@akagilnc/pi-workflow-roles 0.1.2135 → 0.1.2146

package/README.md

@@ -40,7 +40,7 @@ ak-role config unset-engine judge
 
 Receipts are typed, so callers compose roles without parsing prose; ordering and stopping stay caller-owned. Programmatic consumers derive contracts from the exported schemas in `src/package-contracts/`, not from this guide.
 
-When a labor-engine detour fails and the seat continues the labor on the main road, the typed receipt may carry a mechanical `engineLaborFallback` field: `{ engine, failure, laborBy: "seat" }`. It appears only after a real detour failure that fell back to seat labor (including package-owned idle timeout on the detour tool)—not on detour success or caller cancel. First failure wins for the activation; model-forged `engineLaborFallback` keys are stripped unless the package latch recorded one. Sole producer: `src/engine-labor-fallback.ts`; decision record: [ADR 0071](docs/adr/0071-engine-detour-failure-seat-fallback-declaration.md). This README only projects that contract.
+When a labor-engine detour fails and the seat continues the labor on the main road, the typed receipt may carry a mechanical `engineLaborFallback` field: `{ engine, failure, laborBy: "seat" }`. It appears only after a real detour failure that fell back to seat labor—not on detour success or caller cancel. First failure wins for the activation; model-forged `engineLaborFallback` keys are stripped unless the package latch recorded one. Sole producer: `src/engine-labor-fallback.ts`; decision record: [ADR 0071](docs/adr/0071-engine-detour-failure-seat-fallback-declaration.md). This README only projects that contract.
 
 ## Call the roles
 

package/README.zh-CN.md

@@ -40,7 +40,7 @@ ak-role config unset-engine judge
 
 回执是 typed 的，调用者不必解析散文即可组合角色；顺序与停止归调用者。编程消费者从 `src/package-contracts/` 导出推导契约，不从本文。
 
-当劳务引擎绕行失败、座席回到主路继续劳务时，typed 回执可带机械字段 `engineLaborFallback`：`{ engine, failure, laborBy: "seat" }`。仅在真实绕行失败并座席顶班后出现（含 detour 工具命中 package-owned idle 超时）——成功绕行或调用方 cancel 不出现。同一次 activation 内先到先得；无包内 latch 时剥离模型伪造的 `engineLaborFallback` 键。唯一构造点：`src/engine-labor-fallback.ts`；决策记录：[ADR 0071](docs/adr/0071-engine-detour-failure-seat-fallback-declaration.md)。本文只投影该契约。
+当劳务引擎绕行失败、座席回到主路继续劳务时，typed 回执可带机械字段 `engineLaborFallback`：`{ engine, failure, laborBy: "seat" }`。仅在真实绕行失败并座席顶班后出现——成功绕行或调用方 cancel 不出现。同一次 activation 内先到先得；无包内 latch 时剥离模型伪造的 `engineLaborFallback` 键。唯一构造点：`src/engine-labor-fallback.ts`；决策记录：[ADR 0071](docs/adr/0071-engine-detour-failure-seat-fallback-declaration.md)。本文只投影该契约。
 
