@akagilnc/pi-workflow-roles 0.1.2020 → 0.1.2033

package/dist/public-cli/main.js

@@ -14387,12 +14387,15 @@ function parseModelSpec(spec, fallbackThinking) {
   const thinkingSplit = trimmed.lastIndexOf(":");
   let modelPart = trimmed;
   let thinking = fallbackThinking;
-  if (thinkingSplit > 0) {
+  if (thinkingSplit !== -1) {
     const maybeThinking = trimmed.slice(thinkingSplit + 1);
-    if (THINKING_LEVELS.has(maybeThinking)) {
-      thinking = maybeThinking;
-      modelPart = trimmed.slice(0, thinkingSplit);
+    if (!THINKING_LEVELS.has(maybeThinking)) {
+      throw new Error(
+        `model specification must be provider/model[:thinking], got ${spec}`
+      );
     }
+    thinking = maybeThinking;
+    modelPart = trimmed.slice(0, thinkingSplit);
   }
   const slash = modelPart.indexOf("/");
   if (slash <= 0 || slash === modelPart.length - 1) {
@@ -14402,15 +14405,34 @@ function parseModelSpec(spec, fallbackThinking) {
   }
   const provider = modelPart.slice(0, slash);
   const model = modelPart.slice(slash + 1);
-  if (!thinking) {
+  return thinking === void 0 ? { provider, model } : { provider, model, thinking };
+}
+function parsePersistentModelSpec(spec) {
+  const parsed = parseModelSpec(spec);
+  if (parsed.thinking === void 0) {
     throw new Error(
       `model specification requires a thinking level (provider/model:thinking), got ${spec}`
     );
   }
-  return { provider, model, thinking };
+  return {
+    provider: parsed.provider,
+    model: parsed.model,
+    thinking: parsed.thinking
+  };
 }
 function formatModelSpec(selection) {
-  return `${selection.provider}/${selection.model}:${selection.thinking}`;
+  const base = `${selection.provider}/${selection.model}`;
+  return selection.thinking === void 0 ? base : `${base}:${selection.thinking}`;
+}
+function buildSeatModelCliArgs(model) {
+  if (model === void 0) return [];
+  return [
+    "--provider",
+    model.provider,
+    "--model",
+    model.model,
+    ...model.thinking === void 0 ? [] : ["--thinking", model.thinking]
+  ];
 }
 function parsePublicCliConfig(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -15432,7 +15454,15 @@ import {
   writeFile as writeFile2
 } from "node:fs/promises";
 import { basename as basename3, isAbsolute as isAbsolute3, join as join5, resolve as resolve4, sep as sep3 } from "node:path";
-async function writeRoleInvocationLedger(source, role) {
+function effectiveModelLedgerFields(model) {
+  if (model === void 0) return {};
+  return {
+    provider: model.provider,
+    model: model.model,
+    ...model.thinking === void 0 ? {} : { thinking: model.thinking }
+  };
+}
+async function writeRoleInvocationLedger(source, role, effectiveModel) {
   const identity = {
     role,
     runId: source.runId,
@@ -15442,7 +15472,8 @@ async function writeRoleInvocationLedger(source, role) {
     sessionDirectory: source.sessionDirectory,
     sessionFile: source.sessionFile,
     ...source.correlationId === void 0 ? {} : { correlationId: source.correlationId },
-    ...source.ticketNumber === void 0 ? {} : { ticketNumber: source.ticketNumber }
+    ...source.ticketNumber === void 0 ? {} : { ticketNumber: source.ticketNumber },
+    ...effectiveModelLedgerFields(effectiveModel)
   };
   await writeFile2(
     join5(source.runDirectory, "invocation.json"),
@@ -15451,6 +15482,26 @@ async function writeRoleInvocationLedger(source, role) {
     "utf8"
   );
 }
+async function recordEffectiveInvocationModel(runDirectory, model) {
+  const ledgerPath = join5(runDirectory, "invocation.json");
+  const current = JSON.parse(await readFile4(ledgerPath, "utf8"));
+  const next = {
+    ...current,
+    provider: model.provider,
+    model: model.model
+  };
+  if (model.thinking === void 0) {
+    delete next.thinking;
+  } else {
+    next.thinking = model.thinking;
+  }
+  await writeFile2(
+    ledgerPath,
+    `${JSON.stringify(next, null, 2)}
+`,
+    "utf8"
+  );
+}
 async function mergeInvocationIdentityPage(runDirectory, fields) {
   const ledgerPath = join5(runDirectory, "invocation.json");
