@akagilnc/pi-workflow-roles 0.1.1893 → 0.1.1941

package/dist/public-cli/main.js

@@ -147,6 +147,18 @@ function validateRuntimeReviewerReceipt(output) {
         throw new Error("Successful Reviewer outcome lacks report");
       if (status === "failed" && report !== void 0) throw new Error("Failed Reviewer outcome cannot bind a report");
     }
+    const specDisposition = read(output, "specDisposition");
+    if (specDisposition === "launched") {
+      if (expectedAxes.length !== 2 || expectedAxes[0] !== "standards" || expectedAxes[1] !== "spec") {
+        throw new Error("Reviewer specDisposition launched requires Standards+Spec accepted legs");
+      }
+    } else if (specDisposition === "skipped-missing") {
+      if (expectedAxes.length !== 1 || expectedAxes[0] !== "standards") {
+        throw new Error("Reviewer specDisposition skipped-missing requires Standards-only accepted legs");
+      }
+    } else if (specDisposition !== void 0) {
+      throw new Error("Invalid Reviewer specDisposition");
+    }
   }
   return output;
 }
@@ -14873,6 +14885,69 @@ var init_sitian_role_run_coordinates = __esm({
   }
 });
 
+// src/ticket-frontmatter.ts
+function parseTicketNumberFrontmatter(bytes) {
+  let text;
+  if (typeof bytes === "string") {
+    text = bytes;
+  } else {
+    try {
+      text = exactUtf8(bytes, "ticket face");
+    } catch {
+      return void 0;
+    }
+  }
+  let cursor;
+  if (text.startsWith("---\n")) {
+    cursor = 4;
+  } else if (text.startsWith("---\r\n")) {
+    cursor = 5;
+  } else {
+    return void 0;
+  }
+  const fmLines = [];
+  let closed = false;
+  while (cursor < text.length) {
+    const nl = text.indexOf("\n", cursor);
+    const lineEnd = nl === -1 ? text.length : nl;
+    let line2 = text.slice(cursor, lineEnd);
+    if (line2.endsWith("\r")) line2 = line2.slice(0, -1);
+    if (line2 === "---") {
+      closed = true;
+      break;
+    }
+    fmLines.push(line2);
+    if (nl === -1) break;
+    cursor = nl + 1;
+  }
+  if (!closed) return void 0;
+  let found;
+  for (const line2 of fmLines) {
+    const match = /^[ \t]*ticketNumber[ \t]*:[ \t]*(\d+)[ \t]*$/.exec(line2);
+    if (match === null) continue;
+    const value = Number(match[1]);
+    if (!Number.isInteger(value) || value < 1) return void 0;
+    if (found !== void 0 && found !== value) return void 0;
+    found = value;
+  }
+  return found;
+}
+function resolveTicketNumberFromAttachmentBodies(bodies) {
+  const found = /* @__PURE__ */ new Set();
+  for (const body of bodies) {
+    const value = parseTicketNumberFrontmatter(body);
+    if (value !== void 0) found.add(value);
+  }
+  if (found.size !== 1) return void 0;
+  return found.values().next().value;
+}
+var init_ticket_frontmatter = __esm({
+  "src/ticket-frontmatter.ts"() {
+    "use strict";
+    init_exact_utf8();
+  }
+});
+
 // src/audit-escalation.ts
 function isAuditEscalationResult(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -15338,7 +15413,9 @@ async function writeRoleInvocationLedger(source, role) {
     projectRoot: source.projectRoot,
     runDirectory: source.runDirectory,
     sessionDirectory: source.sessionDirectory,
-    sessionFile: source.sessionFile
+    sessionFile: source.sessionFile,
+    ...source.correlationId === void 0 ? {} : { correlationId: source.correlationId },
+    ...source.ticketNumber === void 0 ? {} : { ticketNumber: source.ticketNumber }
   };
   await writeFile2(
     join5(source.runDirectory, "invocation.json"),
@@ -15399,6 +15476,17 @@ function requireOptionPath(flag, value) {
   }
   return value;
 }
+function requireAuthorityRef(value) {
+  if (value === void 0 || value.trim() === "") {
+    throw new CliUsageError("--authority-ref requires a nonempty durable reference");
+  }
+  if (/\s/.test(value)) {
+    throw new CliUsageError(
+      "--authority-ref requires a durable reference, not inline Spec prose"
+    );
+  }
+  return value;
+}
 function parseJudgeArgv(args) {
   const attachmentPaths = [];
   let project;
@@ -15568,13 +15656,37 @@ async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
   const frozenPath = join5(destinationDir, name);
   await writeFile2(frozenPath, bytes);
   return {
-    provenancePath: absolute,
-    frozenPath,
-    byteLength: bytes.byteLength,
-    sha256: sha256Hex(bytes),
-    mediaKind: "regular-file"
+    attachment: {
+      provenancePath: absolute,
+      frozenPath,
+      byteLength: bytes.byteLength,
+      sha256: sha256Hex(bytes),
+      mediaKind: "regular-file"
+    },
+    body: bytes
   };
 }
+async function freezeAttachmentsWithTicketNumber(attachmentPaths, attachmentsDirectory) {
+  const attachments = [];
+  const bodies = [];
+  for (let i = 0; i < attachmentPaths.length; i += 1) {
+    const frozen = await freezeRegularFileAttachment(
+      attachmentPaths[i],
+      attachmentsDirectory,
+      i
+    );
+    attachments.push(frozen.attachment);
+    bodies.push(frozen.body);
+  }
+  const ticketNumber = resolveTicketNumberFromAttachmentBodies(bodies);
+  return {
+    attachments,
+    ...ticketNumber === void 0 ? {} : { ticketNumber }
+  };
+}
+function ticketAdmissionFields(ticketNumber) {
+  return ticketNumber === void 0 ? {} : { ticketNumber };
+}
 async function admitJudgeInvocation(options) {