 ## 调用百官
 

package/dist/compliance-transport.js

@@ -1,7 +1,6 @@
 import { Type } from "typebox";
 import { executeAuditorChild, } from "./evidence-child-executor.js";
 import { createAuditorDossierTool } from "./auditor-dossier-tool.js";
-import { withPackageOwnedToolIdleSuspended } from "./package-owned-tool-idle.js";
 /** Zero-projection kickoff — soul already carries dossier-fetch duty; no hand-delivered materials. */
 export const AUDITOR_DOSSIER_PROMPT = "Audit the current run dossier.";
 const nonblank = Type.String({ minLength: 1, pattern: "\\S" });
@@ -62,28 +61,24 @@ export function readComplianceCandidate(arguments_, usage) {
     return { status: "audit-incomplete", observation: { kind: "object-status-unreadable", status: status === undefined ? "missing" : "unknown" }, candidate: arguments_, ...(usage === undefined ? {} : { usage }) };
 }
 export async function runComplianceAudit(options) {
-    // #339: only the real compliance-audit await leaves the outer package-owned
-    // idle owner. Pre/post-audit work stays under the single outer backstop.
-    return withPackageOwnedToolIdleSuspended(async () => {
-        const prompt = options.serializedInput ?? AUDITOR_DOSSIER_PROMPT;
-        const receipt = await executeAuditorChild({
-            tool: options.tool,
-            dossierTool: createAuditorDossierTool(options.runDirectory),
-            systemPrompt: options.systemPrompt,
-            prompt,
-            roleLabel: options.roleLabel,
-            context: options.context,
-            retainResponse: (response) => retainComplianceResponse(options.context, response),
-            ...(options.runCompletion === undefined ? {} : { runCompletion: options.runCompletion }),
-            ...(options.signal === undefined ? {} : { signal: options.signal }),
-        });
-        if (receipt.noReceiptLifecycle !== undefined) {
-            return {
-                status: "no-receipt",
-                ...receipt.noReceiptLifecycle,
-                ...(receipt.response.usage === undefined ? {} : { usage: receipt.response.usage }),
-            };
-        }
-        return readComplianceCandidate(receipt.decision, receipt.response.usage);
+    const prompt = options.serializedInput ?? AUDITOR_DOSSIER_PROMPT;
+    const receipt = await executeAuditorChild({
+        tool: options.tool,
+        dossierTool: createAuditorDossierTool(options.runDirectory),
+        systemPrompt: options.systemPrompt,
+        prompt,
+        roleLabel: options.roleLabel,
+        context: options.context,
+        retainResponse: (response) => retainComplianceResponse(options.context, response),
+        ...(options.runCompletion === undefined ? {} : { runCompletion: options.runCompletion }),
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
     });
+    if (receipt.noReceiptLifecycle !== undefined) {
+        return {
+            status: "no-receipt",
+            ...receipt.noReceiptLifecycle,
+            ...(receipt.response.usage === undefined ? {} : { usage: receipt.response.usage }),
+        };
+    }
+    return readComplianceCandidate(receipt.decision, receipt.response.usage);
 }

package/dist/doctor-contracts.js

@@ -1,5 +1,6 @@
 import { Type } from "typebox";
 import { canonicalJson } from "./canonical-json.js";
+import { seatFallbackBaseStatus, seatFallbackStatusHasLawfulEvidence, } from "./engine-labor-fallback.js";
 import { openToolObjectFromUnion } from "./open-tool-schema.js";
 export const DOCTOR_EVIDENCE_TOOL_NAME = "ak_doctor_evidence";
 export const DOCTOR_OUTPUT_TOOL_NAME = "ak_doctor_output";
@@ -66,13 +67,20 @@ catch {
 } }
 export function validateDoctorSubmissionShape(value) {
     const status = read(value, "status");
-    if (status !== "completed" && status !== "refused")
+    const base = typeof status === "string" ? seatFallbackBaseStatus(status) : status;
+    if (base !== "completed" && base !== "refused")
         throw new DoctorSubmissionContractError("Doctor submission has no recognized execution status");
+    // ADR 0071: tainted status requires latch-shaped engineLaborFallback evidence.
+    if (typeof status === "string" && !seatFallbackStatusHasLawfulEvidence(status, value)) {
+        throw new DoctorSubmissionContractError("Doctor submission has no recognized execution status");
+    }
     return value;
 }
 export function validateRecordedDoctorOutput(value) {
     const output = validateDoctorSubmissionShape(value);
-    if (read(output, "status") === "completed" && read(output, "cost") === undefined)
+    const status = read(output, "status");
+    const base = typeof status === "string" ? seatFallbackBaseStatus(status) : status;
+    if (base === "completed" && read(output, "cost") === undefined)
         throw new Error("Completed Doctor receipt has no runtime-owned cost testimony");
     return output;
 }

