principles-disciple 1.126.0 → 1.128.0

package/src/core/principle-compiler/code-validator.ts

@@ -1,93 +0,0 @@
-/**
- * Code Validator — Validates LLM-generated rule implementation code
- *
- * CHECKS:
- * 1. Syntax: code parses without errors (VM)
- * 2. Forbidden patterns: delegates to core checkForbiddenPatterns (PRI-44)
- * 3. Export check: sandbox loads and exports evaluate + meta (VM)
- * 4. Return shape: evaluate(mockInput) returns { matched: boolean } (VM)
- *
- * PRI-44: Forbidden pattern detection extracted to @principles/core.
- */
-
-import { nodeVm } from '../../utils/node-vm-polyfill.js';
-import { loadRuleImplementationModule } from '../rule-implementation-runtime.js';
-import { checkForbiddenPatterns, type ValidationResult } from '@principles/core/runtime-v2';
-
-const MOCK_INPUT = {
-  action: {
-    toolName: 'bash',
-    normalizedPath: '/tmp/test.ts',
-    paramsSummary: { command: 'echo test' },
-  },
-  workspace: { isRiskPath: false, planStatus: 'NONE', hasPlanFile: false },
-  session: { sessionId: 'test', currentGfi: 0, recentThinking: false },
-  evolution: { epTier: 0 },
-  derived: { estimatedLineChanges: 0, bashRisk: 'safe' },
-};
-
-export type { ValidationResult } from '@principles/core/runtime-v2';
-
-export function validateGeneratedCode(code: string): ValidationResult {
-  const errors: string[] = [];
-  const warnings: string[] = [];
-
-  // --- Check 1: Syntax ---
-  const normalized = code
-    .replace(/export\s+const\s+/g, 'const ')
-    .replace(/export\s+function\s+/g, 'function ');
-  try {
-    new nodeVm.Script(normalized, { filename: 'code-validator-syntax.js' });
-  } catch (err) {
-    errors.push(`Syntax error: ${(err as Error).message}`);
-    return { valid: false, errors, warnings };
-  }
-
-  // --- Check 2: Forbidden patterns (delegated to core) ---
-  const forbiddenLabels = checkForbiddenPatterns(code);
-  for (const label of forbiddenLabels) {
-    errors.push(`Forbidden pattern: ${label}`);
-  }
-
-  if (errors.length > 0) {
-    return { valid: false, errors, warnings };
-  }
-
-  // --- Check 3: Sandbox load + export check ---
-  let moduleExports: { meta?: unknown; evaluate?: unknown };
-  try {
-    moduleExports = loadRuleImplementationModule(code, 'code-validator-candidate.js');
-  } catch (err) {
-    errors.push(`Sandbox compilation error: ${(err as Error).message}`);
-    return { valid: false, errors, warnings };
-  }
-
-  if (!moduleExports.meta || typeof moduleExports.meta !== 'object') {
-    errors.push('Missing export: meta');
-  }
-
-  if (typeof moduleExports.evaluate !== 'function') {
-    errors.push('Missing export: evaluate');
-  }
-
-  if (errors.length > 0) {
-    return { valid: false, errors, warnings };
-  }
-
-  // --- Check 4: Return shape ---
-  // evaluate() throwing on mock input is acceptable — the function exists and has the
-  // right signature, it just can't handle our generic mock data.
-  // Track as a non-blocking warning so operators know the rule may be fragile.
-  try {
-    const result = (moduleExports.evaluate as (input: unknown) => unknown)(MOCK_INPUT);
-    if (!result || typeof result !== 'object') {
-      errors.push('evaluate must return an object');
-    } else if (typeof (result as Record<string, unknown>).matched !== 'boolean') {
-      errors.push('evaluate must return { matched: boolean }');
-    }
-  } catch (evalWarning) {
-    warnings.push(`evaluate() threw on mock input: ${(evalWarning as Error).message}`);
-  }
-
-  return { valid: errors.length === 0, errors, warnings };
-}