   if (options.project !== void 0) {
     requireOptionPath("--project", options.project);
@@ -15585,16 +15697,11 @@ async function admitJudgeInvocation(options) {
   const attachmentsDirectory = join5(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-  const attachments = [];
-  for (let i = 0; i < options.attachmentPaths.length; i += 1) {
-    attachments.push(
-      await freezeRegularFileAttachment(
-        options.attachmentPaths[i],
-        attachmentsDirectory,
-        i
-      )
-    );
-  }
+  const { attachments, ticketNumber } = await freezeAttachmentsWithTicketNumber(
+    options.attachmentPaths,
+    attachmentsDirectory
+  );
+  const ticketFields = ticketAdmissionFields(ticketNumber);
   const instruction = options.instruction;
   const instructionEmpty = instruction.trim() === "";
   const admitted = {
@@ -15605,6 +15712,7 @@ async function admitJudgeInvocation(options) {
     runDirectory,
     sessionDirectory,
     sessionFile,
+    ...ticketFields,
     instruction,
     instructionEmpty,
     attachments: attachments.map((a) => ({
@@ -15630,7 +15738,8 @@ async function admitJudgeInvocation(options) {
     runDirectory,
     sessionDirectory,
     sessionFile,
-    admittedRequestPath
+    admittedRequestPath,
+    ...ticketFields
   };
 }
 function buildJudgeTransportPrompt(admitted) {
@@ -15668,16 +15777,11 @@ async function admitCoderInvocation(options) {
   const attachmentsDirectory = join5(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-  const attachments = [];
-  for (let i = 0; i < options.attachmentPaths.length; i += 1) {
-    attachments.push(
-      await freezeRegularFileAttachment(
-        options.attachmentPaths[i],
-        attachmentsDirectory,
-        i
-      )
-    );
-  }
+  const { attachments, ticketNumber } = await freezeAttachmentsWithTicketNumber(
+    options.attachmentPaths,
+    attachmentsDirectory
+  );
+  const ticketFields = ticketAdmissionFields(ticketNumber);
   const taskPath = join5(runDirectory, "task.md");
   await writeFile2(taskPath, instruction, "utf8");
   const admitted = {
@@ -15689,6 +15793,7 @@ async function admitCoderInvocation(options) {
     runDirectory,
     sessionDirectory,
     sessionFile,
+    ...ticketFields,
     instruction,
     instructionEmpty: false,
     taskPath,
@@ -15717,7 +15822,8 @@ async function admitCoderInvocation(options) {
     sessionDirectory,
     sessionFile,
     admittedRequestPath,
-    taskPath
+    taskPath,
+    ...ticketFields
   };
 }
 function buildCoderTransportPrompt(admitted) {
@@ -15744,29 +15850,12 @@ async function admitFixerInvocation(options) {
   if (options.phase !== "plan" && options.phase !== "apply") {
     throw new CliUsageError("fixer phase must be plan or apply");
   }
-  const projectRoot = resolve4(options.project ?? options.cwd);
-  const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } = roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "fixer", home: options.home });
-  const attachmentsDirectory = join5(runDirectory, "attachments");
-  ensureRealDirectoryTree(ledgerHome, sessionDirectory);
-  ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-  const attachments = [];
-  for (let i = 0; i < options.attachmentPaths.length; i += 1) {
-    attachments.push(
-      await freezeRegularFileAttachment(
-        options.attachmentPaths[i],
-        attachmentsDirectory,
-        i
-      )
-    );
-  }
   let prerequisites = Object.freeze([]);
-  let prerequisitesPath;
+  let prerequisitesSource;
   if (options.prerequisitesPath !== void 0) {
     const absolutePrereq = isAbsolute3(options.prerequisitesPath) ? options.prerequisitesPath : resolve4(options.prerequisitesPath);
-    let source;
     try {
-      source = await readFile4(absolutePrereq, "utf8");
+      prerequisitesSource = await readFile4(absolutePrereq, "utf8");
     } catch (error) {
       throw new CliUsageError(
         `fixer prerequisites path is unreadable: ${options.prerequisitesPath}`,
@@ -15774,13 +15863,27 @@ async function admitFixerInvocation(options) {
       );
     }
     try {
-      prerequisites = parseFixerPrerequisites(source);
+      prerequisites = parseFixerPrerequisites(prerequisitesSource);
     } catch (error) {
       if (error instanceof FixerPacketValidationError) {
         throw new CliUsageError(error.message, { cause: error });
       }
       throw error;
     }
+  }
+  const projectRoot = resolve4(options.project ?? options.cwd);
+  const runId = (options.createRunId ?? uuidv7)();
+  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } = roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "fixer", home: options.home });
+  const attachmentsDirectory = join5(runDirectory, "attachments");
+  ensureRealDirectoryTree(ledgerHome, sessionDirectory);
+  ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
+  const { attachments, ticketNumber } = await freezeAttachmentsWithTicketNumber(
+    options.attachmentPaths,
+    attachmentsDirectory
+  );
+  const ticketFields = ticketAdmissionFields(ticketNumber);
+  let prerequisitesPath;
+  if (prerequisitesSource !== void 0) {
     prerequisitesPath = join5(runDirectory, "prerequisites.json");
     await writeFile2(
       prerequisitesPath,
@@ -15800,6 +15903,7 @@ async function admitFixerInvocation(options) {
