create-principles-disciple 1.147.0 → 1.147.2

package/host-runtime/dist/governance-signal-admission.js

@@ -35,8 +35,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import Database from 'better-sqlite3';
-import { collectSync, computeFeatureFlagsFromConfig, CORRECTION_SEED_KEYWORDS, buildToolFailureObservation, evaluateTriage, evaluateTriggerController, resolveSourceKind, PainToPrincipleService, PrincipleTreeLedgerAdapter, RuntimeStateManager, createDiagnosticianTaskId, disposePainSignalBridgesForWorkspace, sanitizeString, boundCorrectionEvidenceText, MAX_EVIDENCE_VALUE_CHARS, evaluateStage2ConfidenceGate, evaluatePainIngress, STAGE2_MAX_ATTEMPTS, PENDING_CANDIDATE_TTL_MS, } from '@principles/core/runtime-v2';
-import { deriveProductionCorrectionPainIdentity, deriveProductionToolPainIdentity, hasProductionPainSchema, PRODUCTION_WRITE_TOOLS, } from './production-pain-evidence.js';
+import { collectSync, computeFeatureFlagsFromConfig, CORRECTION_SEED_KEYWORDS, PainToPrincipleService, PrincipleTreeLedgerAdapter, RuntimeStateManager, createDiagnosticianTaskId, disposePainSignalBridgesForWorkspace, sanitizeString, boundCorrectionEvidenceText, MAX_EVIDENCE_VALUE_CHARS, evaluateStage2ConfidenceGate, evaluatePainIngress, STAGE2_MAX_ATTEMPTS, PENDING_CANDIDATE_TTL_MS, } from '@principles/core/runtime-v2';
+import { deriveProductionCorrectionPainIdentity, hasProductionPainSchema, } from './production-pain-evidence.js';
 import { promoteGovernanceEvidence, ensureGovernanceSchema } from './governance-observation-store.js';
 import { loadPdConfigForPlugin } from './pd-config.js';
 // ─── Shared detector constants (one truth for both hosts) ───────────────────
@@ -305,8 +305,8 @@ function ensureGovernanceAdmissionSchema(db) {
     db.transaction(() => {
         for (const statement of ADMISSION_CREATE_STATEMENTS)
             db.exec(statement);
-        // SPEC-CODEX-PAIN-CLOSURE-001 CR-01: this store also writes tool_calls
-        // (admitToolFailure); make sure the host tool-use-id join column exists on
+        // SPEC-CODEX-PAIN-CLOSURE-001 CR-01: trajectory evidence writers persist
+        // tool_calls; make sure the host tool-use-id join column exists on
         // workspaces whose base schema predates it (idempotent additive ALTER —
         // only when the table itself exists: governance-only databases without a
         // tool_calls table are a valid pre-existing state, not an error).
@@ -439,29 +439,6 @@ function insertCorrectionPain({ db, candidate, workspaceDir, painId, reason, now
         .run(candidate.rootSessionId, 'user_correction', GOVERNANCE_STRONG_PAIN_SCORE, reason.slice(0, MAX_REASON_BOUND), 'severe', 'system_infer', null, excerpt, painId, null, candidate.hostKind, nowIso);
     return reason;
 }
-/**
- * ONE builder for the tool_failure task payload shape — the Codex inline
- * admission path and the WorkBuddy bare-pain sweep must produce the SAME
- * shape, differing only in the attributed host and the pain facts.
- */
-function buildToolFailureTaskPayload(fields) {
-    // P1-1 privacy (review round 2): sanitize the FULL text before any
-    // truncation — a token crossing the 200-char boundary must be redacted, not
-    // split into a fragment that survives verbatim. sanitizeString bounds itself.
