principles-disciple 1.127.0 → 1.129.0

package/dist/core/replay-engine.js

@@ -0,0 +1,82 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { getImplementationAssetRoot } from './code-implementation-storage.js';
+import { loadLedger } from './principle-tree-ledger.js';
+export class ReplayEngine {
+    workspaceDir;
+    stateDir;
+    constructor(workspaceDir, stateDir) {
+        this.workspaceDir = workspaceDir;
+        this.stateDir = stateDir;
+    }
+    listReports(implementationId) {
+        const reportDir = path.join(getImplementationAssetRoot(this.stateDir, implementationId), 'replays');
+        if (!fs.existsSync(reportDir))
+            return [];
+        try {
+            const files = fs.readdirSync(reportDir).filter((file) => file.endsWith('.json'));
+            return files
+                .sort()
+                .reverse()
+                .map((file) => {
+                const content = fs.readFileSync(path.join(reportDir, file), 'utf-8');
+                return JSON.parse(content);
+            });
+        }
+        catch (err) {
+            console.warn(`[ReplayEngine] Failed to read reports in ${reportDir}: ${err instanceof Error ? err.message : String(err)}`);
+            return [];
+        }
+    }
+    getLatestReport(implementationId) {
+        const reports = this.listReports(implementationId);
+        return reports.length > 0 ? reports[0] : null;
+    }
+    hasPassingReport(implementationId) {
+        return this.listReports(implementationId).some((report) => report.overallDecision === 'pass');
+    }
+    _getImplementationById(implementationId) {
+        const ledger = loadLedger(this.stateDir);
+        return ledger.tree.implementations[implementationId] ?? null;
+    }
+}
+export function formatReplayReport(report) {
+    const decisionEmoji = report.overallDecision === 'pass'
+        ? 'PASS'
+        : report.overallDecision === 'fail'
+            ? 'FAIL'
+            : 'NEEDS-REVIEW';
+    let output = '';
+    output += '\nReplay Evaluation Report\n';
+    output += `${'='.repeat(50)}\n`;
+    output += `Implementation: ${report.implementationId}\n`;
+    output += `Generated At:   ${report.generatedAt}\n`;
+    output += `Overall Decision: [${decisionEmoji}]\n\n`;
+    output += `Evidence Status: ${report.evidenceSummary.evidenceStatus} (samples=${report.evidenceSummary.totalSamples})\n\n`;
+    const formatSection = (label, summary) => {
+        const rate = summary.total > 0
+            ? ((summary.passed / summary.total) * 100).toFixed(1)
+            : 'N/A';
+        let section = `  ${label}:\n`;
+        section += `    Total: ${summary.total} | Passed: ${summary.passed} | Failed: ${summary.failed}\n`;
+        section += `    Pass Rate: ${rate}%\n`;
+        if (summary.failed > 0) {
+            section += '    Failures:\n';
+            for (const detail of summary.details.filter((item) => !item.passed)) {
+                section += `      - ${detail.sampleFingerprint}: ${detail.reason ?? detail.decision}\n`;
+            }
+        }
+        return section;
+    };
+    output += formatSection('Pain-Negative Samples', report.replayResults.painNegative);
+    output += formatSection('Success-Positive Samples', report.replayResults.successPositive);
+    output += formatSection('Principle-Anchor Samples', report.replayResults.principleAnchor);
+    if (report.blockers.length > 0) {
+        output += '\nBlockers:\n';
+        for (const blocker of report.blockers) {
+            output += `  - ${blocker}\n`;
+        }
+    }
+    output += `${'='.repeat(50)}\n`;
+    return output;
+}