     runDirectory,
     sessionDirectory,
     sessionFile,
+    ...ticketFields,
     instruction,
     instructionEmpty: false,
     packetPath,
@@ -15835,7 +15939,8 @@ async function admitFixerInvocation(options) {
     admittedRequestPath,
     packetPath,
     ...prerequisitesPath === void 0 ? {} : { prerequisitesPath },
-    prerequisites
+    prerequisites,
+    ...ticketFields
   };
 }
 function buildFixerTransportPrompt(admitted) {
@@ -16003,34 +16108,32 @@ async function admitCollectorInvocation(options) {
   } else {
     repository = resolveGitHubRemoteRepository(projectRoot);
   }
-  const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } = roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "collector", home: options.home });
-  const attachmentsDirectory = join5(runDirectory, "attachments");
-  ensureRealDirectoryTree(ledgerHome, sessionDirectory);
-  ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-  const attachments = [];
-  const attachmentPaths = options.attachmentPaths ?? [];
-  for (let i = 0; i < attachmentPaths.length; i += 1) {
-    attachments.push(
-      await freezeRegularFileAttachment(
-        attachmentPaths[i],
-        attachmentsDirectory,
-        i
-      )
-    );
-  }
   let manifest = emptyCollectorManifest();
-  let requestManifestPath;
+  let manifestCanonicalJson;
   if (options.requestManifestPath !== void 0) {
     try {
       manifest = await loadCollectorManifest(options.requestManifestPath);
+      manifestCanonicalJson = manifest.canonicalJson;
     } catch (error) {
       throw new CliUsageError(error instanceof Error ? error.message : String(error), { cause: error });
     }
-    requestManifestPath = join5(runDirectory, "request-manifest.json");
-    await writeFile2(requestManifestPath, manifest.canonicalJson, "utf8");
   }
   const manifestDigest = manifest.digest;
+  const runId = (options.createRunId ?? uuidv7)();
+  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } = roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "collector", home: options.home });
+  const attachmentsDirectory = join5(runDirectory, "attachments");
+  ensureRealDirectoryTree(ledgerHome, sessionDirectory);
+  ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
+  const { attachments, ticketNumber } = await freezeAttachmentsWithTicketNumber(
+    options.attachmentPaths ?? [],
+    attachmentsDirectory
+  );
+  const ticketFields = ticketAdmissionFields(ticketNumber);
+  let requestManifestPath;
+  if (manifestCanonicalJson !== void 0) {
+    requestManifestPath = join5(runDirectory, "request-manifest.json");
+    await writeFile2(requestManifestPath, manifestCanonicalJson, "utf8");
+  }
   const instruction = options.instruction ?? "";
   const instructionEmpty = instruction.trim() === "";
   const admitted = {
@@ -16041,6 +16144,7 @@ async function admitCollectorInvocation(options) {
     runDirectory,
     sessionDirectory,
     sessionFile,
+    ...ticketFields,
     instruction,
     instructionEmpty,
     prNumber,
@@ -16079,7 +16183,8 @@ async function admitCollectorInvocation(options) {
     prNumber,
     repository,
     ...requestManifestPath === void 0 ? {} : { requestManifestPath },
-    manifestDigest
+    manifestDigest,
+    ...ticketFields
   };
 }
 function buildCollectorTransportPrompt(_admitted) {
@@ -16276,17 +16381,11 @@ async function admitDoctorInvocation(options) {
   const attachmentsDirectory = join5(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-  const attachments = [];
-  const attachmentPaths = options.attachmentPaths ?? [];
-  for (let i = 0; i < attachmentPaths.length; i += 1) {
-    attachments.push(
-      await freezeRegularFileAttachment(
-        attachmentPaths[i],
-        attachmentsDirectory,
-        i
-      )
-    );
-  }
+  const { attachments, ticketNumber } = await freezeAttachmentsWithTicketNumber(
+    options.attachmentPaths ?? [],
+    attachmentsDirectory
+  );
+  const ticketFields = ticketAdmissionFields(ticketNumber);
   const instruction = options.instruction ?? "";
   const instructionEmpty = instruction.trim() === "";
   const admitted = {
@@ -16297,6 +16396,7 @@ async function admitDoctorInvocation(options) {
     runDirectory,
     sessionDirectory,
     sessionFile,
+    ...ticketFields,
     instruction,
     instructionEmpty,
     issueNumber: options.issueNumber,
@@ -16332,7 +16432,8 @@ async function admitDoctorInvocation(options) {
     admittedRequestPath,
     issueNumber: options.issueNumber,
     caseRunsPath,
-    caseIdentity: caseIdentity2
+    caseIdentity: caseIdentity2,
+    ...ticketFields
   };
 }
 function buildDoctorTransportPrompt(admitted) {
@@ -16348,6 +16449,7 @@ function buildDoctorTransportPrompt(admitted) {
 }
 function parseReviewerArgv(args) {
   const attachmentPaths = [];
+  const authorityRefs = [];
   let project;
   let baseRevision;
   const positional = [];
@@ -16374,6 +16476,14 @@ function parseReviewerArgv(args) {
       baseRevision = requireOptionPath("--base", token.slice("--base=".length));
       continue;
     }
+    if (token === "--authority-ref") {
+      authorityRefs.push(requireAuthorityRef(tokens.shift()));
+      continue;
+    }
+    if (token.startsWith("--authority-ref=")) {
+      authorityRefs.push(requireAuthorityRef(token.slice("--authority-ref=".length)));