-    const payload = {
-        painType: 'tool_failure',
-        source: fields.toolName,
-        reason: fields.reason || `tool=${fields.toolName}`,
-        score: fields.score,
-        sessionId: fields.sessionId,
-        hostKind: fields.hostKind,
-        evidence: [{ sourceRef: `governance_observation:${fields.logicalObservationKey}`, note: sanitizeString(fields.reason || fields.toolName, fields.workspaceDir) }],
-    };
-    return payload;
-}
-function toolFailureTaskPayload(fields) {
-    return JSON.stringify(buildToolFailureTaskPayload(fields));
-}
 /**
  * P1 (review round 3): a `behavior_trace` may only name a row that EXISTS in
  * trajectory.db with the SAME lineage tuple. WorkBuddy currently has no
@@ -486,47 +463,36 @@ function persistedBehaviorTraceEvidence(args) {
 }
 function buildTaskSubmissionPayload(candidate, workspaceDir, details) {
     const { reason, db } = details;
-    if (candidate.kind === 'user_correction') {
-        // P1-1 privacy (review round 2): sanitize the FULL text before any
-        // truncation — a token crossing the 200-char boundary must be redacted, not
-        // split into a fragment that survives verbatim. sanitizeString bounds itself.
-        const payload = {
-            painType: 'user_frustration',
-            source: 'user_correction',
-            reason: reason || 'User correction detected',
-            score: GOVERNANCE_STRONG_PAIN_SCORE,
-            sessionId: candidate.rootSessionId,
-            hostKind: candidate.hostKind,
-            evidence: persistedBehaviorTraceEvidence({
-                db,
-                hostKind: candidate.hostKind,
-                logicalObservationKey: candidate.logicalObservationKey,
-                rolloutIdentity: candidate.rolloutIdentity,
-                rootSessionId: candidate.rootSessionId,
-                hostTurnId: candidate.hostTurnId,
-                text: candidate.text,
-                workspaceDir,
-            }),
-            // SPEC-CODEX-PAIN-CLOSURE-001 CR-02 (merged from main): an explicit
-            // Owner statement rides as classified correction evidence — never
-            // summarized by an AI, never inside evidence[] pseudo-trace entries.
-            ...(candidate.explicitOwnerStatement === true
-                ? { correctionEvidence: candidate.hostKind === 'workbuddy'
-                        ? { text: boundCorrectionEvidenceText({ text: candidate.text, classification: 'owner_statement', channel: 'workbuddy_explicit_prefix' }, workspaceDir).text, classification: 'owner_statement', channel: 'workbuddy_explicit_prefix' }
-                        : { text: sanitizeString(candidate.text, workspaceDir), classification: 'owner_statement', channel: candidate.explicitChannel === 'codex_explicit_agent' ? 'codex_explicit_agent' : 'codex_explicit_prefix' } }
-                : {}),
-        };
-        return payload;
-    }
-    return buildToolFailureTaskPayload({
-        hostKind: candidate.hostKind,
-        logicalObservationKey: candidate.logicalObservationKey,
+    // P1-1 privacy (review round 2): sanitize the FULL text before any
+    // truncation — a token crossing the 200-char boundary must be redacted, not
+    // split into a fragment that survives verbatim. sanitizeString bounds itself.
+    const payload = {
+        painType: 'user_frustration',
+        source: 'user_correction',
+        reason: reason || 'User correction detected',
+        score: GOVERNANCE_STRONG_PAIN_SCORE,
         sessionId: candidate.rootSessionId,
-        toolName: candidate.toolName,
-        reason,
-        score: 70,
-        workspaceDir,
-    });
+        hostKind: candidate.hostKind,
+        evidence: persistedBehaviorTraceEvidence({
+            db,
+            hostKind: candidate.hostKind,
+            logicalObservationKey: candidate.logicalObservationKey,
+            rolloutIdentity: candidate.rolloutIdentity,
+            rootSessionId: candidate.rootSessionId,
+            hostTurnId: candidate.hostTurnId,
+            text: candidate.text,
+            workspaceDir,
+        }),
+        // SPEC-CODEX-PAIN-CLOSURE-001 CR-02 (merged from main): an explicit
+        // Owner statement rides as classified correction evidence — never
+        // summarized by an AI, never inside evidence[] pseudo-trace entries.