package/src/core/principle-compiler/compiler.ts

@@ -1,327 +0,0 @@
-/**
- * PrincipleCompiler — Orchestrator (Task 5)
- *
- * Orchestrates the full compilation flow:
- *   ReflectionContextCollector.collect() → extract patterns → generateFromTemplate()
- *   → validateGeneratedCode() → [replay validation] → registerCompiledRule()
- *
- * DESIGN DECISIONS:
- * - extractPatterns infers toolName from pain event reasons and session tool calls
- * - Groups by toolName into PainPattern objects
- * - If no patterns can be extracted, returns a 'no patterns' failure
- * - PRI-115: Replay validation gate runs after code validation, before registration
- */
-
-import { ReflectionContextCollector } from '../reflection/reflection-context.js';
-import { validateGeneratedCode } from './code-validator.js';
-import { generateFromTemplate, type PainPattern } from './template-generator.js';
-import { registerCompiledRule } from './ledger-registrar.js';
-import { createImplementationAssetDir } from '../code-implementation-storage.js';
-import type { TrajectoryDatabase } from '../trajectory.js';
-import type { CompileResult } from '@principles/core/runtime-v2';
-import { loadRuleImplementationModule } from '../rule-implementation-runtime.js';
-import { createGoldenTraceFixture, type GoldenTraceCase } from '@principles/core/runtime-v2';
-import { replayGoldenTrace, type ReplayEvaluateFn } from '@principles/core/runtime-v2';
-
-// Re-export CompileResult from core
-export type { CompileResult } from '@principles/core/runtime-v2';
-
-// ---------------------------------------------------------------------------
-// Constants
-// ---------------------------------------------------------------------------
-
-/** Tool names to look for when scanning text for tool references */
-const KNOWN_TOOLS = ['bash', 'write', 'edit', 'read', 'grep', 'glob', 'mcp'] as const;
-
-/** Regex to extract file paths from reason text */
-const PATH_REGEX = /(?:\/[\w.-]+){2,}/;
-
-// ---------------------------------------------------------------------------
-// Pattern Extraction
-// ---------------------------------------------------------------------------
-
-/**
- * Extract PainPatterns from a ReflectionContext.
- *
- * Strategy:
- * 1. Scan pain event reasons for known tool names
- * 2. Extract file paths from reason text as pathRegex candidates
- * 3. Cross-reference with sessionSnapshot toolCalls for failed tool calls
- * 4. Group by toolName into PainPattern objects
- */
-function extractPatterns(context: {
-  painEvents: Array<{ reason: string | null; source: string }>;
-  sessionSnapshot: {
-    toolCalls: Array<{
-      toolName: string;
-      outcome: string;
-      filePath: string | null;
-      errorType: string | null;
-    }>;
-  } | null;
-}): PainPattern[] {
-  const toolNameMap = new Map<string, PainPattern>();
-
-  // 1. Extract from pain event reasons
-  for (const pe of context.painEvents) {
-    const text = pe.reason ?? pe.source ?? '';
-    const toolName = inferToolName(text);
-    if (!toolName) continue;
-
-    const pathRegex = extractPathRegex(text);
-
-    if (!toolNameMap.has(toolName)) {
-      toolNameMap.set(toolName, { toolName });
-    }
-
-    const pattern = toolNameMap.get(toolName)!;
-    if (pathRegex && !pattern.pathRegex) {
-      pattern.pathRegex = pathRegex;
-    }
-  }
-
-  // 2. Extract from session snapshot tool calls (failed ones)
-  if (context.sessionSnapshot?.toolCalls) {
-    for (const tc of context.sessionSnapshot.toolCalls) {
-      // Focus on failed/blocked tool calls as they indicate pain
-      if (tc.outcome !== 'failure' && tc.outcome !== 'blocked') continue;
-
-      const toolName = tc.toolName;
-      if (!toolNameMap.has(toolName)) {
-        const pattern: PainPattern = { toolName };
-        if (tc.errorType) {
-          pattern.errorType = tc.errorType;
-        }
-        if (tc.filePath) {