   const current = JSON.parse(await readFile4(ledgerPath, "utf8"));
@@ -15753,7 +15804,7 @@ async function admitJudgeInvocation(options) {
   const admittedRequestPath = join5(runDirectory, "admitted-request.json");
   await writeFile2(admittedRequestPath, `${JSON.stringify(admitted, null, 2)}
 `, "utf8");
-  await writeRoleInvocationLedger(admitted, admitted.role);
+  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
   return {
     role: "judge",
     runId,
@@ -15835,7 +15886,7 @@ async function admitCoderInvocation(options) {
   const admittedRequestPath = join5(runDirectory, "admitted-request.json");
   await writeFile2(admittedRequestPath, `${JSON.stringify(admitted, null, 2)}
 `, "utf8");
-  await writeRoleInvocationLedger(admitted, admitted.role);
+  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
   return {
     role: "coder",
     phase: options.phase,
@@ -15950,7 +16001,7 @@ async function admitFixerInvocation(options) {
   const admittedRequestPath = join5(runDirectory, "admitted-request.json");
   await writeFile2(admittedRequestPath, `${JSON.stringify(admitted, null, 2)}
 `, "utf8");
-  await writeRoleInvocationLedger(admitted, admitted.role);
+  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
   return {
     role: "fixer",
     phase: options.phase,
@@ -16194,7 +16245,7 @@ async function admitCollectorInvocation(options) {
 `,
     "utf8"
   );
-  await writeRoleInvocationLedger(admitted, admitted.role);
+  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
   return {
     role: "collector",
     runId,
@@ -16444,7 +16495,7 @@ async function admitDoctorInvocation(options) {
 `,
     "utf8"
   );
-  await writeRoleInvocationLedger(admitted, admitted.role);
+  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
   return {
     role: "doctor",
     runId,
@@ -16578,7 +16629,7 @@ async function admitReviewerInvocation(options) {
 `,
     "utf8"
   );
-  await writeRoleInvocationLedger(admitted, admitted.role);
+  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
   return {
     role: "reviewer",
     runId,
@@ -16765,7 +16816,7 @@ async function admitMergerInvocation(options) {
 `,
     "utf8"
   );
-  await writeRoleInvocationLedger(admitted, admitted.role);
+  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
   return {
     role: "merger",
     runId,
@@ -17816,7 +17867,10 @@ async function markRunAdmitted(admitted) {
     ...admitted.role === "coder" || admitted.role === "fixer" ? { phase: admitted.phase } : {}
   });
 }
-async function markRunRunning(runDirectory) {
+async function markRunRunning(runDirectory, effectiveModel) {
+  if (effectiveModel !== void 0) {
+    await recordEffectiveInvocationModel(runDirectory, effectiveModel);
+  }
   const current = await readRoleRunState(runDirectory);
   if (current === void 0) {
     throw new Error("cannot mark running: run state missing");
@@ -18394,11 +18448,14 @@ var init_tool_execution_observation = __esm({
 });
 
 // src/package-owned-tool-idle.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var packageOwnedToolIdleScope;
 var init_package_owned_tool_idle = __esm({
   "src/package-owned-tool-idle.ts"() {
     "use strict";
     init_stream_idle_guard();
     init_tool_execution_observation();
+    packageOwnedToolIdleScope = new AsyncLocalStorage();
   }
 });
 
@@ -18470,6 +18527,7 @@ var init_compliance_transport = __esm({
     init_build();
     init_evidence_child_executor();
     init_auditor_dossier_tool();
+    init_package_owned_tool_idle();
     nonblank2 = typebox_exports.String({ minLength: 1, pattern: "\\S" });
     decisionGateSchema = typebox_exports.Object({ question: nonblank2, options: typebox_exports.Array(nonblank2, { minItems: 1 }) }, { additionalProperties: false });
     complianceDecisionSchema = typebox_exports.Object({ status: typebox_exports.Unknown({ description: "Auditor decision status." }), violations: typebox_exports.Array(nonblank2, { description: "Observed compliance violations." }), conflicts: typebox_exports.Array(nonblank2, { description: "Unresolved authority or execution conflicts." }), decisionGate: typebox_exports.Union([decisionGateSchema, typebox_exports.Null()], { description: "Escalation question and available options." }) }, { additionalProperties: true, required: [] });
