create-principles-disciple 1.93.0 → 1.95.0

package/console/dist/server/config/WorkspaceConfigStore.js

@@ -87,7 +87,8 @@ export class WorkspaceConfigStore {
             }
             return parsed;
         }
-        catch {
+        catch (e) {
+            console.warn('WorkspaceConfigStore: failed to parse workspaces.json, returning empty list:', e);
             return [];
         }
     }

package/console/dist/server/config/pd-config-store.d.ts

@@ -13,7 +13,7 @@
  * - ERR-013: Object.hasOwn() for untrusted keys
  * - ERR-045: ANY-segment redaction for sensitive keys
  */
-import type { EffectivePdConfig, RedactedPdConfigSummary, InternalAgentName } from '@principles/core/runtime-v2';
+import type { EffectivePdConfig, RedactedPdConfigSummary, InternalAgentName, FeatureFlagsResult } from '@principles/core/runtime-v2';
 export interface ConfigLoadResultOk {
     ok: true;
     effective: EffectivePdConfig;
@@ -76,6 +76,12 @@ export declare function validateBindingPayload(payload: unknown): {
 };
 export declare function getPdConfigPath(workspaceDir: string): string;
 export declare function loadPdConfig(workspaceDir: string): ConfigLoadResult;
+/**
+ * Compute feature flags from the loaded PD config (PRI-460).
+ * Works with both ok and error results (uses defaults for errors).
+ * Replaces the legacy `loadWorkspaceFeatureFlags` + `buildFeedbackChannelFlags` path.
+ */
+export declare function computeFlagsFromLoadResult(result: ConfigLoadResult): FeatureFlagsResult;
 export declare function getConfigSummary(workspaceDir: string): {
     summary: RedactedPdConfigSummary;
     errors?: {
@@ -132,4 +138,37 @@ export declare function getPrinciplesOutputLanguage(workspaceDir: string): Outpu
  * Safe partial write: preserves unknown sections, validates before write.
  */
 export declare function updatePrinciplesOutputLanguage(workspaceDir: string, payload: unknown): OutputLanguageResult;
+export interface FeatureFlagUpdateResultOk {
+    ok: true;
+    feature: string;
+    enabled: boolean;
+}
+export interface FeatureFlagUpdateResultErr {
+    ok: false;
+    statusCode: number;
+    error: string;
+    message: string;
+    nextAction?: string;
+}
+export type FeatureFlagUpdateResult = FeatureFlagUpdateResultOk | FeatureFlagUpdateResultErr;
+/**
+ * Update a feature flag's `enabled` field in .pd/config.yaml.
+ *
+ * Safe partial write: preserves unknown sections, validates before write.
+ * Follows the load → validate → merge → atomic write pattern of
+ * updateAgentBinding / updatePrinciplesOutputLanguage.
+ *
+ * Constraints (spec §13.4):
+ * - featureName must be in the registered flag set (DEFAULT_FEATURE_FLAGS)
+ * - Does NOT create a new `features:` section if absent (rejects)
+ * - Atomic write + validates merged yaml can be re-parsed by loadPdConfig
+ *
+ * ERR entries (spec §13.9):
+ * - ERR-001/ERR-005: enabled strictly typeof === 'boolean'; featureName
+ *   strictly checked against whitelist
+ * - ERR-009: unknown featureName → ok:false with reason
+ * - ERR-013: Object.hasOwn for features section existence check
+ * - ERR-015/018/019: load-validate-merge-write-reload, no stale cache
+ */
+export declare function updateFeatureFlag(workspaceDir: string, featureName: string, enabled: boolean): FeatureFlagUpdateResult;
 export declare function checkReadiness(workspaceDir: string, agentName: string, getEnvVar?: (name: string) => string | undefined): ReadinessResult | ReadinessError;