package/dist/core/risk-calculator.d.ts

@@ -0,0 +1,22 @@
+export type RiskLevel = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
+export interface FileModification {
+    toolName: string;
+    params: Record<string, unknown>;
+}
+export declare function estimateLineChanges(modification: FileModification): number;
+export declare function assessRiskLevel(filePath: string, modification: FileModification, riskPaths: string[]): RiskLevel;
+/**
+ * Get the total line count of a target file.
+ * @param absoluteFilePath - Absolute path to the file
+ * @returns File line count, or null if file doesn't exist or can't be read
+ */
+export declare function getTargetFileLineCount(absoluteFilePath: string): number | null;
+/**
+ * Calculate the effective line limit based on percentage of target file.
+ * @param targetLineCount - Total lines in target file
+ * @param percentage - Allowed percentage (0-100)
+ * @param minLines - Absolute minimum threshold
+ * @param maxLines - Optional upper bound to prevent misconfiguration
+ * @returns Maximum allowed lines (at least minLines, at most maxLines if provided)
+ */
+export declare function calculatePercentageThreshold(targetLineCount: number, percentage: number, minLines: number, maxLines?: number): number;

package/{src/core/risk-calculator.ts → dist/core/risk-calculator.js}

@@ -1,84 +1,65 @@
- 
 /* global NodeJS */
 import * as fs from 'fs';
 import { isRisky } from '../utils/io.js';
-
-export type RiskLevel = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
-
-export interface FileModification {
-    toolName: string;
-    params: Record<string, unknown>;
-}
-
-     
-export function estimateLineChanges(modification: FileModification): number {
+export function estimateLineChanges(modification) {
     const { toolName, params } = modification;
-    
     if (toolName === 'write_file' || toolName === 'write') {
-        const content = (params.content as string) || '';
+        const content = params.content || '';
         return content.split('\n').length;
     }
-    
     if (toolName === 'replace' || toolName === 'edit') {
-        const newContent = (params.new_string as string) || (params.newText as string) || '';
+        const newContent = params.new_string || params.newText || '';
         return newContent.split('\n').length;
     }
-    
     if (toolName === 'apply_patch' || toolName === 'patch') {
-        const patch = (params.patch as string) || '';
+        const patch = params.patch || '';
         // Rough estimate for patch files
-        return patch.split('\n').filter((l: string) => l.startsWith('+') || l.startsWith('-')).length;
+        return patch.split('\n').filter((l) => l.startsWith('+') || l.startsWith('-')).length;
     }
-
     if (toolName === 'delete_file') {
         // Deleting a file is considered a significant change, but we don't know the size. 
         // We'll treat it as a medium-to-large size change.
         return 50;
     }
-    
     return 0;
 }
-
-export function assessRiskLevel(
-    filePath: string,
-    modification: FileModification,
-    riskPaths: string[]
-): RiskLevel {
+export function assessRiskLevel(filePath, modification, riskPaths) {
     const isRiskPath = isRisky(filePath, riskPaths);
     const estimatedLines = estimateLineChanges(modification);
-    
     if (isRiskPath) {
-        if (estimatedLines > 100) return 'CRITICAL';
+        if (estimatedLines > 100)
+            return 'CRITICAL';
         return 'HIGH';
-    } else {
-        if (estimatedLines > 100) return 'HIGH';
-        if (estimatedLines > 10) return 'MEDIUM';
+    }
+    else {
+        if (estimatedLines > 100)
+            return 'HIGH';
+        if (estimatedLines > 10)
+            return 'MEDIUM';
         return 'LOW';
     }
 }
-
 /**
  * Get the total line count of a target file.
  * @param absoluteFilePath - Absolute path to the file
  * @returns File line count, or null if file doesn't exist or can't be read
  */
-export function getTargetFileLineCount(absoluteFilePath: string): number | null {
+export function getTargetFileLineCount(absoluteFilePath) {
     try {
         if (!fs.existsSync(absoluteFilePath)) {
             return null; // File genuinely doesn't exist
         }
-        
         const stats = fs.statSync(absoluteFilePath);
         if (!stats.isFile()) {
             return null; // Not a regular file (directory, device, etc.)
         }
-        
         const content = fs.readFileSync(absoluteFilePath, 'utf-8');
         return content.split('\n').length;
-    } catch (e) {
+    }
+    catch (e) {
         // Log error before falling back to null - this is intentional for security gates
         const error = e instanceof Error ? e : new Error(String(e));
-        const errorCode = (e as NodeJS.ErrnoException).code;
+        const errorCode = e.code;
         console.error(`[PD:RISK_CALC] Failed to read file for line count: ${absoluteFilePath}`, {
             code: errorCode,
             message: error.message,
@@ -86,7 +67,6 @@ export function getTargetFileLineCount(absoluteFilePath: string): number | null
         return null;
     }
 }
-
 /**
  * Calculate the effective line limit based on percentage of target file.
  * @param targetLineCount - Total lines in target file
@@ -95,24 +75,14 @@ export function getTargetFileLineCount(absoluteFilePath: string): number | null
  * @param maxLines - Optional upper bound to prevent misconfiguration
  * @returns Maximum allowed lines (at least minLines, at most maxLines if provided)
  */
- 
- 
-export function calculatePercentageThreshold(
-    targetLineCount: number,
-    percentage: number,
-    minLines: number,
-    maxLines?: number
-): number {
+export function calculatePercentageThreshold(targetLineCount, percentage, minLines, maxLines) {
     // Clamp percentage to valid range [0, 100]
     const clampedPercentage = Math.max(0, Math.min(100, percentage));
-    
     const calculated = Math.round(targetLineCount * (clampedPercentage / 100));
     let effectiveLimit = Math.max(calculated, minLines);
-    
     // Apply optional upper bound
     if (maxLines !== undefined && maxLines > 0) {
         effectiveLimit = Math.min(effectiveLimit, maxLines);
     }
-    
     return effectiveLimit;
 }

