@akagilnc/pi-workflow-roles 0.1.1756 → 0.1.1764

package/dist/public-cli/main.js

@@ -15321,20 +15321,50 @@ async function writeRoleInvocationLedger(source, role) {
     "utf8"
   );
 }
-async function recordLaunchedPiIdentity(runDirectory, identity) {
+async function mergeInvocationIdentityPage(runDirectory, fields) {
   const ledgerPath = join4(runDirectory, "invocation.json");
   const current = JSON.parse(await readFile4(ledgerPath, "utf8"));
   await writeFile2(
     ledgerPath,
     `${JSON.stringify({
       ...current,
-      piExecutable: identity.executable,
-      piVersion: identity.version
+      ...fields
     }, null, 2)}
 `,
     "utf8"
   );
 }
+async function recordLaunchedPiIdentity(runDirectory, identity) {
+  await mergeInvocationIdentityPage(runDirectory, {
+    piExecutable: identity.executable,
+    piVersion: identity.version
+  });
+}
+async function observeLaunchedRolePackageIdentity(packageRoot2, selectedRoleEntry) {
+  const rolePackageRoot = packageRoot2;
+  const raw = JSON.parse(
+    await readFile4(join4(rolePackageRoot, "package.json"), "utf8")
+  );
+  if (typeof raw.version !== "string" || raw.version.trim() === "") {
+    throw new Error(
+      `role package.json at ${rolePackageRoot} does not declare a nonblank version`
+    );
+  }
+  return {
+    roleEntry: selectedRoleEntry,
+    rolePackageRoot,
+    rolePackageVersion: raw.version,
+    entryMode: "public-cli"
+  };
+}
+async function recordLaunchedRolePackageIdentity(runDirectory, identity) {
+  await mergeInvocationIdentityPage(runDirectory, {
+    roleEntry: identity.roleEntry,
+    rolePackageRoot: identity.rolePackageRoot,
+    rolePackageVersion: identity.rolePackageVersion,
+    entryMode: identity.entryMode
+  });
+}
 function requireOptionPath(flag, value) {
   if (value === void 0 || value.trim() === "") {
     throw new CliUsageError(
@@ -16698,13 +16728,8 @@ import { promisify as promisify2 } from "node:util";
 function resolveInternalRoleEntrypoint(packageRoot2) {
   return join5(packageRoot2, INTERNAL_ROLE_ENTRYPOINT_RELATIVE);
 }
-function buildExplicitInternalActivationArgs(packageRoot2, extraArgs = []) {
-  return [
-    "--no-extensions",
-    "-e",
-    resolveInternalRoleEntrypoint(packageRoot2),
-    ...extraArgs
-  ];
+function buildExplicitInternalActivationArgs(selectedRoleEntry, extraArgs = []) {
+  return ["--no-extensions", "-e", selectedRoleEntry, ...extraArgs];
 }
 function knownFailureFromProviderStop(input) {
   if (input.stopReason !== "error") return void 0;
@@ -16750,20 +16775,31 @@ async function selectedPiIdentity(command, cwd, env) {
   return { executable, version };
 }
 async function runExplicitInternalActivation(options) {
+  const roleEntry = await realpath3(
+    resolveInternalRoleEntrypoint(options.packageRoot)
+  );
   const args = buildExplicitInternalActivationArgs(
-    options.packageRoot,
+    roleEntry,
     options.extraArgs ?? []
   );
   const runner = options.runner ?? defaultExplicitInternalPiRunner;
+  const env = {
+    ...process.env,
+    ...options.env,
+    HOME: options.home,
+    PI_CODING_AGENT_DIR: options.agentDir
+  };
+  const runDirectory = env.AK_ROLE_RUN_DIR;
+  if (typeof runDirectory === "string" && runDirectory !== "") {
+    await recordLaunchedRolePackageIdentity(
+      runDirectory,
+      await observeLaunchedRolePackageIdentity(options.packageRoot, roleEntry)
+    );
+  }
   return await runner(args, {
     cwd: options.cwd,
     ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
-    env: {
-      ...process.env,
-      ...options.env,
-      HOME: options.home,
-      PI_CODING_AGENT_DIR: options.agentDir
-    }
+    env
   });
 }
 var execFileAsync2, defaultExplicitInternalPiRunner;
@@ -23117,6 +23153,7 @@ __export(cli_exports, {
   resolveInternalRoleEntrypoint: () => resolveInternalRoleEntrypoint,
   runAkRole: () => runAkRole
 });
+import { realpath as realpath5 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { join as join16 } from "node:path";
 function defaultIo() {
@@ -23310,6 +23347,7 @@ async function runAkRole(argv, env) {
   const io = env.io ?? defaultIo();
   const home = resolveHome(env);
   try {
+    env = { ...env, packageRoot: await realpath5(env.packageRoot) };
     const parsed = parseArgv(argv);
     if (parsed.help || parsed.command === void 0 || parsed.command === "help") {
       if (parsed.command === "help" && parsed.args[0] !== void 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.1756",
+  "version": "0.1.1764",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/souls/judge.md