package/console/dist/server/config/pd-config-store.js

@@ -16,7 +16,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import yaml from 'js-yaml';
-import { validatePdConfig, computeEffectivePdConfig, redactPdConfig, checkAgentRuntimeReadiness, resolveAgentRuntimeBinding, INTERNAL_AGENT_NAMES, } from '@principles/core/runtime-v2';
+import { validatePdConfig, computeEffectivePdConfig, computeFeatureFlagsFromConfig, redactPdConfig, checkAgentRuntimeReadiness, resolveAgentRuntimeBinding, INTERNAL_AGENT_NAMES, } from '@principles/core/runtime-v2';
 // ── Constants ────────────────────────────────────────────────────────────────
 const PD_CONFIG_DIR = '.pd';
 const PD_CONFIG_FILENAME = 'config.yaml';
@@ -211,6 +211,16 @@ export function loadPdConfig(workspaceDir) {
         warnings: effective.warnings,
     };
 }
+// ── Feature Flags from Config ────────────────────────────────────────────────
+/**
+ * Compute feature flags from the loaded PD config (PRI-460).
+ * Works with both ok and error results (uses defaults for errors).
+ * Replaces the legacy `loadWorkspaceFeatureFlags` + `buildFeedbackChannelFlags` path.
+ */
+export function computeFlagsFromLoadResult(result) {
+    const effective = result.ok ? result.effective : result.defaults;
+    return computeFeatureFlagsFromConfig(effective);
+}
 // ── Get Redacted Summary ─────────────────────────────────────────────────────
 export function getConfigSummary(workspaceDir) {
     const result = loadPdConfig(workspaceDir);
@@ -596,6 +606,165 @@ export function updatePrinciplesOutputLanguage(workspaceDir, payload) {
     }
     return { ok: true, outputLanguage: outputLangRaw, source: 'user_config' };
 }
+// ── Update Feature Flag (spec 2026-06-27 §13.4) ────────────────────────────
+/**
+ * Whitelist of registered feature flag names. A PATCH request may only
+ * toggle flags that already exist in the registry. Built from the default
+ * effective config's computed flags — this is the authoritative source of
+ * registered flag IDs (avoids ambiguity between the array and Record
+ * forms of DEFAULT_FEATURE_FLAGS in the core barrel).
+ */
+const _DEFAULT_FLAGS_RESULT = computeFeatureFlagsFromConfig(computeEffectivePdConfig(null));
+const REGISTERED_FEATURE_FLAG_NAMES = new Set(Object.keys(_DEFAULT_FLAGS_RESULT.flags));
+/** Map of flag ID → category, for preserving category when writing. */
+const DEFAULT_FLAG_CATEGORY = new Map(Object.entries(_DEFAULT_FLAGS_RESULT.flags).map(([id, flag]) => [id, flag.category]));
+/**
+ * Update a feature flag's `enabled` field in .pd/config.yaml.
+ *
+ * Safe partial write: preserves unknown sections, validates before write.
+ * Follows the load → validate → merge → atomic write pattern of
+ * updateAgentBinding / updatePrinciplesOutputLanguage.
+ *
+ * Constraints (spec §13.4):
+ * - featureName must be in the registered flag set (DEFAULT_FEATURE_FLAGS)
+ * - Does NOT create a new `features:` section if absent (rejects)
+ * - Atomic write + validates merged yaml can be re-parsed by loadPdConfig
+ *
+ * ERR entries (spec §13.9):
+ * - ERR-001/ERR-005: enabled strictly typeof === 'boolean'; featureName
+ *   strictly checked against whitelist
+ * - ERR-009: unknown featureName → ok:false with reason
+ * - ERR-013: Object.hasOwn for features section existence check
+ * - ERR-015/018/019: load-validate-merge-write-reload, no stale cache
+ */
+export function updateFeatureFlag(workspaceDir, featureName, enabled) {
+    // 1. Validate featureName against the registered whitelist
+    if (!REGISTERED_FEATURE_FLAG_NAMES.has(featureName)) {
+        return {
+            ok: false,
+            statusCode: 400,
+            error: 'unknown_feature',
+            message: `Unknown feature flag '${featureName}'. Registered flags: ${Array.from(REGISTERED_FEATURE_FLAG_NAMES).join(', ')}`,
+            nextAction: `Use one of: ${Array.from(REGISTERED_FEATURE_FLAG_NAMES).join(', ')}`,
+        };
+    }
+    // 2. Validate enabled is boolean (typeof check, no `as` — ERR-001)
+    if (typeof enabled !== 'boolean') {
+        return {
+            ok: false,
+            statusCode: 400,
+            error: 'bad_request',
+            message: `enabled must be a boolean. Got: ${typeof enabled}`,
+            nextAction: 'Send { enabled: true } or { enabled: false }',
+        };
+    }
+    // 3. Read raw config to preserve unknown sections + check features section
+    //    Check features section BEFORE loadPdConfig malformed check: a config
+    //    without a features section is rejected with 422 regardless of whether
+    //    the rest is valid or malformed (spec §13.4: 不允许新增).
+    const configPath = getPdConfigPath(workspaceDir);
+    let rawConfig;