@@ -21605,17 +21663,6 @@ var init_settlement = __esm({
 // src/public-cli/coder-run.ts
 import { writeFile as writeFile6 } from "node:fs/promises";
 import { join as join11 } from "node:path";
-function buildModelArgs(model) {
-  if (model === void 0) return [];
-  return [
-    "--provider",
-    model.provider,
-    "--model",
-    model.model,
-    "--thinking",
-    model.thinking
-  ];
-}
 function buildCoderActivationExtraArgs(admitted, options) {
   const prompt = buildCoderTransportPrompt(admitted);
   const skillArgs = admitted.phase === "apply" ? [
@@ -21641,7 +21688,7 @@ function buildCoderActivationExtraArgs(admitted, options) {
     admitted.taskPath,
     "--mode",
     "json",
-    ...buildModelArgs(options.model),
+    ...buildSeatModelCliArgs(options.model),
     prompt
   ];
 }
@@ -21669,7 +21716,7 @@ function buildCoderResumeActivationExtraArgs(admitted, options) {
     admitted.taskPath,
     "--mode",
     "json",
-    ...buildModelArgs(options.model),
+    ...buildSeatModelCliArgs(options.model),
     RESUME_TRANSPORT_ENVELOPE
   ];
 }
@@ -21735,7 +21782,7 @@ async function dispatchAdmittedCoder(input) {
         io
       );
     }
-    await markRunRunning(admitted.runDirectory);
+    await markRunRunning(admitted.runDirectory, env.model);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     const childEnv = {
       ...process.env,
@@ -21841,7 +21888,8 @@ async function runPublicCoder(argv, env, io, parseCoderArgv2) {
       instruction: parsed.instruction,
       attachmentPaths: parsed.attachmentPaths,
       ...parsed.project === void 0 ? {} : { project: parsed.project },
-      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+      ...env.model === void 0 ? {} : { model: env.model }
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -21995,17 +22043,6 @@ var init_coder_run = __esm({
 // src/public-cli/collector-run.ts
 import { writeFile as writeFile7 } from "node:fs/promises";
 import { join as join12 } from "node:path";
-function buildModelArgs2(model) {
-  if (model === void 0) return [];
-  return [
-    "--provider",
-    model.provider,
-    "--model",
-    model.model,
-    "--thinking",
-    model.thinking
-  ];
-}
 function buildCollectorActivationExtraArgs(admitted, options = {}) {
   const prompt = buildCollectorTransportPrompt(admitted);
   return [
@@ -22027,7 +22064,7 @@ function buildCollectorActivationExtraArgs(admitted, options = {}) {
     ...admitted.requestManifestPath === void 0 ? [] : ["--ak-collector-request-manifest", admitted.requestManifestPath],
     "--mode",
     "json",
-    ...buildModelArgs2(options.model),
+    ...buildSeatModelCliArgs(options.model),
     prompt
   ];
 }
@@ -22068,7 +22105,7 @@ async function dispatchAdmittedCollector(input) {
         io
       );
     }
-    await markRunRunning(admitted.runDirectory);
+    await markRunRunning(admitted.runDirectory, env.model);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     const childEnv = {
       ...process.env,
@@ -22181,7 +22218,8 @@ async function runPublicCollector(argv, env, io, parseCollectorArgv2) {
       ...parsed.project === void 0 ? {} : { project: parsed.project },
       ...parsed.repo === void 0 ? {} : { repo: parsed.repo },
       ...parsed.requestManifestPath === void 0 ? {} : { requestManifestPath: parsed.requestManifestPath },
-      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+      ...env.model === void 0 ? {} : { model: env.model }
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -22232,17 +22270,6 @@ var init_collector_run = __esm({
 // src/public-cli/doctor-run.ts
 import { writeFile as writeFile8 } from "node:fs/promises";
 import { join as join13 } from "node:path";
-function buildModelArgs3(model) {
-  if (model === void 0) return [];
-  return [
-    "--provider",
-    model.provider,
-    "--model",
-    model.model,
-    "--thinking",
-    model.thinking
-  ];
-}