package/{src/core/rule-host-helpers.ts → dist/core/rule-host-helpers.d.ts}

@@ -4,6 +4,5 @@
  * Canonical definitions moved to:
  *   packages/principles-core/src/runtime-v2/internalization/rule-host-helpers.ts
  */
-
 export type { RuleHostHelpers } from '@principles/core/runtime-v2';
 export { createRuleHostHelpers } from '@principles/core/runtime-v2';

package/dist/core/rule-host-helpers.js

@@ -0,0 +1,7 @@
+/**
+ * Rule Host Helpers — Re-exported from @principles/core (PRI-42)
+ *
+ * Canonical definitions moved to:
+ *   packages/principles-core/src/runtime-v2/internalization/rule-host-helpers.ts
+ */
+export { createRuleHostHelpers } from '@principles/core/runtime-v2';

package/{src/core/rule-host-types.ts → dist/core/rule-host-types.d.ts}

@@ -4,11 +4,4 @@
  * Canonical definitions moved to:
  *   packages/principles-core/src/runtime-v2/internalization/rule-host-contracts.ts
  */
-
-export type {
-  RuleHostInput,
-  RuleHostDecision,
-  RuleHostMeta,
-  RuleHostResult,
-  LoadedImplementation,
-} from '@principles/core/runtime-v2';
+export type { RuleHostInput, RuleHostDecision, RuleHostMeta, RuleHostResult, LoadedImplementation, } from '@principles/core/runtime-v2';

package/dist/core/rule-host-types.js

@@ -0,0 +1,7 @@
+/**
+ * Rule Host Types — Re-exported from @principles/core (PRI-42)
+ *
+ * Canonical definitions moved to:
+ *   packages/principles-core/src/runtime-v2/internalization/rule-host-contracts.ts
+ */
+export {};