+    if (fs.existsSync(configPath)) {
+        let rawContent;
+        try {
+            rawContent = fs.readFileSync(configPath, 'utf8');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { ok: false, statusCode: 500, error: 'read_error', message: `Failed to read config for update: ${message}` };
+        }
+        let rawParsed;
+        try {
+            rawParsed = yaml.load(rawContent, { schema: yaml.JSON_SCHEMA });
+        }
+        catch (err) {
+            // YAML syntax error = malformed config (409, not 500). Consistent with
+            // updateAgentBinding which treats loadPdConfig failures as conflict.
+            const message = err instanceof Error ? err.message : String(err);
+            return { ok: false, statusCode: 409, error: 'conflict', message: `Cannot update feature flag: existing .pd/config.yaml is malformed. YAML parse error: ${message}` };
+        }
+        if (isRecord(rawParsed)) {
+            rawConfig = { ...rawParsed };
+        }
+        else {
+            rawConfig = {};
+        }
+    }
+    else {
+        rawConfig = {};
+    }
+    // 4. Refuse to CREATE a features section if absent (spec §13.4: 不允许新增)
+    //    Use Object.hasOwn for untrusted key check (ERR-013)
+    if (!Object.hasOwn(rawConfig, 'features') || !isRecord(rawConfig.features)) {
+        return {
+            ok: false,
+            statusCode: 422,
+            error: 'no_features_section',
+            message: `Cannot update feature flag: .pd/config.yaml has no 'features:' section. This API does not create new feature sections.`,
+            nextAction: 'Manually add a features: section to .pd/config.yaml first, or set the flag via yaml directly.',
+        };
+    }
+    // 5. Load existing config — if malformed, refuse to write
+    const loadResult = loadPdConfig(workspaceDir);
+    if (!loadResult.ok) {
+        return {
+            ok: false,
+            statusCode: 409,
+            error: 'conflict',
+            message: `Cannot update feature flag: existing .pd/config.yaml is malformed. Fix config errors first. Errors: ${loadResult.errors.map(e => e.reason).join('; ')}`,
+        };
+    }
+    // 6. Merge: update features[featureName].enabled, preserving other flags
+    const existingFeatures = { ...rawConfig.features };
+    const existingEntry = Object.hasOwn(existingFeatures, featureName)
+        ? existingFeatures[featureName]
+        : undefined;
+    // Preserve existing category if present; otherwise use the registered default
+    const category = (isRecord(existingEntry) && Object.hasOwn(existingEntry, 'category') && typeof existingEntry.category === 'string')
+        ? existingEntry.category
+        : (DEFAULT_FLAG_CATEGORY.get(featureName) ?? 'quiet');
+    existingFeatures[featureName] = { category, enabled };
+    rawConfig.features = existingFeatures;
+    // 7. Validate the updated config before writing
+    const validation = validatePdConfig(rawConfig);
+    if (!validation.ok) {
+        return {
+            ok: false,
+            statusCode: 400,
+            error: 'validation_error',
+            message: `Updated config would be invalid: ${validation.errors.map(e => e.reason).join('; ')}`,
+            nextAction: 'Fix config validation errors before retrying',
+        };
+    }
+    // 8. Atomic write
+    try {
+        writeConfigAtomic(configPath, rawConfig);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, statusCode: 500, error: 'write_error', message: `Failed to write config: ${message}`, nextAction: 'Check disk space and file permissions for .pd/config.yaml' };
+    }
+    // 9. Re-read to confirm actual persisted state (ERR-002: fail loud on re-read failure)
+    const confirmResult = loadPdConfig(workspaceDir);
+    if (!confirmResult.ok) {
+        return {
+            ok: false,
+            statusCode: 500,
+            error: 'confirm_read_failed',
+            message: `Write succeeded but re-read failed: config is now malformed`,
+            nextAction: 'Inspect .pd/config.yaml manually for corruption',
+        };
+    }
+    // Use computeFlagsFromLoadResult (not computeFeatureFlagsFromConfig) because
+    // confirmResult is a ConfigLoadResult, not an EffectivePdConfig.
+    const confirmFlags = computeFlagsFromLoadResult(confirmResult);
+    const confirmedEnabled = confirmFlags.flags[featureName]?.enabled === true;
+    return {
+        ok: true,
+        feature: featureName,
+        enabled: confirmedEnabled,
+    };
+}
 // ── Check Readiness ──────────────────────────────────────────────────────────
 export function checkReadiness(workspaceDir, agentName, getEnvVar = (name) => process.env[name]) {
     // 1. Validate agent name

