stage2_correction_degradations', nextAction: 'Inspect the per-candidate degradations; pending candidates remain durable and retry next cycle.' }
+            : {}),
+        degradations: degradations.slice(0, 10),
+    };
+}

package/host-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.14.6",
+  "version": "0.15.0",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",

package/install-layout/dist/index.d.ts

@@ -72,6 +72,14 @@ export interface InstallLayoutPaths {
      * the same way the Codex hook resolves the canonical runtime.
      */
     workbuddyAdapterDir: string;
+    /**
+     * Gate 4 (PRI-1071): the shared read-only MCP server component (payload dir
+     * pd-mcp-server/, npm name @principles/pd-mcp-server). This is the Install
+     * Layout SSoT for the canonical server entry OpenClaw/WorkBuddy launchers
+     * bind to; Codex keeps its plugin-data runtime layout and records that dir
+     * in its own binding.
+     */
+    mcpServerDir: string;
 }
 export interface LayoutResolution {
     mode: InstallLayoutMode | 'missing';
@@ -111,6 +119,13 @@ export declare function parseInstallManifest(value: unknown): {
     error?: string;
 };
 export declare function getInstallLayoutPaths(homeDir: string): InstallLayoutPaths;
+/**
+ * Canonical installed MCP server entry for the shared runtime layout
+ * (~/.pd/runtime/pd-mcp-server/dist/index.js). Launchers, binding writers and
+ * health diagnostics derive the path from this single owner instead of each
+ * repeating the segment list.
+ */
+export declare function getMcpServerEntry(paths: InstallLayoutPaths): string;
 /**
  * WorkBuddy governance workspace (SPEC workbuddy-host-adapter §4.1 OD-07,
  * frozen by Phase 0 probe P06 2026-10-12): an explicit user-level directory

package/install-layout/dist/index.js

@@ -140,8 +140,18 @@ export function getInstallLayoutPaths(homeDir) {
         releaseManagerDir: path.join(runtimeDir, 'release-manager'),
         codexAdapterDir: path.join(runtimeDir, 'codex-adapter'),
         workbuddyAdapterDir: path.join(runtimeDir, 'workbuddy-adapter'),
+        mcpServerDir: path.join(runtimeDir, 'pd-mcp-server'),
     };
 }
+/**
+ * Canonical installed MCP server entry for the shared runtime layout
+ * (~/.pd/runtime/pd-mcp-server/dist/index.js). Launchers, binding writers and
+ * health diagnostics derive the path from this single owner instead of each
+ * repeating the segment list.
+ */
+export function getMcpServerEntry(paths) {
+    return path.join(paths.mcpServerDir, 'dist', 'index.js');
+}
 /**
  * WorkBuddy governance workspace (SPEC workbuddy-host-adapter §4.1 OD-07,
  * frozen by Phase 0 probe P06 2026-10-12): an explicit user-level directory

package/install-layout/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/install-layout",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.146.9",
+  "version": "1.147.0",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {
@@ -26,6 +26,7 @@
     "host-runtime",
     "codex-adapter",
     "workbuddy-adapter",
+    "pd-mcp-server",
     "install-layout",
     "release-manager",
     "trust/root.json",
@@ -36,13 +37,14 @@
   ],
   "scripts": {
     "build": "tsc",
+    "build:deps": "npm run build --workspace=@principles/core && npm run build --workspace=@principles/install-layout && node scripts/mcp-server-build.mjs",
     "dev": "tsc --watch",
     "bundle": "node scripts/bundle-plugin.mjs",
-    "build:release-asset": "node scripts/build-self-contained-release.mjs",
+    "build:release-asset": "npm run build:deps && node scripts/build-self-contained-release.mjs",
     "generate:release-locks": "node scripts/generate-release-locks.mjs",
     "check:release-locks": "node scripts/check-release-locks.mjs",
-    "prepack": "npm run build && npm run bundle",
-    "prepublishOnly": "npm run build && npm run bundle",
+    "prepack": "npm run build:deps && npm run build && npm run bundle",
+    "prepublishOnly": "npm run build:deps && npm run build && npm run bundle",
     "test": "vitest run",
     "test:fast": "vitest run --exclude tests/smoke-packaged-install.test.ts --exclude tests/release-asset-smoke.test.ts --exclude tests/release-upgrade-gate.test.ts --exclude tests/release-junction-lifecycle.test.ts",
     "test:smoke:packaged": "vitest run tests/smoke-packaged-install.test.ts",
@@ -60,7 +62,7 @@
   "dependencies": {
     "@earendil-works/pi-agent-core": "1.2.0",
     "@earendil-works/pi-ai": "1.4.0",
-    "@principles/install-layout": "^0.4.0",
+    "@principles/install-layout": "^0.4.1",
     "@sinclair/typebox": "^0.34.52",
     "@tufjs/models": "3.0.1",
     "@inquirer/prompts": "^8.7.2",
@@ -96,7 +98,7 @@
     "directory": "packages/create-principles-disciple"
   },
   "pd": {
-    "bundledPluginVersion": "2.2.13"
+    "bundledPluginVersion": "2.4.0"
   },
-  "gitHead": "8e0cdc607ee5d25e0b66a0655a6e0ce033a1fe99"
+  "gitHead": "d3355465b090daf098581cdb4c174634fe1e5279"
 }