+        ...(candidate.explicitOwnerStatement === true
+            ? { correctionEvidence: candidate.hostKind === 'workbuddy'
+                    ? { text: boundCorrectionEvidenceText({ text: candidate.text, classification: 'owner_statement', channel: 'workbuddy_explicit_prefix' }, workspaceDir).text, classification: 'owner_statement', channel: 'workbuddy_explicit_prefix' }
+                    : { text: sanitizeString(candidate.text, workspaceDir), classification: 'owner_statement', channel: candidate.explicitChannel === 'codex_explicit_agent' ? 'codex_explicit_agent' : 'codex_explicit_prefix' } }
+            : {}),
+    };
+    return payload;
 }
 function taskSubmissionPayload(candidate, workspaceDir, details) {
     return JSON.stringify(buildTaskSubmissionPayload(candidate, workspaceDir, details));
@@ -1040,106 +1006,6 @@ function admitCorrection({ db, candidate, workspaceDir, now, nowIso, keywordStor
     }
     return { disposition: 'admitted', kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey, canonicalPainId: painId, duplicate, ruleVersion: detection?.ruleVersion ?? null };
 }
-function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
-    const identity = deriveProductionToolPainIdentity({
-        workspaceDir,
-        sessionId: candidate.rootSessionId,
-        turnId: candidate.hostTurnId,
-        toolName: candidate.toolName,
-        source: candidate.source,
-        // I1 identity parity: same call id the live handler derived from (the
-        // candidate builder forwards the host `tool_use_id`).
-        ...(candidate.toolCallId !== undefined ? { toolCallId: candidate.toolCallId } : {}),
-        ...(candidate.toolInput !== undefined ? { toolInput: candidate.toolInput } : {}),
-        ...(candidate.toolOutput !== undefined ? { toolOutput: candidate.toolOutput } : {}),
-    });
-    const { outcome, sanitizedParams, paramsJson, resultPreview, painId } = identity;
-    // Admission gate — identical semantics to the live production handler on a
-    // fresh process (ADR-0020 accepts cold in-memory cooldowns for Codex;
-    // canonical idempotency is the guard).
-    const sourceObservation = buildToolFailureObservation({ toolName: candidate.toolName, error: outcome.error, exitCode: outcome.exitCode ?? undefined });
-    const sourceKind = resolveSourceKind({
-        observedAt: nowIso,
-        workspaceId: workspaceDir,
-        sessionId: candidate.rootSessionId,
-        toolName: candidate.toolName,
-        failureSource: sourceObservation.failureSource,
-        toolNotFound: sourceObservation.toolNotFound,
-        nonZeroExit: outcome.exitCode !== null && outcome.exitCode !== 0,
-    });
-    // Risk evaluation mirrors the production handler: it reads the RAW params
-    // (sanitized params replace paths with placeholders and would lose the
-    // absolute-path risk signal). Identity still uses sanitized params.
-    const rawFile = isRecord(outcome.params) ? (own(outcome.params, 'file_path') ?? own(outcome.params, 'path')) : undefined;
-    const relativePath = String(rawFile ?? 'unknown').slice(0, 500);
-    const isRisky = path.isAbsolute(relativePath) && !path.resolve(relativePath).startsWith(`${workspaceDir}${path.sep}`);
-    const painScore = Math.min(100, (outcome.failure ? 70 : 0) + (isRisky ? 20 : 0));
-    const triage = evaluateTriage({ sourceKind, score: painScore, isRisky });
-    const trigger = evaluateTriggerController({ triageResult: triage, isOwnerManual: false, isCooldownActive: false, isValid: true, score: painScore, sessionId: candidate.rootSessionId });
-    const gateAdmitted = outcome.failure && PRODUCTION_WRITE_TOOLS.has(candidate.toolName) && trigger.shouldCreateDiagnosticTask;
-    void sanitizedParams;
-    if (!gateAdmitted) {
-        return { disposition: 'not_admitted', kind: 'tool_failure', logicalObservationKey: candidate.logicalObservationKey, reason: trigger.reason };
-    }
-    let duplicate = false;
-    let duplicateWithoutPain = false;
-    let reason = '';
-    db.transaction(() => {
-        // Same duplicate probes as the production handler: the host tool-call id
-        // (CR-01) is the stable join key; the content-shape probe stays the
-        // fallback for hosts/candidates without ids.
-        // Review R3/P2: admission dedup is host-scoped — a colliding row from
-        // another host is not this candidate's duplicate.