 function buildDoctorActivationExtraArgs(admitted, options = {}) {
   const prompt = buildDoctorTransportPrompt(admitted);
   return [
@@ -22261,7 +22288,7 @@ function buildDoctorActivationExtraArgs(admitted, options = {}) {
     admitted.caseRunsPath,
     "--mode",
     "json",
-    ...buildModelArgs3(options.model),
+    ...buildSeatModelCliArgs(options.model),
     prompt
   ];
 }
@@ -22299,7 +22326,7 @@ async function dispatchAdmittedDoctor(input) {
         io
       );
     }
-    await markRunRunning(admitted.runDirectory);
+    await markRunRunning(admitted.runDirectory, env.model);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     const childEnv = {
       ...process.env,
@@ -22417,7 +22444,8 @@ async function runPublicDoctor(argv, env, io, parseDoctorArgv2) {
       attachmentPaths: parsed.attachmentPaths,
       ...parsed.project === void 0 ? {} : { project: parsed.project },
       ...parsed.runs === void 0 ? {} : { runs: parsed.runs },
-      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+      ...env.model === void 0 ? {} : { model: env.model }
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -22465,17 +22493,6 @@ var init_doctor_run = __esm({
 // src/public-cli/fixer-run.ts
 import { writeFile as writeFile9 } from "node:fs/promises";
 import { join as join14 } from "node:path";
-function buildModelArgs4(model) {
-  if (model === void 0) return [];
-  return [
-    "--provider",
-    model.provider,
-    "--model",
-    model.model,
-    "--thinking",
-    model.thinking
-  ];
-}
 function buildFixerActivationExtraArgs(admitted, options) {
   const prompt = buildFixerTransportPrompt(admitted);
   const diagnosisSkillPath = resolvePackagedMethodSkillPath(
@@ -22507,7 +22524,7 @@ function buildFixerActivationExtraArgs(admitted, options) {
     ...prerequisiteArgs,
     "--mode",
     "json",
-    ...buildModelArgs4(options.model),
+    ...buildSeatModelCliArgs(options.model),
     prompt
   ];
 }
@@ -22541,7 +22558,7 @@ function buildFixerResumeActivationExtraArgs(admitted, options) {
     ...prerequisiteArgs,
     "--mode",
     "json",
-    ...buildModelArgs4(options.model),
+    ...buildSeatModelCliArgs(options.model),
     RESUME_TRANSPORT_ENVELOPE
   ];
 }
@@ -22604,7 +22621,7 @@ async function dispatchAdmittedFixer(input) {
         io
       );
     }
-    await markRunRunning(admitted.runDirectory);
+    await markRunRunning(admitted.runDirectory, env.model);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     const childEnv = {
       ...process.env,
@@ -22733,7 +22750,8 @@ async function runPublicFixer(argv, env, io, parseFixerArgv2) {
       attachmentPaths: parsed.attachmentPaths,
       ...parsed.prerequisitesPath === void 0 ? {} : { prerequisitesPath: parsed.prerequisitesPath },
       ...parsed.project === void 0 ? {} : { project: parsed.project },
-      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+      ...env.model === void 0 ? {} : { model: env.model }
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -22873,17 +22891,6 @@ var init_fixer_run = __esm({
 // src/public-cli/judge-run.ts
 import { writeFile as writeFile10 } from "node:fs/promises";
 import { join as join15 } from "node:path";
-function buildModelArgs5(model) {
-  if (model === void 0) return [];
-  return [
-    "--provider",
-    model.provider,
-    "--model",
-    model.model,
-    "--thinking",
-    model.thinking
-  ];
-}
 function buildJudgeActivationExtraArgs(admitted, options = {}) {
   const prompt = buildJudgeTransportPrompt(admitted);
   return [
@@ -22901,7 +22908,7 @@ function buildJudgeActivationExtraArgs(admitted, options = {}) {
     "judge",
     "--mode",
     "json",
-    ...buildModelArgs5(options.model),
+    ...buildSeatModelCliArgs(options.model),
     prompt
   ];
 }
@@ -22920,7 +22927,7 @@ function buildJudgeResumeActivationExtraArgs(admitted, options = {}) {
     "judge",
     "--mode",
     "json",
-    ...buildModelArgs5(options.model),
+    ...buildSeatModelCliArgs(options.model),
     RESUME_TRANSPORT_ENVELOPE
   ];
 }
@@ -22983,7 +22990,7 @@ async function dispatchAdmittedJudge(input) {