-          pattern.pathRegex = escapeRegex(tc.filePath);
-        }
-        toolNameMap.set(toolName, pattern);
-      } else {
-        const existing = toolNameMap.get(toolName)!;
-        if (tc.errorType && !existing.errorType) {
-          existing.errorType = tc.errorType;
-        }
-        if (tc.filePath && !existing.pathRegex) {
-          existing.pathRegex = escapeRegex(tc.filePath);
-        }
-      }
-    }
-  }
-
-  return Array.from(toolNameMap.values());
-}
-
-/**
- * Infer tool name from text by checking for known tool names.
- * Returns the first matching known tool name, or null if none found.
- *
- * Uses negative lookbehind to avoid matching natural-language uses:
- * - "please read the error" → read is a verb, not a tool reference
- * - "could write to file" → write is a verb, not a tool reference
- * Tool references in pain events typically appear near words like
- * "tool", "call", "command", "failed", "via", "using", etc.
- */
-function inferToolName(text: string): string | null {
-  const lower = text.toLowerCase();
-  for (const tool of KNOWN_TOOLS) {
-    // Match as a standalone word but exclude common natural-language patterns
-    // e.g., "bash" in "bash" or "bash command" but not in "ambush"
-    // and not in "please read" or "could write" where it's a verb
-    const regex = new RegExp(`(?<!please |could |should |would )\\b${tool}\\b`);
-    if (regex.test(lower)) {
-      return tool;
-    }
-  }
-  return null;
-}
-
-/**
- * Extract a file path from text and return it as an escaped regex pattern.
- * Returns the first path found, or null.
- */
-function extractPathRegex(text: string): string | null {
-  const match = PATH_REGEX.exec(text);
-  if (match) {
-    return escapeRegex(match[0]);
-  }
-  return null;
-}
-
-/**
- * Escape special regex characters in a string.
- */
-function escapeRegex(str: string): string {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-// ---------------------------------------------------------------------------
-// PrincipleCompiler
-// ---------------------------------------------------------------------------
-
-export class PrincipleCompiler {
-  private readonly stateDir: string;
-  private readonly collector: ReflectionContextCollector;
-
-  constructor(stateDir: string, trajectory: TrajectoryDatabase) {
-    this.stateDir = stateDir;
-    this.collector = new ReflectionContextCollector(stateDir, trajectory);
-  }
-
-  /**
-   * Compile a single principle into an auto-generated rule.
-   *
-   * Flow:
-   * 1. Collect reflection context
-   * 2. Extract pain patterns
-   * 3. Generate code from template
-   * 4. Validate generated code
-   * 4.5. Replay validation against GoldenTrace (PRI-115)
-   * 5. Register in ledger
-   */
-  compileOne(principleId: string): CompileResult {
-    // Step 1: Collect context
-    const context = this.collector.collect(principleId);
-    if (!context) {
-      return { success: false, principleId, reason: 'no context' };
-    }
-
-    // Step 2: Extract patterns
-    const patterns = extractPatterns({
-      painEvents: context.painEvents,
-      sessionSnapshot: context.sessionSnapshot,
-    });
-
-    // Step 3: Generate code
-    const coversCondition = context.principle.triggerPattern || context.principle.text;
-    const code = generateFromTemplate(principleId, coversCondition, patterns);
-    if (!code) {
-      return { success: false, principleId, reason: 'no patterns' };
-    }
-
-    // Step 4: Validate
-    const validation = validateGeneratedCode(code);
-    if (!validation.valid) {
-      return {
-        success: false,
-        principleId,
-        reason: `validation failed: ${validation.errors.join('; ')}`,
-      };
-    }
-
-    // Step 4.5: Replay validation against GoldenTrace (PRI-115)
-    const replayCases = this.buildGoldenTraceCases(patterns, context);