-        if (candidate.toolUseId !== undefined
-            && (candidate.hostKind !== undefined
-                ? db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ? AND host_kind = ?').get(candidate.rootSessionId, candidate.toolUseId, candidate.hostKind)
-                : db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_use_id = ?').get(candidate.rootSessionId, candidate.toolUseId)) !== undefined) {
-            duplicate = true;
-            duplicateWithoutPain = db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) === undefined;
-        }
-        else if ((candidate.hostKind !== undefined
-            ? db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ? AND host_kind = ?')
-                .get(candidate.rootSessionId, candidate.toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview, candidate.hostKind)
-            : db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?')
-                .get(candidate.rootSessionId, candidate.toolName, paramsJson, outcome.outcome, outcome.exitCode, outcome.error ?? null, resultPreview)) !== undefined) {
-            duplicate = true;
-            duplicateWithoutPain = db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) === undefined;
-        }
-        else {
-            db.prepare(`INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at`)
-                .run(candidate.rootSessionId, nowIso, nowIso);
-            const projectDir = typeof candidate.projectDir === 'string' && path.isAbsolute(candidate.projectDir)
-                ? path.resolve(candidate.projectDir)
-                : null;
-            db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir, host_kind) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(candidate.rootSessionId, candidate.toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, nowIso, candidate.toolUseId ?? null, projectDir, candidate.hostKind);
-            reason = `tool=${candidate.toolName}; error=${outcome.error ?? `exit=${outcome.exitCode}`}; path=${relativePath}`;
-            db.prepare(`INSERT INTO pain_events (session_id, source, score, reason, severity, origin, confidence, text, canonical_pain_id, runtime_task_id, host_kind, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(candidate.rootSessionId, sourceObservation.failureSource ?? 'tool_failure', painScore, reason, painScore >= 70 ? 'severe' : painScore >= 40 ? 'moderate' : 'mild', 'system_infer', null, null, painId, null, candidate.hostKind, nowIso);
-        }
-        // PRI-640 §17: enrich unknown → codex on the already-admitted duplicate
-        // pain row; the IS NULL guard keeps any durable attribution.
-        db.prepare('UPDATE pain_events SET host_kind = ? WHERE canonical_pain_id = ? AND host_kind IS NULL').run(candidate.hostKind, painId);
-        if (!duplicateWithoutPain) {
-            insertAdmissionMarker({
-                db,
-                identity: { hostKind: candidate.hostKind, logicalObservationKey: candidate.logicalObservationKey, rolloutIdentity: candidate.rolloutIdentity, rootSessionId: candidate.rootSessionId, signalKind: candidate.kind },
-                canonicalPainId: painId,
-                ruleVersion: null,
-                reason: sanitizeString(reason, workspaceDir),
-                payloadJson: taskSubmissionPayload(candidate, workspaceDir, { reason, db }),
-                nowIso,
-            });
-        }
-        // A duplicate call row without an admitted pain mirrors the production
-        // handler (no pain insert on duplicates) and records no marker, so a later
-        // delivery whose gate reaches threshold can still admit.
-    })();
-    if (duplicateWithoutPain) {
-        return { disposition: 'not_admitted', kind: 'tool_failure', logicalObservationKey: candidate.logicalObservationKey, reason: 'duplicate_tool_call_without_admitted_pain' };
-    }
-    return { disposition: 'admitted', kind: 'tool_failure', logicalObservationKey: candidate.logicalObservationKey, canonicalPainId: painId, duplicate, ruleVersion: null };
-}
 function admitOne({ db, candidate, workspaceDir, now, nowIso, keywordStore, onDegradation, trustedWorkbuddyLive }) {
     if (candidate.hostKind !== 'codex' && !(candidate.hostKind === 'workbuddy' && candidate.kind === 'user_correction' && (candidate.explicitOwnerStatement === true || trustedWorkbuddyLive === true))) {
         return { ok: false, reason: 'unsupported_host_kind', nextAction: 'governance signal admission accepts Codex observations or explicit WorkBuddy Owner statements' };
@@ -1171,10 +1037,7 @@ function admitOne({ db, candidate, workspaceDir, now, nowIso, keywordStore, onDe
         };
     }
     try {
-        if (candidate.kind === 'user_correction') {
-            return admitCorrection({ db, candidate, workspaceDir, now, nowIso, ...(keywordStore ? { keywordStore } : {}), ...(onDegradation ? { onDegradation } : {}) });
-        }
-        return admitToolFailure({ db, candidate, workspaceDir, nowIso });
+        return admitCorrection({ db, candidate, workspaceDir, now, nowIso, ...(keywordStore ? { keywordStore } : {}), ...(onDegradation ? { onDegradation } : {}) });
     }
     catch (error) {
         // RateLimitedSignal never reaches here — admitCorrection converts it to a
@@ -2117,129 +1980,6 @@ export async function ensureGovernanceContinuation(input) {
         close();
     }
 }
-/**
- * Admit bare host pains — failure rows the shared production pain handler
- * already persisted (host_kind set, canonical_pain_id set, runtime_task_id
- * NULL) but that no inline admission exists for. The WorkBuddy hook is the
- * only evidence producer on that host (SPEC workbuddy-host-adapter §1: no
- * transcript reads), so these rows would otherwise stay stranded as
- * evidence-only forever: reconcile only continues ADMITTED markers, and no
- * WorkBuddy admission step existed (review R2/P1).