package/dist/engine-detour-tool.js

@@ -1,7 +1,6 @@
 import { Type } from "typebox";
 import { ENGINE_DETOUR_ALREADY_USED_DIAGNOSTIC, ENGINE_DETOUR_TOOL_NAME, engineDetourFailureDiagnostic, engineNameFromEnv, isEngineDetourFailure, runEngineDetourOnce, } from "./engine-detour.js";
 import { activationEngineLaborFallbackLatch, recordEngineLaborFallback, } from "./engine-labor-fallback.js";
-import { isPackageOwnedToolIdleTimeoutError, pokePackageOwnedToolIdle, wrapPackageOwnedToolDefinition, } from "./package-owned-tool-idle.js";
 const engineDetourArgsSchema = Type.Object({
     argv: Type.Array(Type.String({ minLength: 1 }), {
         minItems: 1,
@@ -23,14 +22,8 @@ function seatFallbackToolResult(field, failure) {
         },
     };
 }
-/** Caller/upper-layer cancel must propagate; idle backstop is seat-fallback, not cancel. */
+/** Caller/upper-layer cancel must propagate; process failure is seat-fallback, not cancel. */
 function isCallerCancellation(error, signal) {
-    if (isPackageOwnedToolIdleTimeoutError(error))
-        return false;
-    if (signal !== undefined &&
-        isPackageOwnedToolIdleTimeoutError(signal.reason)) {
-        return false;
-    }
     if (signal?.aborted === true)
         return true;
     if (typeof error === "object" &&
@@ -44,13 +37,13 @@ function isCallerCancellation(error, signal) {
  * Build one once-latch detour tool definition for a configured engine name.
  * `latch` is shared so parent registration can reset between activations.
  * `fail` owns host abort (parent) vs throw (evidence child) for tool misuse only.
- * Engine process failure (nonzero/empty/spawn/idle-timeout) soft-returns seat fallback (#380).
+ * Engine process failure (nonzero/empty/spawn) soft-returns seat fallback (#380).
  * Caller AbortSignal cancel propagates without writing fallback.
  */
 export function createEngineDetourToolDefinition(input) {
     const latch = input.latch ?? { used: false };
     const engineName = input.engineName;
-    return wrapPackageOwnedToolDefinition({
+    return {
         name: ENGINE_DETOUR_TOOL_NAME,
         label: "Engine Detour",
         description: `Run one labor-engine subprocess (engine=${engineName}) and return its stdout to this session. Call at most once per activation. Build argv from the host CLI actual interface for this engine name; when optional packaged notes are present in the session prompt, follow those bytes too.`,
@@ -83,17 +76,14 @@ export function createEngineDetourToolDefinition(input) {
             };
             let result;
             try {
-                // Byte activity on stdout/stderr touches the outer package-owned idle clock
-                // (183s silence law unchanged). True hangs still die; slow streaming engines live.
                 result = await runEngineDetourOnce({
                     argv,
                     cwd: ctx.cwd,
                     ...(signal === undefined ? {} : { signal }),
-                    onOutputActivity: pokePackageOwnedToolIdle,
                 });
             }
             catch (error) {
-                // Caller cancel: propagate. Idle backstop + spawn/engine failure: seat fallback.
+                // Caller cancel: propagate. Spawn/engine failure: seat fallback.
                 if (isCallerCancellation(error, signal)) {
                     throw error;
                 }
@@ -111,7 +101,7 @@ export function createEngineDetourToolDefinition(input) {
                 },
             };
         },
-    });
+    };
 }
 /**
  * Register the engine-generic detour tool once for this process when any role has