package/dist/core/rule-host.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Rule Host — Constrained execution layer for active code implementations
+ *
+ * PURPOSE: Load active code implementations from the SQLite activations table
+ * (code_tool_hook channel), execute them in a constrained node:vm context,
+ * and merge their decisions.
+ *
+ * ARCHITECTURE (PRI-436):
+ *   - SQLite is the SOLE production source of active RuleCode
+ *   - No filesystem ledger or implementation asset reads occur during evaluation
+ *   - Constructor takes stateDir for API compatibility (no longer used for impl loading)
+ *   - workspaceDir enables reading code_tool_hook activations from SQLite
+ *   - evaluate(input) loads active code implementations and runs them
+ *   - Each implementation executes in an isolated vm context with minimal helpers
+ *   - Decision merge: block short-circuits, requireApproval collects, allow is implicit
+ *
+ * SECURITY CONSTRAINTS (T-12-01, T-12-04):
+ *   - Candidate code loads through a dedicated vm context, not the host realm
+ *   - No importModuleDynamically callback
+ *   - Helpers are a frozen object — implementations cannot modify the helper surface
+ *
+ * CONSERVATIVE DEGRADATION (T-12-02, D-08):
+ *   - On ANY host error (load failure, eval error, vm error): return undefined
+ *   - Never throw, never bypass downstream gates (Progressive Gate, Edit Verification)
+ */
+import type { RuleHostInput, RuleHostResult } from '@principles/core/runtime-v2';
+import type { RuleHostLogger } from '@principles/core/runtime-v2';
+export type { RuleHostLogger } from '@principles/core/runtime-v2';
+export interface RuleHostOptions {
+    /** Workspace directory for SQLite access. Required for RuleHost to load active code_tool_hook activations. */
+    workspaceDir?: string;
+}
+export declare class RuleHost {
+    private readonly stateDir;
+    private readonly logger;
+    private readonly workspaceDir;
+    private readonly implementationSources;
+    constructor(stateDir: string, logger?: RuleHostLogger, options?: RuleHostOptions);
+    /**
+     * Evaluate the input against all active code implementations.
+     *
+     * Returns:
+     *   - undefined when no active code implementations exist (no opinion)
+     *   - undefined when all implementations return allow or matched=false
+     *   - { decision: 'block', ... } when any implementation returns block (short-circuits)
+     *   - { decision: 'requireApproval', ... } when any implementation returns requireApproval
+     */
+    evaluate(input: RuleHostInput): RuleHostResult | undefined;
+    /**
+     * Load active code implementations from the SQLite activations table.
+     *
+     * PRI-436: SQLite is the SOLE production source. The filesystem ledger
+     * (principle-tree-ledger) and implementation asset paths have been deleted.
+     * No fallback, no dual-source, no deprecated adapter.
+     *
+     * Source: activations table (code_tool_hook channel, deactivated_at IS NULL)
+     *   → JOIN pi_artifacts for content_json → extract implementationCode → compile
+     */
+    private _loadActiveCodeImplementations;
+    /**
+     * Load active code implementations from the activations table (code_tool_hook channel).
+     *
+     * For each activation record:
+     *   1. Query the pi_artifacts table for the artifact content
+     *   2. Parse content_json to extract implementationCode (treated as unknown, EP-01)
+     *   3. Compile via loadRuleImplementationModule (isolated vm context)
+     *
+     * PRI-436 invariant: at most one active activation per rule (target_ref).
+     * Duplicate active activations for the same target_ref are ALL skipped
+     * (zero executions) and emit structured unhealthy evidence via logger.warn
+     * (Runtime Contract Rule 9: graceful degradation includes a reason).
+     *
+     * All data from SQLite is treated as unknown and validated before use.
+     */
+    private _loadFromActivationsTable;
+    /**
+     * PRI-437: Record an unhealthy activation state to EventLog.
+     *
+     * This makes compile/load failures visible to CLI (pd runtime health) and
+     * Console API — NOT just a logger.warn that's silently skipped.
+     *
+     * ERR-002: degradation includes a reason and nextAction (not silent).
+     * Failures in EventLog recording are caught and logged (never throw).
+     */
+    private _recordUnhealthy;
+}