package/pd-cli/dist/commands/health-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-codex.d.ts","sourceRoot":"","sources":["../../src/commands/health-codex.ts"],"names":[],"mappings":"AAiDA,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA6PD,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0YpF"}
+{"version":3,"file":"health-codex.d.ts","sourceRoot":"","sources":["../../src/commands/health-codex.ts"],"names":[],"mappings":"AAmDA,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA+PD,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoZpF"}

package/pd-cli/dist/commands/health-codex.js

@@ -31,6 +31,7 @@ import { createRequire } from 'module';
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
 import { loadPdConfigForPlugin, resolveNearestPdWorkspace, readCodexIngestionConsent, deriveCodexIngestionConsentState, listGovernanceCheckpoints, readGovernanceObservationStats, readGovernanceAdmissionCounts, detectLegacyCodexHookRegistration, CODEX_INGESTION_DISCLOSURE_VERSION, } from '@principles/host-runtime';
 import { assessCodexInstall, CODEX_INSTALL_NEXT_ACTIONS } from './health-codex-install.js';
+import { assessMcpHealth, formatMcpHealthLines } from './health-mcp.js';
 import { getInstallLayoutPaths, parseInstallManifest } from '@principles/install-layout';
 import { SqliteConnection, SqliteTaskStore, computeFeatureFlagsFromConfig, isFeatureEnabled } from '@principles/core/runtime-v2';
 const require = createRequire(import.meta.url);
@@ -441,6 +442,14 @@ export async function handleHealthCodex(opts = {}) {
         }
     }
     // ── §15 ready conjunction ──────────────────────────────────────────────────
+    // PRI-1071 Gate 4: the shared MCP recall surface is reported separately.
+    // It is NOT part of the §15 ingestion/closure conjunction — a missing MCP
+    // binding must be visible and actionable, but it must not reclassify the
+    // (independent) Codex ingestion readiness contract.
+    const mcp = assessMcpHealth({ host: 'codex', homeDir: os.homedir(), env: process.env });
+    if (mcp.status !== 'HEALTHY') {
+        warnings.push(`mcp: ${mcp.status} — ${mcp.reason ?? 'unverified'}. ${mcp.nextAction ?? ''}`.trim());
+    }
     if (!hostCodexEnabled)
         noteReadyBlocker('host.codex', 'disabled');
     if (workerEvaluation.mode === 'paused')
@@ -492,6 +501,7 @@ export async function handleHealthCodex(opts = {}) {
                 cliStatusSource: install.cliStatusSource,
             }
             : { reason: install.reason, nextAction: install.nextAction },
+        mcp,
         ready,
         readyBlockers: readyBlockers.slice(0, 12),
         warnings,
@@ -526,6 +536,8 @@ export async function handleHealthCodex(opts = {}) {
     }
     line('codexIngestionMinVersion', report.codexIngestionMinVersion);
     line('codexIngestionVerifiedVersion', report.codexIngestionVerifiedVersion);
+    for (const mcpLine of formatMcpHealthLines(report.mcp))
+        console.log(mcpLine);
     line('featureFlag.host.codex', `${String(report.featureFlag.enabled)} (${report.featureFlag.source})`);
     if ('enabled' in report.ingestionFlag) {
         line('ingestionFlag.codex_conversation_ingestion', `${String(report.ingestionFlag.enabled)} (${report.ingestionFlag.source})`);