+      continue;
+    }
     if (token.startsWith("-") && token !== "-") {
       throw new CliUsageError(`unknown reviewer option: ${token}`);
     }
@@ -16386,6 +16496,7 @@ function parseReviewerArgv(args) {
     instruction: positional.join(" "),
     attachmentPaths,
     baseRevision,
+    authorityRefs,
     ...project === void 0 ? {} : { project }
   };
 }
@@ -16396,22 +16507,20 @@ async function admitReviewerInvocation(options) {
   if (options.baseRevision.trim() === "") {
     throw new CliUsageError("--base requires a nonempty revision");
   }
+  const authorityRefs = Object.freeze(
+    (options.authorityRefs ?? []).map((ref) => requireAuthorityRef(ref))
+  );
   const projectRoot = resolve4(options.project ?? options.cwd);
   const runId = (options.createRunId ?? uuidv7)();
   const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } = roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "reviewer", home: options.home });
   const attachmentsDirectory = join5(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-  const attachments = [];
-  for (let i = 0; i < options.attachmentPaths.length; i += 1) {
-    attachments.push(
-      await freezeRegularFileAttachment(
-        options.attachmentPaths[i],
-        attachmentsDirectory,
-        i
-      )
-    );
-  }
+  const { attachments, ticketNumber } = await freezeAttachmentsWithTicketNumber(
+    options.attachmentPaths,
+    attachmentsDirectory
+  );
+  const ticketFields = ticketAdmissionFields(ticketNumber);
   const instruction = options.instruction;
   const instructionEmpty = instruction.trim() === "";
   const admitted = {
@@ -16422,9 +16531,11 @@ async function admitReviewerInvocation(options) {
     runDirectory,
     sessionDirectory,
     sessionFile,
+    ...ticketFields,
     instruction,
     instructionEmpty,
     baseRevision: options.baseRevision,
+    authorityRefs: [...authorityRefs],
     attachments: attachments.map((a) => ({
       provenancePath: a.provenancePath,
       frozenPath: a.frozenPath,
@@ -16453,7 +16564,9 @@ async function admitReviewerInvocation(options) {
     sessionDirectory,
     sessionFile,
     admittedRequestPath,
-    baseRevision: options.baseRevision
+    baseRevision: options.baseRevision,
+    authorityRefs,
+    ...ticketFields
   };
 }
 function buildReviewerTransportPrompt(admitted) {
@@ -16555,16 +16668,11 @@ async function admitMergerInvocation(options) {
   const attachmentsDirectory = join5(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-  const attachments = [];
-  for (let i = 0; i < options.attachmentPaths.length; i += 1) {
-    attachments.push(
-      await freezeRegularFileAttachment(
-        options.attachmentPaths[i],
-        attachmentsDirectory,
-        i
-      )
-    );
-  }
+  const { attachments, ticketNumber } = await freezeAttachmentsWithTicketNumber(
+    options.attachmentPaths,
+    attachmentsDirectory
+  );
+  const ticketFields = ticketAdmissionFields(ticketNumber);
   const targetIntent = mergerMaterialFromUtf8(
     `Investigate primary sources for target parent ${derived.targetObjectId}. Do not invent intent.`
   );
@@ -16604,6 +16712,7 @@ async function admitMergerInvocation(options) {
     runDirectory,
     sessionDirectory,
     sessionFile,
+    ...ticketFields,
     instruction,
     instructionEmpty: false,
     mergerInputPath,
@@ -16643,7 +16752,8 @@ async function admitMergerInvocation(options) {
     sessionFile,
     admittedRequestPath,
     mergerInputPath,
-    derived: admitted.derived
+    derived: admitted.derived,
+    ...ticketFields
   };
 }
 function buildMergerTransportPrompt(admitted) {
@@ -16666,6 +16776,7 @@ var init_invocation = __esm({
     init_activation_ledger_topology();
     init_activation_ledger_git();
     init_sitian_role_run_coordinates();
+    init_ticket_frontmatter();
     init_doctor_evidence();
     init_collector_config();
     init_fixer_packet();
@@ -16731,7 +16842,7 @@ var init_reviewer_scope_prompt = __esm({
 });
 
 // src/reviewer-construction.ts
-var REVIEWER_CONSTRUCTION_RECIPE, REVIEWER_AXIS_OUTPUT_ADAPTER, REVIEWER_STANDARDS_CONCLUSION_KEYS, REVIEWER_STANDARDS_CONCLUSION_LABELS;
+var REVIEWER_CONSTRUCTION_RECIPE, REVIEWER_AXIS_OUTPUT_ADAPTER, REVIEWER_VERIFICATION_BOUNDARY, REVIEWER_STANDARDS_CONCLUSION_KEYS, REVIEWER_STANDARDS_CONCLUSION_LABELS;
 var init_reviewer_construction = __esm({
   "src/reviewer-construction.ts"() {
     "use strict";
@@ -16748,6 +16859,14 @@ var init_reviewer_construction = __esm({
       version: 1,
       implementationSha256: sha256Hex("reviewer-axis-output:v1:single-axis-verbatim-report+standards-three-priorities")
     });
+    REVIEWER_VERIFICATION_BOUNDARY = [
+      "Verification-Boundary: you may run focused product tests during this review turn when independent verification needs them.",
+      "A full repository test suite is not forbidden, but do not re-run it every review round;",
+      "prefer once at family wrap-up unless this review specifically requires a broader run.",
+      "Slice and review work should not trigger frequent full-suite reruns.",
+      "Independently discover test facts (including existing coder/fixer receipts and any tests you run);",
+      "do not treat caller prose as the source of those facts."