@@ -2,7 +2,7 @@
 
 你是大理寺。卷由别人提交，你只负责逐条审理、裁决和判断是否收敛；不承担施工，
 不提交变更。可为取证运行验证，即使产生可逆的工作树副作用；落判前恢复开庭基线并
-如实记载。
+如实记载。此类取证不构成污点，不得据此自设回避、复判等法外程序。
 
 ## 证据
 

package/src/public-cli/cli.ts

@@ -1,6 +1,7 @@
 /**
  * Public ak-role CLI dispatcher (roles / config / layered help / Judge run).
  */
+import { realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -352,6 +353,9 @@ export async function runAkRole(
   const home = resolveHome(env);
 
   try {
+    // Select the installed package identity once, before any role-owned Skill,
+    // runtime entry, activation argv, or invocation provenance is derived.
+    env = { ...env, packageRoot: await realpath(env.packageRoot) };
     const parsed = parseArgv(argv);
 
     if (

package/src/public-cli/explicit-internal.ts

@@ -10,7 +10,11 @@ import { delimiter, isAbsolute, join, resolve } from "node:path";
 import { platform } from "node:process";
 import { promisify } from "node:util";
 
-import { recordLaunchedPiIdentity } from "./invocation.ts";
+import {
+  observeLaunchedRolePackageIdentity,
+  recordLaunchedPiIdentity,
+  recordLaunchedRolePackageIdentity,
+} from "./invocation.ts";
 import { INTERNAL_ROLE_ENTRYPOINT_RELATIVE } from "./registry.ts";
 import type { ControlledFailureCause } from "./terminal.ts";
 
@@ -23,15 +27,10 @@ export function resolveInternalRoleEntrypoint(packageRoot: string): string {
  * Ordinary Pi package auto-registration does not include this entrypoint (ADR 0052).
  */
 export function buildExplicitInternalActivationArgs(
-  packageRoot: string,
+  selectedRoleEntry: string,
   extraArgs: readonly string[] = [],
 ): string[] {
-  return [
-    "--no-extensions",
-    "-e",
-    resolveInternalRoleEntrypoint(packageRoot),
-    ...extraArgs,
-  ];
+  return ["--no-extensions", "-e", selectedRoleEntry, ...extraArgs];
 }
 
 /** Production-owned typed failure carried on a resolved runner result. */
@@ -246,20 +245,34 @@ export async function runExplicitInternalActivation(options: {
   timeoutMs?: number | undefined;
   runner?: ExplicitInternalPiRunner;
 }): Promise<ExplicitInternalPiResult> {
+  const roleEntry = await realpath(
+    resolveInternalRoleEntrypoint(options.packageRoot),
+  );
   const args = buildExplicitInternalActivationArgs(
-    options.packageRoot,
+    roleEntry,
     options.extraArgs ?? [],
   );
   const runner = options.runner ?? defaultExplicitInternalPiRunner;
+  const env: NodeJS.ProcessEnv = {
+    ...process.env,
+    ...options.env,
+    HOME: options.home,
+    PI_CODING_AGENT_DIR: options.agentDir,
+  };
+  // Package provenance is known at the public CLI seam before Pi starts — write it
+  // onto the existing invocation page so runs remain attributable even when the
+  // child runner is injected or Pi identity recording never fires.
+  const runDirectory = env.AK_ROLE_RUN_DIR;
+  if (typeof runDirectory === "string" && runDirectory !== "") {
+    await recordLaunchedRolePackageIdentity(
+      runDirectory,
+      await observeLaunchedRolePackageIdentity(options.packageRoot, roleEntry),
+    );
+  }
   return await runner(args, {
     cwd: options.cwd,
     ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
-    env: {
-      ...process.env,
-      ...options.env,
-      HOME: options.home,
-      PI_CODING_AGENT_DIR: options.agentDir,
-    },
+    env,
   });
 }
 