-    if (replayCases.length > 0) {
-      let moduleExports: { evaluate?: unknown };
-      try {
-        moduleExports = loadRuleImplementationModule(code, `replay-${principleId}.js`);
-      } catch (err) {
-        return {
-          success: false,
-          principleId,
-          reason: `module_load_error: ${(err as Error).message}`,
-          code,
-          degraded: true,
-        };
-      }
-
-      if (typeof moduleExports.evaluate !== 'function') {
-        return { success: false, principleId, reason: 'replay: no evaluate export', degraded: true };
-      }
-
-      try {
-        const evaluateFn = moduleExports.evaluate as ReplayEvaluateFn;
-        const replayResult = replayGoldenTrace(evaluateFn, replayCases);
-        if (!replayResult.passed) {
-          return {
-            success: false,
-            principleId,
-            reason: 'replay_validation_failed',
-            code,
-            replayResult,
-            degraded: true,
-          };
-        }
-      } catch (err) {
-        return {
-          success: false,
-          principleId,
-          reason: `replay_error: ${(err as Error).message}`,
-          code,
-          degraded: true,
-        };
-      }
-    }
-    // Step 5: Register
-    const registration = registerCompiledRule(this.stateDir, {
-      principleId,
-      codeContent: code,
-      coversCondition,
-    });
-
-    // Step 6: Persist code to disk so RuleHost can load it
-    createImplementationAssetDir(this.stateDir, registration.implementationId, '1', {
-      entrySource: code,
-    });
-
-    return {
-      success: true,
-      principleId,
-      ruleId: registration.ruleId,
-      implementationId: registration.implementationId,
-      code,
-    };
-  }
-
-  /**
-   * Build GoldenTrace test cases from extracted pain patterns.
-   *
-   * Generates synthetic negative/positive parameter pairs based on whether
-   * the pattern targets commands (commandRegex) or paths (pathRegex).
-   * Returns an empty array when no patterns are available.
-   */
-  private buildGoldenTraceCases(
-    patterns: PainPattern[],
-    _context: { painEvents: Array<{ reason: string | null; source: string }> },
-  ): GoldenTraceCase[] {
-    if (patterns.length === 0) return [];
-
-    const pattern = patterns[0];
-    // Skip replay when the pattern has no regex qualifier -- the generated template
-    // blocks ALL calls to the tool, making it impossible to construct a passing
-    // positive case. Replay is only meaningful when the template is selective.
-    // Also skip contentRegex-only patterns: synthetic content params are not meaningful.
-    if (!pattern.commandRegex && !pattern.pathRegex) return [];
-    const negativeParams: Record<string, unknown> = {};
-    if (pattern.commandRegex) negativeParams.command = 'rm -rf /';
-    else negativeParams.path = '/etc/passwd';
-
-    const positiveParams: Record<string, unknown> = {};
-    if (pattern.commandRegex) positiveParams.command = 'echo hello';
-    else positiveParams.path = '/tmp/safe.txt';
-
-    const fixture = createGoldenTraceFixture({
-      toolName: pattern.toolName,
-      negativeParams,
-      positiveParams,
-      expectedDecision: 'block',
-    });
-
-    return fixture.cases;
-  }
-
-  /**
-   * Compile all eligible principles (those with derivedFromPainIds).
-   */
-  compileAll(): CompileResult[] {
-    const contexts = this.collector.collectBatch();
-    return contexts.map((ctx) => {
-      try {
-        return this.compileOne(ctx.principle.id);
-      } catch (e) {
-        // Log for operator visibility — catch-return is intentional for batch容错
-        console.warn(`[PrincipleCompiler] compileAll failed for ${ctx.principle.id}: ${(e as Error).message}`);
-        return { success: false, principleId: ctx.principle.id, reason: `unhandled: ${(e as Error).message}` };
-      }
-    });
-  }
-}