+    ].join(" ");
     REVIEWER_STANDARDS_CONCLUSION_KEYS = Object.freeze([
       "constitutionality",
       "minimum-necessary-test-cost",
@@ -16772,6 +16891,7 @@ var init_reviewer_dispatch = __esm({
     init_reviewer_prompt_identity();
     init_sha256();
     init_reviewer_construction();
+    init_reviewer_construction();
     init_reviewer_preflight_error();
     init_sha256();
     init_reviewer_prompt_identity();
@@ -17524,6 +17644,20 @@ async function findRunDirectoryById(home, runId) {
   }
   return void 0;
 }
+function parsePersistedTicketIdentity(record4) {
+  const correlationId = typeof record4.correlationId === "string" && record4.correlationId.trim() !== "" ? record4.correlationId : void 0;
+  const ticketNumber = typeof record4.ticketNumber === "number" && Number.isInteger(record4.ticketNumber) && record4.ticketNumber >= 1 ? record4.ticketNumber : void 0;
+  return {
+    ...correlationId === void 0 ? {} : { correlationId },
+    ...ticketNumber === void 0 ? {} : { ticketNumber }
+  };
+}
+function restoredTicketFields(fields) {
+  return {
+    ...fields.correlationId === void 0 ? {} : { correlationId: fields.correlationId },
+    ...fields.ticketNumber === void 0 ? {} : { ticketNumber: fields.ticketNumber }
+  };
+}
 async function loadResumableRunRecord(home, runId) {
   const runDirectory = await findRunDirectoryById(home, runId);
   if (runDirectory === void 0) {
@@ -17553,8 +17687,11 @@ async function loadResumableRunRecord(home, runId) {
   let prerequisitesPath;
   let prerequisites;
   let baseRevision;
+  let authorityRefs;
   let mergerInputPath;
   let derived;
+  let correlationId;
+  let ticketNumber;
   try {
     const raw = JSON.parse(
       await readFile8(run.admittedRequestPath, "utf8")
@@ -17588,6 +17725,18 @@ async function loadResumableRunRecord(home, runId) {
       if (typeof record4.baseRevision === "string" && record4.baseRevision.trim() !== "") {
         baseRevision = record4.baseRevision;
       }
+      if (Array.isArray(record4.authorityRefs)) {
+        authorityRefs = Object.freeze(
+          record4.authorityRefs.map((ref) => {
+            if (typeof ref !== "string") {
+              throw new CliUsageError(
+                "role run admitted authority refs must be durable reference strings"
+              );
+            }
+            return requireAuthorityRef(ref);
+          })
+        );
+      }
       if (typeof record4.mergerInputPath === "string" && record4.mergerInputPath.trim() !== "") {
         mergerInputPath = record4.mergerInputPath;
       }
@@ -17603,12 +17752,38 @@ async function loadResumableRunRecord(home, runId) {
           };
         }
       }
+      const fromAdmitted = parsePersistedTicketIdentity(record4);
+      correlationId = fromAdmitted.correlationId;
+      ticketNumber = fromAdmitted.ticketNumber;
     }
-  } catch {
+  } catch (error) {
+    if (error instanceof CliUsageError) throw error;
     throw new CliUsageError(
-      `role run admitted request is unreadable: ${runId}`
+      `role run admitted request is unreadable: ${runId}`,
+      { cause: error }
     );
   }
+  if (correlationId === void 0 || ticketNumber === void 0) {
+    try {
+      const invocationRaw = JSON.parse(
+        await readFile8(join9(run.runDirectory, "invocation.json"), "utf8")
+      );
+      if (invocationRaw !== null && typeof invocationRaw === "object" && !Array.isArray(invocationRaw)) {
+        const fromInvocation = parsePersistedTicketIdentity(
+          invocationRaw
+        );
+        if (correlationId === void 0) correlationId = fromInvocation.correlationId;
+        if (ticketNumber === void 0) ticketNumber = fromInvocation.ticketNumber;
+      }
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
+        throw new CliUsageError(
+          `role run invocation identity is unreadable: ${runId}`,
+          { cause: error }
+        );
+      }
+    }
+  }
   return {
     run,
     observation: run.resumable,
@@ -17622,8 +17797,11 @@ async function loadResumableRunRecord(home, runId) {
       ...prerequisitesPath === void 0 ? {} : { prerequisitesPath },
       ...prerequisites === void 0 ? {} : { prerequisites },
       ...baseRevision === void 0 ? {} : { baseRevision },
+      ...authorityRefs === void 0 ? {} : { authorityRefs },
       ...mergerInputPath === void 0 ? {} : { mergerInputPath },
-      ...derived === void 0 ? {} : { derived }
+      ...derived === void 0 ? {} : { derived },
+      ...correlationId === void 0 ? {} : { correlationId },
+      ...ticketNumber === void 0 ? {} : { ticketNumber }
     }
   };
 }
@@ -17645,7 +17823,8 @@ async function loadResumableJudgeRun(home, runId) {
     runDirectory: loaded.run.runDirectory,
     sessionDirectory: loaded.run.sessionDirectory,
     sessionFile: loaded.run.sessionFile,
-    admittedRequestPath: loaded.run.admittedRequestPath
+    admittedRequestPath: loaded.run.admittedRequestPath,
+    ...restoredTicketFields(loaded.admittedFields)
   };
   return {
     admitted,
@@ -17690,7 +17869,8 @@ async function loadResumableCoderRun(home, runId) {
     sessionDirectory: loaded.run.sessionDirectory,
     sessionFile: loaded.run.sessionFile,
     admittedRequestPath: loaded.run.admittedRequestPath,
-    taskPath
+    taskPath,
+    ...restoredTicketFields(loaded.admittedFields)
   };
   return {
     admitted,
@@ -17738,7 +17918,8 @@ async function loadResumableFixerRun(home, runId) {
     admittedRequestPath: loaded.run.admittedRequestPath,
     packetPath,