package/console/dist/server/index.js

@@ -2,7 +2,7 @@ import * as http from 'http';
 import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
-import { loadWorkspaceFeatureFlags, buildFeedbackChannelFlags, } from './config/feature-flags.js';
+import { loadPdConfig, computeFlagsFromLoadResult } from './config/pd-config-store.js';
 import { AuthConfig } from './config/AuthConfig.js';
 import { WorkspaceConfigStore } from './config/WorkspaceConfigStore.js';
 import { WorkspaceService } from './models/WorkspaceService.js';
@@ -15,6 +15,8 @@ import { handleActivationsRoute, disposeActivationsModels } from './routes/activ
 import { handleApprovalsGroupedRoute, disposeApprovalsGroupedModels } from './routes/approvals-grouped.js';
 import { handleGovernanceRoute, disposeGovernanceModels } from './routes/governance.js';
 import { handleEvidenceChainRoute, disposeEvidenceChainModels } from './routes/evidence-chain.js';
+import { handleIntentRoute, disposeIntentModels } from './routes/intent.js';
+import { handleIntentDecisionsRoute, disposeIntentDecisionModels } from './routes/intent-decisions.js';
 import { createWorkspacesRoutes } from './routes/workspaces.js';
 import { handleUpdateRoute } from './routes/update.js';
 import { handleUpdateHistoryRoute } from './routes/update-history.js';
@@ -197,11 +199,15 @@ function asyncHandler(fn, timeoutMs = REQUEST_TIMEOUT_MS) {
 async function initServices(workspaceDir, authConfig) {
     const configStore = new WorkspaceConfigStore();
     const workspaceService = new WorkspaceService(configStore);
-    // Load feature flags — fail-closed: on error, feedback_channel is disabled
-    const flagLoadResult = loadWorkspaceFeatureFlags(workspaceDir);
-    const feedbackFlags = buildFeedbackChannelFlags(flagLoadResult);
-    if (!flagLoadResult.ok) {
-        console.warn('[pd-console] Feature flag loading failed (feedback channel disabled):', flagLoadResult.reason);
+    // Load feature flags from canonical .pd/config.yaml — fail-closed: on error, feedback_channel uses defaults
+    const configResult = loadPdConfig(workspaceDir);
+    const pdFlags = computeFlagsFromLoadResult(configResult);
+    const feedbackChannelEnabled = pdFlags.flags.feedback_channel?.enabled ?? false;
+    const feedbackFlags = {
+        feedback_channel: { enabled: feedbackChannelEnabled },
+    };
+    if (!configResult.ok) {
+        console.warn('[pd-console] PD config loading failed (using defaults for feedback channel):', configResult.errors.map(e => e.reason).join('; '));
     }
     return {
         workspaceDir,
@@ -211,7 +217,7 @@ async function initServices(workspaceDir, authConfig) {
         feedbackFlags,
     };
 }
-async function closeServices(services) {
+async function closeServices() {
     disposeFeedbackReportModels();
     disposeApprovalsModels();
     disposeApprovalsGroupedModels();
@@ -221,7 +227,8 @@ async function closeServices(services) {
     disposeActivationsModels();
     disposeGovernanceModels();
     disposeEvidenceChainModels();
-    services.workspaceService.dispose();
+    disposeIntentModels();
+    disposeIntentDecisionModels();
 }
 // ── Route handler ───────────────────────────────────────────────────────────
 function handleRequest(services) {
@@ -290,7 +297,7 @@ function handleRequest(services) {
                 asyncHandler(() => handleUpdateHistoryRoute(req, res, services.workspaceDir, ''))(req, res);
                 return;
             }
-            // Update routes: GET /api/update/check, POST /api/update/apply, GET /api/update/status, POST /api/update/rollback
+            // Update routes: GET /api/update/check, POST /api/update/apply, POST /api/update/rollback
             if (urlPath === '/api/update' || urlPath.startsWith('/api/update/')) {
                 const subPath = urlPath.slice('/api/update'.length);
                 const isApply = subPath === '/apply';
@@ -321,6 +328,17 @@ function handleRequest(services) {
                 asyncHandler(() => handleGovernanceRoute(req, res, services.workspaceDir))(req, res);
                 return;
             }
+            // PRI-466: GET /api/v1/intent
+            if (urlPath === '/api/v1/intent') {
+                asyncHandler(() => handleIntentRoute(req, res, services.workspaceDir))(req, res);
+                return;
+            }
+            // PRI-470: IntentDecisionRecord (POST/GET /api/v1/intent-decisions, /:id, /summary)
+            if (urlPath === '/api/v1/intent-decisions' || urlPath.startsWith('/api/v1/intent-decisions/')) {
+                const subPath = urlPath.slice('/api/v1/intent-decisions'.length);
+                asyncHandler(() => handleIntentDecisionsRoute(req, res, services.workspaceDir, subPath))(req, res);
+                return;
+            }
             // PRI-331: GET /api/v1/evidence-chain
             if (urlPath === '/api/v1/evidence-chain') {
                 asyncHandler(() => handleEvidenceChainRoute(req, res, services.workspaceDir))(req, res);
@@ -355,7 +373,7 @@ export async function main() {
     const shutdown = async (signal) => {
         console.log(`[pd-console] Received ${signal}, shutting down...`);
         await new Promise((resolve) => { server.close(() => resolve()); });
-        await closeServices(services);
+        await closeServices();
         process.exit(0);
     };
     process.on('SIGTERM', () => { void shutdown('SIGTERM'); });