         io
       );
     }
-    await markRunRunning(admitted.runDirectory);
+    await markRunRunning(admitted.runDirectory, env.model);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     const childEnv = {
       ...process.env,
@@ -23102,7 +23109,8 @@ async function runPublicJudge(argv, env, io, parseJudgeArgv2) {
       instruction: parsed.instruction,
       attachmentPaths: parsed.attachmentPaths,
       ...parsed.project === void 0 ? {} : { project: parsed.project },
-      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+      ...env.model === void 0 ? {} : { model: env.model }
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -23205,17 +23213,6 @@ var init_judge_run = __esm({
 // src/public-cli/merger-run.ts
 import { mkdir as mkdir4, writeFile as writeFile11 } from "node:fs/promises";
 import { join as join16, resolve as resolve7 } from "node:path";
-function buildModelArgs6(model) {
-  if (model === void 0) return [];
-  return [
-    "--provider",
-    model.provider,
-    "--model",
-    model.model,
-    "--thinking",
-    model.thinking
-  ];
-}
 function buildMergerActivationExtraArgs(admitted, options) {
   const prompt = buildMergerTransportPrompt(admitted);
   const skillPath = resolvePackagedMethodSkillPath(
@@ -23240,7 +23237,7 @@ function buildMergerActivationExtraArgs(admitted, options) {
     admitted.mergerInputPath,
     "--mode",
     "json",
-    ...buildModelArgs6(options.model),
+    ...buildSeatModelCliArgs(options.model),
     prompt
   ];
 }
@@ -23267,7 +23264,7 @@ function buildMergerResumeActivationExtraArgs(admitted, options) {
     admitted.mergerInputPath,
     "--mode",
     "json",
-    ...buildModelArgs6(options.model),
+    ...buildSeatModelCliArgs(options.model),
     RESUME_TRANSPORT_ENVELOPE
   ];
 }
@@ -23333,7 +23330,7 @@ async function dispatchAdmittedMerger(input) {
         io
       );
     }
-    await markRunRunning(admitted.runDirectory);
+    await markRunRunning(admitted.runDirectory, env.model);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     const childEnv = {
       ...process.env,
@@ -23509,7 +23506,8 @@ async function runPublicMerger(argv, env, io, parseMergerArgv2) {
       instruction: parsed.instruction,
       attachmentPaths: parsed.attachmentPaths,
       ...parsed.project === void 0 ? {} : { project: parsed.project },
-      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+      ...env.model === void 0 ? {} : { model: env.model }
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -23676,17 +23674,6 @@ var init_merger_run = __esm({
 // src/public-cli/reviewer-run.ts
 import { writeFile as writeFile12 } from "node:fs/promises";
 import { join as join17 } from "node:path";
-function buildModelArgs7(model) {
-  if (model === void 0) return [];
-  return [
-    "--provider",
-    model.provider,
-    "--model",
-    model.model,
-    "--thinking",
-    model.thinking
-  ];
-}
 function buildReviewerTicketNumberArgs(ticketNumber) {
   return ticketNumber === void 0 ? [] : ["--ak-review-ticket-number", String(ticketNumber)];
 }
@@ -23718,7 +23705,7 @@ function buildReviewerActivationExtraArgs(admitted, options) {
     ...ticketNumberArgs,
     "--mode",
     "json",
-    ...buildModelArgs7(options.model),
+    ...buildSeatModelCliArgs(options.model),
     prompt
   ];
 }
@@ -23749,7 +23736,7 @@ function buildReviewerResumeActivationExtraArgs(admitted, options) {
     ...ticketNumberArgs,
     "--mode",
     "json",
-    ...buildModelArgs7(options.model),
+    ...buildSeatModelCliArgs(options.model),
     RESUME_TRANSPORT_ENVELOPE
   ];
 }
@@ -23812,7 +23799,7 @@ async function dispatchAdmittedReviewer(input) {
         io
       );
     }
-    await markRunRunning(admitted.runDirectory);
+    await markRunRunning(admitted.runDirectory, env.model);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     await clearReviewerDispatchRejection(admitted.runDirectory);
     const childEnv = {
@@ -23942,7 +23929,8 @@ async function runPublicReviewer(argv, env, io, parseReviewerArgv2) {
       baseRevision: parsed.baseRevision,