     ...loaded.admittedFields.prerequisitesPath === void 0 ? {} : { prerequisitesPath: loaded.admittedFields.prerequisitesPath },
-    prerequisites
+    prerequisites,
+    ...restoredTicketFields(loaded.admittedFields)
   };
   return {
     admitted,
@@ -17771,7 +17952,9 @@ async function loadResumableReviewerRun(home, runId) {
     sessionDirectory: loaded.run.sessionDirectory,
     sessionFile: loaded.run.sessionFile,
     admittedRequestPath: loaded.run.admittedRequestPath,
-    baseRevision
+    baseRevision,
+    authorityRefs: Object.freeze([...loaded.admittedFields.authorityRefs ?? []]),
+    ...restoredTicketFields(loaded.admittedFields)
   };
   return {
     admitted,
@@ -17816,7 +17999,8 @@ async function loadResumableMergerRun(home, runId) {
     sessionFile: loaded.run.sessionFile,
     admittedRequestPath: loaded.run.admittedRequestPath,
     mergerInputPath,
-    derived
+    derived,
+    ...restoredTicketFields(loaded.admittedFields)
   };
   return {
     admitted,
@@ -17973,8 +18157,9 @@ var init_evidence_child_executor = __esm({
     "use strict";
     init_compliance_transport();
     init_package_owned_tool_idle();
-    init_stream_idle_guard();
     init_receipt_delivery_policy();
+    init_reviewer_construction();
+    init_stream_idle_guard();
     init_upstream_error_testimony();
   }
 });
@@ -19232,6 +19417,7 @@ function reviewerDecisiveFacts(output) {
   const axes = reviewerAxes(outcomes.readable ? outcomes.value : void 0);
   const reportAxes = reviewerAxes(reports.readable ? reports.value : void 0);
   const acceptedBatch = safelyRead(candidate, "acceptedBatch");
+  const specDisposition = safelyRead(candidate, "specDisposition");
   const facts = {
     axes,
     reportAxes,
@@ -19239,6 +19425,9 @@ function reviewerDecisiveFacts(output) {
     ...auditNoReceiptDecisiveFact(candidate)
   };
   if (status.readable && typeof status.value === "string") facts.reviewerStatus = status.value;
+  if (specDisposition.readable && (specDisposition.value === "launched" || specDisposition.value === "skipped-missing")) {
+    facts.specDisposition = specDisposition.value;
+  }
   const diagnostic = safelyRead(candidate, "diagnostic");
   if (status.readable && status.value === "refused" && diagnostic.readable) {
     facts.diagnosticPresent = typeof diagnostic.value === "string" && diagnostic.value.trim().length > 0;
@@ -20529,6 +20718,7 @@ async function publishReviewerArtifacts(admitted, roleOutcome, sessionDirectory,
         sessionFile: admitted.sessionFile,
         admittedRequestPath: admitted.admittedRequestPath,
         baseRevision: admitted.baseRevision,
+        authorityRefs: [...admitted.authorityRefs],
         ...admitted.instructionEmpty ? {} : { callerProvenance: admitted.instruction },
         attachments: admitted.attachments.map((a) => ({
           provenancePath: a.provenancePath,
@@ -21265,8 +21455,9 @@ async function dispatchAdmittedCoder(input) {
       PI_CODING_AGENT_DIR: env.agentDir,
       AK_ROLE_RUN_DIR: admitted.runDirectory
     };
-    if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
-      childEnv.AK_CORRELATION_ID = env.correlationId;
+    const correlationId = admitted.correlationId ?? env.correlationId;
+    if (correlationId !== void 0 && correlationId.trim() !== "") {
+      childEnv.AK_CORRELATION_ID = correlationId;
     }
     let result2;
     try {
@@ -21412,7 +21603,10 @@ async function runPublicCoder(argv, env, io, parseCoderArgv2) {
   });
   return await dispatchAdmittedCoder({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease,
@@ -21486,7 +21680,10 @@ async function runPublicCoderResume(argv, env, io) {
   });
   return await dispatchAdmittedCoder({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease,
@@ -21591,8 +21788,9 @@ async function dispatchAdmittedCollector(input) {
       PI_CODING_AGENT_DIR: env.agentDir,
       AK_ROLE_RUN_DIR: admitted.runDirectory
     };
-    if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
-      childEnv.AK_CORRELATION_ID = env.correlationId;
+    const correlationId = admitted.correlationId ?? env.correlationId;
+    if (correlationId !== void 0 && correlationId.trim() !== "") {
+      childEnv.AK_CORRELATION_ID = correlationId;
     }
     let result2;
     try {
@@ -21721,7 +21919,10 @@ async function runPublicCollector(argv, env, io, parseCollectorArgv2) {
   });
   return await dispatchAdmittedCollector({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease
@@ -22123,8 +22324,9 @@ async function dispatchAdmittedFixer(input) {
       PI_CODING_AGENT_DIR: env.agentDir,
       AK_ROLE_RUN_DIR: admitted.runDirectory
     };
-    if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
-      childEnv.AK_CORRELATION_ID = env.correlationId;
+    const correlationId = admitted.correlationId ?? env.correlationId;
+    if (correlationId !== void 0 && correlationId.trim() !== "") {
+      childEnv.AK_CORRELATION_ID = correlationId;
     }
     let result2;
     try {
@@ -22286,7 +22488,10 @@ async function runPublicFixer(argv, env, io, parseFixerArgv2) {
   });
   return await dispatchAdmittedFixer({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease,
@@ -22353,7 +22558,10 @@ async function runPublicFixerResume(argv, env, io) {
   });
   return await dispatchAdmittedFixer({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease,
@@ -22497,8 +22705,9 @@ async function dispatchAdmittedJudge(input) {
       // and role-runtime can record typed provider HTTP observations.