package/console/dist/server/models/ApprovalsConsoleModel.js

@@ -1,7 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { SqliteConnection, SqliteApprovalQueueStore, SqliteActivationStateStore, SqlitePIArtifactStore, ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, createProductionGateDeps, ApprovalCompletionService, ApprovalQueue, mapConfidenceToLabel, isArtifactRevisionOf, MVP_CHANNELS, } from '@principles/core/runtime-v2';
-import { loadWorkspaceFeatureFlags } from '../config/feature-flags.js';
+import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
 const MVP_PROVEN_CHANNELS = new Set(MVP_CHANNELS);
 const EMPTY_STATS = { pending: 0, approved: 0, rejected: 0, cancelled: 0 };
 function isMissingTableError(err) {
@@ -216,17 +216,9 @@ export class ApprovalsConsoleModel {
         // Feature flag gate (Contract F): when story_a_approval_completion is disabled,
         // the new orchestrator is deactivated without damaging existing data.
         // The approval remains in 'approved' status; only activation is skipped.
-        const flagResult = loadWorkspaceFeatureFlags(this.workspaceDir);
-        if (!flagResult.ok) {
-            return {
-                decision: 'refused',
-                reason: `feature_flag_load_failed: ${flagResult.reason}`,
-                nextAction: 'fix feature flag config or manually dispatch via pd runtime activation dispatch',
-                channel: existing.channel,
-                riskLevel: existing.riskLevel,
-            };
-        }
-        const completionFlag = flagResult.flags.flags.story_a_approval_completion;
+        const configResult = loadPdConfig(this.workspaceDir);
+        const pdFlags = computeFlagsFromLoadResult(configResult);
+        const completionFlag = pdFlags.flags.story_a_approval_completion;
         if (!completionFlag || !completionFlag.enabled) {
             // Flag disabled — return undefined so the caller knows activation was skipped.
             // The approval record itself is not rolled back (Contract F: no data damage).