- *
- * Policy: only failures scoring at/above the Codex tool_failure admission
- * floor (GOVERNANCE_STRONG_PAIN_SCORE = 70) are queued for diagnosis — that
- * floor is the existing signal-quality boundary for write-tool failures, and
- * lower-scored failures stay evidence-only in pain_events/tool_calls rather
- * than diluting the diagnostician queue. Idempotency reuses the ONE existing
- * authorities: the unique admission marker (canonical_pain_id probe +
- * UNIQUE logical key) and the deterministic task id, so repeated sweeps and
- * crash restarts never mint a second task. Task creation reuses
- * `ensureGovernanceDiagnosticianTask` unchanged (including its Case-B link
- * repair). Evidence promotion is deliberately NOT attempted here: the
- * promotion substrate (governance_rollouts/observations) is fed by transcript
- * ingestion, which the WorkBuddy MVP excludes.
- */
-export async function admitBareHostPains(input) {
-    const opened = openAdmissionStore(input.workspaceDir, input.databaseFactory);
-    if (!('db' in opened)) {
-        return { ok: false, reason: opened.reason, nextAction: opened.nextAction, admitted: 0, ensured: 0, skippedLowScore: 0, skippedInvalid: 0, degradations: [opened.reason] };
-    }
-    const { db, close } = opened;
-    if (!hasProductionPainSchema(db)) {
-        close();
-        return { ok: false, reason: 'trajectory_schema_invalid', nextAction: 'run the supported PD workspace migration before enabling the worker', admitted: 0, ensured: 0, skippedLowScore: 0, skippedInvalid: 0, degradations: ['trajectory_schema_invalid'] };
-    }
-    const nowIso = (input.now ?? new Date()).toISOString();
-    const workspaceDir = path.resolve(input.workspaceDir);
-    const limit = Math.min(Math.max(input.limit ?? 5, 1), 50);
-    // Bare pains of this host that no admission marker covers yet. A marker is
-    // the durable "already handled" fact; runtime_task_id additionally excludes
-    // pains that reached a task through another path.
-    const barePainPredicate = `
-    FROM pain_events p
-    WHERE p.host_kind = ?
-      AND p.runtime_task_id IS NULL
-      AND p.canonical_pain_id IS NOT NULL
-      AND NOT EXISTS (SELECT 1 FROM governance_signal_admissions a WHERE a.canonical_pain_id = p.canonical_pain_id)`;
-    try {
-        const lowScoreRow = db.prepare(`SELECT COUNT(*) AS n ${barePainPredicate} AND p.score < ?`).get(input.hostKind, GOVERNANCE_STRONG_PAIN_SCORE);
-        const skippedLowScore = typeof rowField(lowScoreRow, 'n') === 'number' ? rowField(lowScoreRow, 'n') : 0;
-        const rows = db.prepare(`SELECT p.canonical_pain_id, p.session_id, p.source, p.score, p.reason ${barePainPredicate} AND p.score >= ? ORDER BY p.id LIMIT ?`)
-            .all(input.hostKind, GOVERNANCE_STRONG_PAIN_SCORE, limit);
-        let admitted = 0;
-        let ensured = 0;
-        let skippedInvalid = 0;
-        const degradations = [];
-        const freshMarkers = [];
-        for (const row of rows) {
-            const painId = rowField(row, 'canonical_pain_id');
-            const sessionId = rowField(row, 'session_id');
-            const score = rowField(row, 'score');
-            if (typeof painId !== 'string' || painId.length === 0 || typeof sessionId !== 'string' || sessionId.length === 0
-                || typeof score !== 'number' || !Number.isFinite(score)) {
-                skippedInvalid += 1;
-                continue;
-            }
-            const logicalObservationKey = `${input.hostKind}|${sessionId}|${painId}`;
-            const reason = typeof rowField(row, 'reason') === 'string' ? rowField(row, 'reason') : '';
-            const source = typeof rowField(row, 'source') === 'string' ? rowField(row, 'source') : 'tool_failure';
-            // The pain row carries the tool name only inside its reason prefix
-            // (`tool=<name>; ...` — the production writer's format); the row's
-            // source column is the failure class, used as the fallback.