package/src/core/principle-compiler/ledger-registrar.ts

@@ -1,116 +0,0 @@
-/**
- * Ledger Registrar (Task 4)
- *
- * Registers a compiled rule into the principle tree ledger:
- * 1. Creates a LedgerRule with type 'gate', enforcement 'block', status 'proposed'
- * 2. Creates an Implementation with type 'code', lifecycleState 'active'
- *
- * IDEMPOTENCY: If the rule already exists, returns existing registration.
- * ROLLBACK: If implementation creation fails after rule creation, attempts cleanup.
- */
-
-import { createRule, createImplementation, loadLedger, deleteRule, type LedgerRule } from '../principle-tree-ledger.js';
-
-export interface RegisterInput {
-  principleId: string;
-  codeContent: string;
-  coversCondition: string;
-}
-
-export interface RegisterResult {
-  success: boolean;
-  ruleId: string;
-  implementationId: string;
-  codePath: string;
-}
-
-/**
- * Register a compiled rule for a principle in the ledger.
- *
- * Idempotent: if rule already exists, returns existing registration.
- * Atomic: if implementation creation fails, rolls back the rule.
- */
-export function registerCompiledRule(stateDir: string, input: RegisterInput): RegisterResult {
-  const { principleId, codeContent, coversCondition } = input;
-
-  const ruleId = `R_${principleId}_auto`;
-  const implementationId = `IMPL_${principleId}_auto`;
-  const codePath = `compiled-rules/${principleId}/rule.ts`;
-
-  // Idempotency: skip if rule already exists
-  const existingLedger = loadLedger(stateDir);
-  if (existingLedger.tree.rules[ruleId]) {
-    const existingRule = existingLedger.tree.rules[ruleId];
-    return {
-      success: true,
-      ruleId,
-      implementationId: existingRule.implementationIds[0] ?? implementationId,
-      codePath,
-    };
-  }
-
-  const now = new Date().toISOString();
-
-  // Step 1: Create the rule
-  // FIX: Auto-generated rules default to 'warn' enforcement (not 'block') until:
-  // - replay evaluation passes
-  // - coverage confirmation
-  // - human approval
-  // This prevents P_001-style false positives from blocking normal edits.
-  const rule: LedgerRule = {
-    id: ruleId,
-    version: 1,
-    name: `Auto-compiled rule for ${principleId}`,
-    description: `Automatically compiled gate rule generated from principle ${principleId}`,
-    type: 'gate',
-    triggerCondition: coversCondition,
-    enforcement: 'warn',
-    action: codeContent,
-    principleId,
-    status: 'proposed',
-    coverageRate: 0,
-    falsePositiveRate: 0,
-    implementationIds: [],
-    createdAt: now,
-    updatedAt: now,
-  };
-
-  createRule(stateDir, rule);
-
-  // Step 2: Create the implementation (with rollback on failure)
-  try {
-    const implementation = {
-      id: implementationId,
-      ruleId,
-      type: 'code' as const,
-      path: codePath,
-      version: '1',
-      coversCondition,
-      coveragePercentage: 100,
-      // FIX: Start as 'candidate' instead of 'active'.
-      // RuleHost only loads lifecycleState='active' implementations.
-      // This means auto-generated rules will NOT block until explicitly
-      // promoted to 'active' after replay evaluation + human approval.
-      lifecycleState: 'candidate' as const,
-      createdAt: now,
-      updatedAt: now,
-    };
-
-    createImplementation(stateDir, implementation);
-  } catch (implError) {
-    // Rollback: remove the orphaned rule
-    try {
-      deleteRule(stateDir, ruleId);
-    } catch {
-      // Best-effort rollback — log but don't mask the original error
-    }
-    throw implError;
-  }
-
-  return {
-    success: true,
-    ruleId,
-    implementationId,
-    codePath,
-  };
-}

package/src/core/principle-internalization/filesystem-lifecycle-datasource.ts

@@ -1,42 +0,0 @@
-import type { LifecycleDatasource } from '@principles/core/runtime-v2';
-import type { LedgerTreeStore, ReplayReport, ArtifactLineageRecord } from '@principles/core/runtime-v2';
-import { loadLedger } from '../principle-tree-ledger.js';
-import { ReplayEngine } from '../replay-engine.js';
-
-export class LineageSourceRetiredError extends Error {
-  constructor() {
-    super(
-      'Artifact lineage source retired in PRI-230. ' +
-      'The nocturnal-artifact-lineage module has been deleted; ' +
-      'this datasource cannot provide lineage records. ' +
-      'Callers must handle this error explicitly rather than interpreting an empty result as "no lineage".'
-    );
-    this.name = 'LineageSourceRetiredError';
-  }
-}
-
-export class FilesystemLifecycleDatasource implements LifecycleDatasource {
-  private _engine?: ReplayEngine;
-
-  constructor(
-    private readonly workspaceDir: string,
-    private readonly stateDir: string,
-  ) {}
-
-  private get engine(): ReplayEngine {
-    if (!this._engine) this._engine = new ReplayEngine(this.workspaceDir, this.stateDir);
-    return this._engine;
-  }
-
-  loadLedger(): LedgerTreeStore {
-    return loadLedger(this.stateDir).tree as unknown as LedgerTreeStore;
-  }
-
-  listReplayReports(implementationId: string): ReplayReport[] {
-    return this.engine.listReports(implementationId);
-  }
-
-  listLineageRecords(_kind: 'behavioral-sample' | 'rule-implementation-candidate'): ArtifactLineageRecord[] {
-    throw new LineageSourceRetiredError();
-  }
-}

package/src/core/principle-internalization/lifecycle-refresh.ts

@@ -1,11 +0,0 @@
-import {
-  PrincipleLifecycleService,
-  type RecomputedPrincipleLifecycle,
-} from './principle-lifecycle-service.js';
-
-export function refreshPrincipleLifecycle(
-  workspaceDir: string,
-  stateDir: string,
-): RecomputedPrincipleLifecycle[] {
-  return new PrincipleLifecycleService(workspaceDir, stateDir).recomputeAll();
-}