       AK_ROLE_RUN_DIR: admitted.runDirectory
     };
-    if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
-      childEnv.AK_CORRELATION_ID = env.correlationId;
+    const correlationId = admitted.correlationId ?? env.correlationId;
+    if (correlationId !== void 0 && correlationId.trim() !== "") {
+      childEnv.AK_CORRELATION_ID = correlationId;
     }
     let result2;
     try {
@@ -22631,7 +22840,10 @@ async function runPublicJudge(argv, env, io, parseJudgeArgv2) {
   });
   return await dispatchAdmittedJudge({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease
@@ -22680,7 +22892,10 @@ async function runPublicResume(argv, env, io) {
   });
   return await dispatchAdmittedJudge({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease
@@ -22838,8 +23053,9 @@ async function dispatchAdmittedMerger(input) {
       PI_CODING_AGENT_DIR: env.agentDir,
       AK_ROLE_RUN_DIR: admitted.runDirectory
     };
-    if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
-      childEnv.AK_CORRELATION_ID = env.correlationId;
+    const correlationId = admitted.correlationId ?? env.correlationId;
+    if (correlationId !== void 0 && correlationId.trim() !== "") {
+      childEnv.AK_CORRELATION_ID = correlationId;
     }
     let result2;
     try {
@@ -23071,7 +23287,10 @@ async function runPublicMerger(argv, env, io, parseMergerArgv2) {
   });
   return await dispatchAdmittedMerger({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease,
@@ -23139,7 +23358,10 @@ async function runPublicMergerResume(argv, env, io) {
   });
   return await dispatchAdmittedMerger({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease,
@@ -23183,6 +23405,7 @@ function buildReviewerActivationExtraArgs(admitted, options) {
     options.packageRoot,
     "code-review"
   );
+  const authorityRefArgs = admitted.authorityRefs.length === 0 ? [] : ["--ak-review-authority-refs", JSON.stringify([...admitted.authorityRefs])];
   return [
     "--no-skills",
     "--skill",
@@ -23199,6 +23422,7 @@ function buildReviewerActivationExtraArgs(admitted, options) {
     "reviewer",
     "--ak-review-base",
     admitted.baseRevision,
+    ...authorityRefArgs,
     "--mode",
     "json",
     ...buildModelArgs7(options.model),
@@ -23210,6 +23434,7 @@ function buildReviewerResumeActivationExtraArgs(admitted, options) {
     options.packageRoot,
     "code-review"
   );
+  const authorityRefArgs = admitted.authorityRefs.length === 0 ? [] : ["--ak-review-authority-refs", JSON.stringify([...admitted.authorityRefs])];
   return [
     "--no-skills",
     "--skill",
@@ -23226,6 +23451,7 @@ function buildReviewerResumeActivationExtraArgs(admitted, options) {
     "reviewer",
     "--ak-review-base",
     admitted.baseRevision,
+    ...authorityRefArgs,
     "--mode",
     "json",
     ...buildModelArgs7(options.model),
@@ -23300,8 +23526,9 @@ async function dispatchAdmittedReviewer(input) {
       PI_CODING_AGENT_DIR: env.agentDir,
       AK_ROLE_RUN_DIR: admitted.runDirectory
     };
-    if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
-      childEnv.AK_CORRELATION_ID = env.correlationId;
+    const correlationId = admitted.correlationId ?? env.correlationId;
+    if (correlationId !== void 0 && correlationId.trim() !== "") {
+      childEnv.AK_CORRELATION_ID = correlationId;
     }
     let result2;
     try {
@@ -23418,6 +23645,7 @@ async function runPublicReviewer(argv, env, io, parseReviewerArgv2) {
       instruction: parsed.instruction,
       attachmentPaths: parsed.attachmentPaths,
       baseRevision: parsed.baseRevision,
+      authorityRefs: parsed.authorityRefs,
       ...parsed.project === void 0 ? {} : { project: parsed.project },
       ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
     });
@@ -23462,7 +23690,10 @@ async function runPublicReviewer(argv, env, io, parseReviewerArgv2) {
   });
   return await dispatchAdmittedReviewer({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease,
@@ -23529,7 +23760,10 @@ async function runPublicReviewerResume(argv, env, io) {
   });
   return await dispatchAdmittedReviewer({
     admitted,
-    env,
+    env: {
+      ...env,
+      ...admitted.correlationId === void 0 ? {} : { correlationId: admitted.correlationId }
+    },
     io,
     extraArgs,
     lease,
@@ -23554,6 +23788,7 @@ var init_reviewer_run = __esm({
 var cli_exports = {};
 __export(cli_exports, {
   CliUsageError: () => CliUsageError,
+  PUBLIC_ROLE_ARGV: () => PUBLIC_ROLE_ARGV,
   buildExplicitInternalActivationArgs: () => buildExplicitInternalActivationArgs,
   helpDocument: () => helpDocument,
   resolveInternalRoleEntrypoint: () => resolveInternalRoleEntrypoint,
@@ -23562,6 +23797,42 @@ __export(cli_exports, {
 import { realpath as realpath5 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { join as join18 } from "node:path";
+function takePublicGlobalFlag(argv, index) {
+  const token = argv[index];
+  if (token === void 0) return void 0;
+  if (token === "--help" || token === "-h") {
+    return { flag: "help", consume: 1 };
+  }
+  if (token === "--model") {
+    const value = argv[index + 1];
+    if (value === void 0) {
+      return { flag: "model", consume: 1, value: void 0 };
+    }
+    return { flag: "model", consume: 2, value };
+  }