-            const toolName = /^tool=([^;]{1,120});/.exec(reason)?.[1] ?? source;
-            const inserted = db.transaction(() => {
-                // Re-probe inside the transaction: a concurrent sweep or live admission
-                // may have marked this pain between the scan and this write.
-                if (db.prepare('SELECT 1 FROM governance_signal_admissions WHERE canonical_pain_id = ?').get(painId) !== undefined)
-                    return false;
-                insertAdmissionMarker({
-                    db,
-                    identity: { hostKind: input.hostKind, logicalObservationKey, rolloutIdentity: sessionId, rootSessionId: sessionId, signalKind: 'tool_failure' },
-                    canonicalPainId: painId,
-                    ruleVersion: null,
-                    reason,
-                    payloadJson: toolFailureTaskPayload({ hostKind: input.hostKind, logicalObservationKey, sessionId, toolName, reason, score, workspaceDir }),
-                    nowIso,
-                });
-                return true;
-            })();
-            if (inserted) {
-                admitted += 1;
-                freshMarkers.push({ logicalObservationKey, canonicalPainId: painId });
-            }
-        }
-        // Reuse the crash-safe ensure semantics unchanged: deterministic task id,
-        // task-store PK idempotency, Case-B link repair.
-        for (const marker of freshMarkers) {
-            const continuation = await ensureGovernanceDiagnosticianTask({
-                workspaceDir,
-                logicalObservationKey: marker.logicalObservationKey,
-                canonicalPainId: marker.canonicalPainId,
-                ...(input.databaseFactory ? { databaseFactory: input.databaseFactory } : {}),
-            });
-            if (continuation.ok) {
-                if (continuation.created)
-                    ensured += 1;
-            }
-            else {
-                degradations.push(`${marker.logicalObservationKey}:${continuation.reason}`);
-            }
-        }
-        return {
-            ok: degradations.length === 0,
-            ...(degradations.length > 0 ? { reason: 'bare_pain_admission_degradations', nextAction: 'inspect the per-item degradations; the admitted pains and markers remain durable and reconcile retries task creation' } : {}),
-            admitted, ensured, skippedLowScore, skippedInvalid,
-            degradations: degradations.slice(0, 10),
-        };
-    }
-    catch (error) {
-        const detail = error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200);
-        return { ok: false, reason: `bare_pain_admission_failed:${detail}`, nextAction: 'inspect the workspace trajectory database and retry; committed markers remain durable', admitted: 0, ensured: 0, skippedLowScore: 0, skippedInvalid: 0, degradations: [`bare_pain_admission_failed:${detail}`] };
-    }
-    finally {
-        close();
-    }
-}
 /**
  * Narrow idempotent reconciliation between the trajectory admission markers
  * and the Runtime V2 task store (separate SQLite databases — no cross-store

package/host-runtime/dist/production-pain-evidence.d.ts

@@ -1,80 +1,14 @@
 import Database from 'better-sqlite3';
 import type { GovernanceHostKind } from '@principles/core/runtime-v2';
 import type { HostEvent, HostEventEmitter, HostEventResult } from '@principles/core/host';
-/** Shared with the governance admission path so both gate tool failures identically. */
-export declare const PRODUCTION_WRITE_TOOLS: ReadonlySet<string>;
-export interface PainEvidenceEntry {
-    sourceRef: string;
-    note: string;
-}
 export interface ProductionPainEnrichment {
+    /** Stable host-supplied occurrence identity for the tool call. */
     eventId?: string;
-    painScore?: number;
-    isRisky?: boolean;
-    consecutiveErrors?: number;
-    relativePath?: string;
-    agentId?: string;