package/console/dist/server/models/EvidenceChainConsoleModel.d.ts

@@ -22,10 +22,8 @@
  * - ERR-014/016/017: Evidence previews bounded via sanitizeString
  * - ERR-013: Use Object.hasOwn() for untrusted object keys
  */
-import { crossReferenceByTimestamp, resolveSummary } from '@principles/core/runtime-v2';
 import type { EvidenceChainState, EvidenceChainRecord, EvidenceChainResponse } from '@principles/core/runtime-v2';
 export type { EvidenceChainState, EvidenceChainRecord, EvidenceChainResponse, };
-export { crossReferenceByTimestamp, resolveSummary, };
 export declare class EvidenceChainConsoleModel {
     private readonly workspaceDir;
     constructor(workspaceDir: string);

package/console/dist/server/models/EvidenceChainConsoleModel.js

@@ -22,11 +22,10 @@
  * - ERR-014/016/017: Evidence previews bounded via sanitizeString
  * - ERR-013: Use Object.hasOwn() for untrusted object keys
  */
-import { SqliteConnection, sanitizeString, assembleEvidenceChain, crossReferenceByTimestamp, resolveSummary, } from '@principles/core/runtime-v2';
+import { SqliteConnection, sanitizeString, assembleEvidenceChain, } from '@principles/core/runtime-v2';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import Database from 'better-sqlite3';
-export { crossReferenceByTimestamp, resolveSummary, };
 // ── Helpers ────────────────────────────────────────────────────────────────────
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -180,6 +179,7 @@ export class EvidenceChainConsoleModel {
         let tasks = [];
         let dreamerTasks = [];
         let candidates = [];
+        let diagnosticArtifacts = [];
         let stateDbAvailable = false;
         if (fs.existsSync(stateDbPath)) {
             const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: true });
@@ -230,6 +230,27 @@ export class EvidenceChainConsoleModel {
                         throw colErr;
                     }
                 }
+                // PRI-469: Read diagnostician artifacts from the artifacts table.
+                // In production, DiagnosticianCommitter writes Stage C output (rootCause +
+                // intentTension) to artifacts.content_json with artifact_kind =
+                // 'diagnostician_output'. This is the canonical source for intentTension.
+                // The tasks.diagnostic_json column is kept as a fallback for test fixtures.
+                // Graceful degradation: if the artifacts table is missing (older workspace),
+                // we simply skip it — assembleEvidenceChain falls back to diagnostic_json.
+                try {
+                    diagnosticArtifacts = db.prepare("SELECT task_id, content_json FROM artifacts WHERE artifact_kind = 'diagnostician_output' ORDER BY created_at DESC").all();
+                }
+                catch (artifactsErr) {
+                    if (isMissingTableError(artifactsErr)) {
+                        // Artifacts table not present in older workspaces — not an error,
+                        // just no intentTension data available from artifacts.
+                    }
+                    else {
+                        // ERR-002: degrade with reason for unexpected errors.
+                        degradedReasons.push('Failed to read diagnostician artifacts table');
+                        degradedNextActions.push('Check state database artifacts table integrity.');
+                    }
+                }
                 stateDbAvailable = true;
             }
             catch (err) {
@@ -272,6 +293,7 @@ export class EvidenceChainConsoleModel {
             stateDbAvailable,
             degradedReasons,
             degradedNextActions,
+            diagnosticArtifacts,
         });
         // ── 5. Sanitize strings in place ─────────────────────────────────
         for (const record of response.records) {
@@ -288,6 +310,18 @@ export class EvidenceChainConsoleModel {
             if (record.candidateSummary) {
                 record.candidateSummary = sanitizeString(record.candidateSummary, this.workspaceDir);
             }
+            // PRI-469: Sanitize intentTension free-text fields.
+            // Enum fields (source, evidenceStrength, suggestedOwnerAction) and
+            // relatedIntentFields are controlled vocabularies validated by the core,
+            // so they don't need sanitization. The explanation, evidence items,
+            // and intentDocHash may contain user/system-generated text.
+            if (record.intentTension) {
+                record.intentTension.explanation = sanitizeString(record.intentTension.explanation, this.workspaceDir);
+                record.intentTension.evidence = record.intentTension.evidence.map((item) => sanitizeString(item, this.workspaceDir));
+                if (record.intentTension.intentDocHash) {
+                    record.intentTension.intentDocHash = sanitizeString(record.intentTension.intentDocHash, this.workspaceDir);
+                }
+            }
         }
         return response;
     }