       authorityRefs: parsed.authorityRefs,
       ...parsed.project === void 0 ? {} : { project: parsed.project },
-      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+      ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+      ...env.model === void 0 ? {} : { model: env.model }
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -26365,7 +26353,7 @@ async function runConfigCommand(args, home, io) {
       if (!isPublicConfigurableSeat(seat)) {
         throw new CliUsageError(`unknown configurable seat: ${seat}`);
       }
-      config = setPersistentSeatConfig(config, seat, parseModelSpec(spec));
+      config = setPersistentSeatConfig(config, seat, parsePersistentModelSpec(spec));
     }
     await savePublicCliConfig(config, home);
     io.stdout(renderConfig(config));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.2020",
+  "version": "0.1.2033",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/compliance-transport.ts

@@ -7,6 +7,7 @@ import {
 } from "./evidence-child-executor.ts";
 import { createAuditorDossierTool } from "./auditor-dossier-tool.ts";
 import type { DossierObservation } from "./dossier-resolution.ts";
+import { withPackageOwnedToolIdleSuspended } from "./package-owned-tool-idle.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 
 export type ComplianceCompletion = AuditorCompletion;
@@ -116,24 +117,28 @@ export type RunComplianceAuditOptions = {
 };
 
 export async function runComplianceAudit(options: RunComplianceAuditOptions): Promise<ComplianceDecision> {
-  const prompt = options.serializedInput ?? AUDITOR_DOSSIER_PROMPT;
-  const receipt = await executeAuditorChild({
-    tool: options.tool,
-    dossierTool: createAuditorDossierTool(options.runDirectory),
-    systemPrompt: options.systemPrompt,
-    prompt,
-    roleLabel: options.roleLabel,
-    context: options.context,
-    retainResponse: (response) => retainComplianceResponse(options.context, response),
-    ...(options.runCompletion === undefined ? {} : { runCompletion: options.runCompletion }),
-    ...(options.signal === undefined ? {} : { signal: options.signal }),
+  // #339: only the real compliance-audit await leaves the outer package-owned
+  // idle owner. Pre/post-audit work stays under the single outer backstop.
+  return withPackageOwnedToolIdleSuspended(async () => {
+    const prompt = options.serializedInput ?? AUDITOR_DOSSIER_PROMPT;
+    const receipt = await executeAuditorChild({
+      tool: options.tool,
+      dossierTool: createAuditorDossierTool(options.runDirectory),
+      systemPrompt: options.systemPrompt,
+      prompt,
+      roleLabel: options.roleLabel,
+      context: options.context,
+      retainResponse: (response) => retainComplianceResponse(options.context, response),
+      ...(options.runCompletion === undefined ? {} : { runCompletion: options.runCompletion }),
+      ...(options.signal === undefined ? {} : { signal: options.signal }),
+    });
+    if (receipt.noReceiptLifecycle !== undefined) {
+      return {
+        status: "no-receipt",
+        ...receipt.noReceiptLifecycle,
+        ...(receipt.response.usage === undefined ? {} : { usage: receipt.response.usage }),
+      };
+    }
+    return readComplianceCandidate(receipt.decision, receipt.response.usage);
   });
-  if (receipt.noReceiptLifecycle !== undefined) {
-    return {
-      status: "no-receipt",
-      ...receipt.noReceiptLifecycle,
-      ...(receipt.response.usage === undefined ? {} : { usage: receipt.response.usage }),
-    };
-  }
-  return readComplianceCandidate(receipt.decision, receipt.response.usage);
 }

package/src/evidence-child-executor.ts

@@ -381,6 +381,10 @@ export async function createInheritedRuntime(options: InheritedRuntimeOptions):
     };
 
   runtime.registerNativeProvider(provider);
+  // registerNativeProvider fires a background refresh; await it so child
+  // AgentSession.prompt sees configured auth without racing void refresh
+  // (mock timers / slow CI otherwise stall before the compliance stream).
+  await runtime.refresh({ allowNetwork: false });
   return state;
 }