-    errorHash?: string;
-    evidence?: readonly PainEvidenceEntry[];
 }
 export type PainEnrichmentProvider = (event: HostEvent) => unknown | Promise<unknown>;
 export type PainDatabaseFactory = (databasePath: string) => Database.Database;
 /** SPEC-CODEX-PAIN-CLOSURE-001 CR-01: a tool result is success, failure or unknown. */
 export type ToolOutcomeClassification = 'success' | 'failure' | 'unknown';
-interface NormalizedOutcome {
-    outcome: ToolOutcomeClassification;
-    failure: boolean;
-    exitCode: number | null;
-    /** Bounded structured reason present when the outcome is unknown (rc-9). */
-    unknownReason?: string;
-    error?: string;
-    durationMs?: number;
-    params: unknown;
-    result: unknown;
-}
-/** Structural input accepted by the canonical derivations (HostEvent satisfies it without a cast). */
-export interface ProductionToolEventFields {
-    workspaceDir: string;
-    sessionId: string;
-    turnId?: string;
-    /**
-     * I1: the host's real per-call identity (Codex `tool_use_id`, WorkBuddy
-     * `call_id`). Two calls with the same session/generation/tool/params/result
-     * but DIFFERENT call ids are two real occurrences and must derive two
-     * identities; a redelivery of the SAME call id is one occurrence. Optional:
-     * hosts that supply no call id keep the historical content-derived identity
-     * (identical-content calls then cannot be distinguished — a documented
-     * limitation, never fabricated precision).
-     */
-    toolCallId?: string;
-    toolName?: string;
-    toolInput?: unknown;
-    toolOutput?: unknown;
-    source: string;
-}
-export interface DerivedToolPainIdentity {
-    eventId: string;
-    painId: string;
-    outcome: NormalizedOutcome;
-    sanitizedParams: Record<string, unknown>;
-    paramsJson: string;
-    resultPreview: string | null;
-}
-/**
- * The canonical tool-pain identity derivation, exposed for the governance
- * admission path (Codex Governance Closure SPEC §10): the same normalized
- * fields fed to the live production handler derive the same deterministic
- * `pain_host_<sha256>` id, so live and observation-delivered admissions of one
- * tool call converge on one canonical pain.
- *
- * I1 parity obligation: when the host supplies a call id, BOTH paths must pass
- * the same `toolCallId` (Codex admission candidates carry it from the same
- * `tool_use_id` the live decoder required) — otherwise one real call would
- * derive two canonical pains.
- */
-export declare function deriveProductionToolPainIdentity(fields: ProductionToolEventFields & {
-    canonicalEventId?: string;
-}): DerivedToolPainIdentity;
 /**
  * The canonical correction-pain identity derivation (SPEC §10/§12): deterministic,
  * content-derived, retry-safe — replacing the legacy random `correction_<traceId>`
@@ -137,6 +71,13 @@ export declare function recordVerifiedToolOutcomes(args: {
     hostKind?: string;
 }): VerifiedToolOutcomeStatus[];
 /**
+ * Shared production tool-call evidence handler.
+ *
+ * Records the real host tool call in `trajectory.db` (tool_calls) and emits the
+ * receipt event. Phase A retired the legacy automatic Pain admission that used
+ * to ride on this path: a technical tool failure is trajectory + health
+ * evidence, never an Owner-pain by itself.
+ *
  * PRI-640: host attribution is supplied by the host adapter that constructs
  * this shared handler (OpenClaw / Codex adapters) — never guessed inside the
  * writer. Omitted -> NULL (unknown).
@@ -148,6 +89,4 @@ export declare function createProductionPainEvidenceHandler(options?: {
     projectDir?: string;
     events?: HostEventEmitter;
 }): (event: HostEvent) => Promise<HostEventResult>;
-export declare function resetProductionPainCooldownForTest(): void;
-export declare function productionPainCooldownEntryCountForTest(): number;
 export { hasCanonicalSchema as hasProductionPainSchema };