package/src/public-cli/invocation.ts

@@ -188,10 +188,10 @@ async function writeRoleInvocationLedger(
   );
 }
 
-/** Add the identity returned by the production Pi launch seam to its existing ledger page. */
-export async function recordLaunchedPiIdentity(
+/** Merge observed launch-time fields into the single existing invocation.json identity page. */
+async function mergeInvocationIdentityPage(
   runDirectory: string,
-  identity: { executable: string; version: string },
+  fields: Record<string, unknown>,
 ): Promise<void> {
   const ledgerPath = join(runDirectory, "invocation.json");
   const current = JSON.parse(await readFile(ledgerPath, "utf8")) as Record<string, unknown>;
@@ -199,13 +199,73 @@ export async function recordLaunchedPiIdentity(
     ledgerPath,
     `${JSON.stringify({
       ...current,
-      piExecutable: identity.executable,
-      piVersion: identity.version,
+      ...fields,
     }, null, 2)}\n`,
     "utf8",
   );
 }
 
+/** Add the identity returned by the production Pi launch seam to its existing ledger page. */
+export async function recordLaunchedPiIdentity(
+  runDirectory: string,
+  identity: { executable: string; version: string },
+): Promise<void> {
+  await mergeInvocationIdentityPage(runDirectory, {
+    piExecutable: identity.executable,
+    piVersion: identity.version,
+  });
+}
+
+/**
+ * Observed role-package launch provenance written onto the same invocation.json page.
+ * Values are field observations from the public CLI activation seam — never fixed schema markers.
+ */
+export type LaunchedRolePackageIdentity = {
+  /** Canonical absolute path of the selected Internal role entry (extensions/role-runtime.ts). */
+  readonly roleEntry: string;
+  /** Canonical absolute package root that owns the entry and bin. */
+  readonly rolePackageRoot: string;
+  /** package.json version of that root as read at launch. */
+  readonly rolePackageVersion: string;
+  /** How this process crossed into the role runtime (ADR 0052 public CLI). */
+  readonly entryMode: "public-cli";
+};
+
+/** Read the package root that is about to serve this public run (observed values only). */
+export async function observeLaunchedRolePackageIdentity(
+  packageRoot: string,
+  selectedRoleEntry: string,
+): Promise<LaunchedRolePackageIdentity> {
+  const rolePackageRoot = packageRoot;
+  const raw = JSON.parse(
+    await readFile(join(rolePackageRoot, "package.json"), "utf8"),
+  ) as { version?: unknown };
+  if (typeof raw.version !== "string" || raw.version.trim() === "") {
+    throw new Error(
+      `role package.json at ${rolePackageRoot} does not declare a nonblank version`,
+    );
+  }
+  return {
+    roleEntry: selectedRoleEntry,
+    rolePackageRoot,
+    rolePackageVersion: raw.version,
+    entryMode: "public-cli",
+  };
+}
+
+/** Add the role-package identity resolved at the public launch seam to its existing ledger page. */
+export async function recordLaunchedRolePackageIdentity(
+  runDirectory: string,
+  identity: LaunchedRolePackageIdentity,
+): Promise<void> {
+  await mergeInvocationIdentityPage(runDirectory, {
+    roleEntry: identity.roleEntry,
+    rolePackageRoot: identity.rolePackageRoot,
+    rolePackageVersion: identity.rolePackageVersion,
+    entryMode: identity.entryMode,
+  });
+}
+
 export type ParseJudgeArgvResult = {
   instruction: string;
   attachmentPaths: string[];