+  if (token.startsWith("--model=")) {
+    return {
+      flag: "model",
+      consume: 1,
+      value: token.slice("--model=".length)
+    };
+  }
+  if (token === "--thinking") {
+    const raw = argv[index + 1];
+    if (raw === void 0) {
+      return { flag: "thinking", consume: 1, raw: void 0 };
+    }
+    return { flag: "thinking", consume: 2, raw };
+  }
+  if (token.startsWith("--thinking=")) {
+    return {
+      flag: "thinking",
+      consume: 1,
+      raw: token.slice("--thinking=".length)
+    };
+  }
+  return void 0;
+}
 function defaultIo() {
   return {
     stdout: (text) => {
@@ -23591,40 +23862,34 @@ function parseArgv(argv) {
   let help = false;
   const positional = [];
   while (args.length > 0) {
-    const token = args.shift();
-    if (token === "--") {
+    if (args[0] === "--") {
+      args.shift();
       positional.push(...args);
       break;
     }
-    if (token === "--help" || token === "-h") {
-      help = true;
-      continue;
-    }
-    if (token === "--model") {
-      const value = args.shift();
-      if (value === void 0) throw new CliUsageError("--model requires a value");
-      model = value;
-      continue;
-    }
-    if (token.startsWith("--model=")) {
-      model = token.slice("--model=".length);
-      continue;
-    }
-    if (token === "--thinking") {
-      const value = args.shift();
-      if (value === void 0) throw new CliUsageError("--thinking requires a value");
-      thinking = parseThinking(value);
-      continue;
-    }
-    if (token.startsWith("--thinking=")) {
-      thinking = parseThinking(token.slice("--thinking=".length));
-      continue;
-    }
-    if (token.startsWith("-") && token !== "-") {
-      positional.push(token);
+    const taken = takePublicGlobalFlag(args, 0);
+    if (taken !== void 0) {
+      if (taken.flag === "help") {
+        help = true;
+        args.splice(0, taken.consume);
+        continue;
+      }
+      if (taken.flag === "model") {
+        if (taken.value === void 0) {
+          throw new CliUsageError("--model requires a value");
+        }
+        model = taken.value;
+        args.splice(0, taken.consume);
+        continue;
+      }
+      if (taken.raw === void 0) {
+        throw new CliUsageError("--thinking requires a value");
+      }
+      thinking = parseThinking(taken.raw);
+      args.splice(0, taken.consume);
       continue;
     }
-    positional.push(token);
+    positional.push(args.shift());
   }
   const [command, ...rest] = positional;
   return {
@@ -23957,7 +24222,7 @@ async function runAkRole(argv, env) {
           ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
         },
         io,
-        parseJudgeArgv
+        PUBLIC_ROLE_ARGV.judge.parse
       );
       return {
         exitCode: result2.exitCode,
@@ -23991,7 +24256,7 @@ async function runAkRole(argv, env) {
           ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
         },
         io,
-        parseCoderArgv
+        PUBLIC_ROLE_ARGV.coder.parse
       );
       return {
         exitCode: result2.exitCode,
@@ -24025,7 +24290,7 @@ async function runAkRole(argv, env) {
           ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
         },
         io,
-        parseFixerArgv
+        PUBLIC_ROLE_ARGV.fixer.parse
       );
       return {
         exitCode: result2.exitCode,
@@ -24059,7 +24324,7 @@ async function runAkRole(argv, env) {
           ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
         },
         io,
-        parseCollectorArgv
+        PUBLIC_ROLE_ARGV.collector.parse
       );
       return {
         exitCode: result2.exitCode,
@@ -24093,7 +24358,7 @@ async function runAkRole(argv, env) {
           ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
         },
         io,
-        parseReviewerArgv
+        PUBLIC_ROLE_ARGV.reviewer.parse
       );
       return {
         exitCode: result2.exitCode,
@@ -24127,7 +24392,7 @@ async function runAkRole(argv, env) {
           ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
         },
         io,
-        parseDoctorArgv
+        PUBLIC_ROLE_ARGV.doctor.parse
       );
       return {
         exitCode: result2.exitCode,
@@ -24161,7 +24426,7 @@ async function runAkRole(argv, env) {
           ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
         },
         io,
-        parseMergerArgv
+        PUBLIC_ROLE_ARGV.merger.parse
       );
       return {
         exitCode: result2.exitCode,
@@ -24183,7 +24448,7 @@ async function runAkRole(argv, env) {
     return { exitCode: 1 };
   }
 }
-var THINKING_LEVELS2;
+var PUBLIC_ROLE_ARGV, THINKING_LEVELS2;
 var init_cli = __esm({
   "src/public-cli/cli.ts"() {
     "use strict";
@@ -24203,6 +24468,15 @@ var init_cli = __esm({
     init_settlement();
     init_explicit_internal();
     init_cli_errors();
+    PUBLIC_ROLE_ARGV = {
+      judge: { parse: parseJudgeArgv },
+      coder: { parse: parseCoderArgv },
+      fixer: { parse: parseFixerArgv },
+      collector: { parse: parseCollectorArgv },
+      doctor: { parse: parseDoctorArgv },
+      merger: { parse: parseMergerArgv },
+      reviewer: { parse: parseReviewerArgv }
+    };
     THINKING_LEVELS2 = /* @__PURE__ */ new Set([
       "off",
       "minimal",