package/console/dist/server/models/HealthCheckModel.js

@@ -240,8 +240,9 @@ export class HealthCheckModel {
                     lastPrincipleAdded = latestSignal?.updatedAt ?? null;
                 }
             }
-            catch {
-                // Pruning not available — leave as null
+            catch (e) {
+                // Pruning not available — leave as null, but log for observability (ERR-002)
+                console.warn('HealthCheckModel.getPipelineTimestamps: pruning read failed, lastPrincipleAdded left null:', e);
             }
             return {
                 lastPainSignal,
@@ -250,7 +251,8 @@ export class HealthCheckModel {
                 lastPrincipleAdded,
             };
         }
-        catch {
+        catch (e) {
+            console.warn('HealthCheckModel.getPipelineTimestamps: failed to read pipeline timestamps, returning all null:', e);
             return {
                 lastPainSignal: null,
                 lastTaskCreated: null,

package/console/dist/server/models/IntentDecisionModel.d.ts

@@ -0,0 +1,66 @@
+/**
+ * IntentDecisionModel — Console model for IntentDecisionRecord (PRI-470).
+ *
+ * Holds the workspaceDir (like ApprovalsConsoleModel) and opens a per-request
+ * SqliteConnection inside each method: open → delegate to SqliteIntentDecisionStore
+ * → close. This keeps each operation isolated and safe across workspaces.
+ *
+ * Graceful degradation (SPEC §21.7 / ERR-002):
+ * - Missing state.db → reads return null/empty/zero summary; writes return a
+ *   structured `not_initialized` result so the route can map to a clear HTTP
+ *   error instead of silently creating a half-initialized workspace.
+ * - Missing intent_decisions table → reads degrade to empty; writes re-throw
+ *   (the table is created by SqliteConnection.initSchema, so its absence
+ *   signals a corrupted or pre-PD workspace that should not be written to).
+ *
+ * ERR checklist:
+ * - EP-01 / ERR-001, ERR-005: store rows validated via core type guards
+ * - EP-03 / ERR-002: every degraded path carries reason + nextAction
+ * - EP-09: model is a thin I/O adapter over the pure store contract
+ */
+import type { IntentDecisionInput, IntentDecisionRecord, IntentDecisionSummary, FollowUpPatch } from '@principles/core/runtime-v2';
+export type IntentDecisionRecordResultModel = {
+    ok: true;
+    record: IntentDecisionRecord;
+    created: boolean;
+} | {
+    ok: false;
+    reason: string;
+    nextAction: string;
+};
+/**
+ * Result of a follow-up dispatch (PRI-471, SPEC §22.1.4).
+ *
+ * - ok:true + record — the existing record was updated with the follow-up
+ *   field (e.g. `patchProposalId`, `resultingCandidateId`).
+ * - ok:false + reason 'decision_not_found' — no IntentDecisionRecord with
+ *   the given id exists; the route maps this to 404.
+ * - ok:false + reason 'state_db_not_found' / 'intent_decisions_table_missing'
+ *   — same degradation as the record() path.
+ */
+export type FollowUpDispatchResultModel = {
+    ok: true;
+    record: IntentDecisionRecord;
+} | {
+    ok: false;
+    reason: 'decision_not_found' | 'state_db_not_found' | 'intent_decisions_table_missing';
+    nextAction: string;
+};
+export declare class IntentDecisionModel {
+    private readonly workspaceDir;
+    constructor(workspaceDir: string);
+    record(input: IntentDecisionInput): Promise<IntentDecisionRecordResultModel>;
+    getById(id: string): Promise<IntentDecisionRecord | null>;
+    listByPainId(painId: string): Promise<IntentDecisionRecord[]>;
+    listByTaskId(taskId: string): Promise<IntentDecisionRecord[]>;
+    getSummary(): Promise<IntentDecisionSummary>;
+    /**
+     * Update follow-up action fields on an existing IntentDecisionRecord
+     * (PRI-471, SPEC §22.1.4).
+     *
+     * Called by the follow-up route after the Owner decision has been
+     * persisted. Only fields present in `patch` are written; the rest stay
+     * unchanged. Returns the updated record or a structured failure.
+     */
+    updateFollowUp(id: string, patch: FollowUpPatch): Promise<FollowUpDispatchResultModel>;
+}