package/dist/engine-detour.js

@@ -48,8 +48,8 @@ export async function runEngineDetourOnce(input) {
     return await new Promise((resolve, reject) => {
         let settled = false;
         const signal = input.signal;
-        // Own abort→kill explicitly so rejection preserves signal.reason (caller cancel
-        // vs package-owned idle). Do not pass `signal` to spawn (Node replaces reason).
+        // Own abort→kill explicitly so rejection preserves signal.reason (caller cancel).
+        // Do not pass `signal` to spawn (Node replaces reason).
         const child = spawn(command, args, {
             cwd: input.cwd,
             env: input.env ?? process.env,
@@ -57,18 +57,11 @@ export async function runEngineDetourOnce(input) {
         });
         let stdout = "";
         let stderr = "";
-        const noteActivity = (chunk) => {
-            if (chunk.length === 0)
-                return;
-            input.onOutputActivity?.();
-        };
         child.stdout.setEncoding("utf8").on("data", (chunk) => {
             stdout += chunk;
-            noteActivity(chunk);
         });
         child.stderr.setEncoding("utf8").on("data", (chunk) => {
             stderr += chunk;
-            noteActivity(chunk);
         });
         const fail = (error) => {
             if (settled)
@@ -89,8 +82,7 @@ export async function runEngineDetourOnce(input) {
             resolve(result);
         };
         const onAbort = () => {
-            // Fail synchronously so cooperative idle/cancel paths can soft-settle
-            // before the outer package-owned idle hard-reject drain.
+            // Fail synchronously so caller-cancel soft-settle preserves signal.reason.
             fail(signal !== undefined ? abortReasonError(signal) : new Error("aborted"));
             try {
                 child.kill("SIGTERM");

package/dist/engine-labor-fallback.js

@@ -1,121 +1,136 @@
-/**
- * #380 — sole shared seat-fallback declaration after engine detour failure.
- * Detour rejoins the main road (ADR 0069); silence is the only crime.
- * Construction of the typed receipt field lives in exactly one site (S1).
- */
-/** Activation-scoped latch holder (one parent seat activation at a time). */
 let activationLatch;
-/** Sole construction site for typed receipt field `engineLaborFallback` (#380 S1). */
-export function buildEngineLaborFallbackField(input) {
-    return Object.freeze({
-        engineLaborFallback: Object.freeze({
-            engine: input.engine,
-            failure: input.failure,
-            laborBy: "seat",
-        }),
-    });
+function buildEngineLaborFallbackField(input) {
+  return Object.freeze({
+    engineLaborFallback: Object.freeze({
+      engine: input.engine,
+      failure: input.failure,
+      laborBy: "seat"
+    })
+  });
 }
-export function createEngineLaborFallbackLatch() {
-    return { field: undefined };
-}
-/**
- * Record first detour failure for this latch (first wins; parallel legs share one field).
- * Always returns the latched first-wins value so tool details and receipt projection match.
- */
-export function recordEngineLaborFallback(latch, input) {
-    const field = buildEngineLaborFallbackField(input);
-    if (latch.field === undefined)
-        latch.field = field;
-    return latch.field;
-}
-export function readEngineLaborFallbackField(latch) {
-    return latch?.field;
-}
-/**
- * Merge sole-built field into typed receipt details.
- * Spread only — must not construct the field key again (S1).
- * Without a mechanical latch, strip any model-injected reserved key (no forged declaration).
- */
-export function withEngineLaborFallbackField(receipt, field) {
-    if (field !== undefined) {
-        return { ...receipt, ...field };
-    }
-    if (!Object.prototype.hasOwnProperty.call(receipt, "engineLaborFallback")) {
-        return receipt;
-    }
-    const { engineLaborFallback: _forged, ...rest } = receipt;
-    return rest;
-}
-/** Install the activation-scoped latch (any role session_start with engine). */
-export function installActivationEngineLaborFallbackLatch(latch) {
-    activationLatch = latch;
-}
-/** Clear activation latch (session end / next activation). */
-export function clearActivationEngineLaborFallbackLatch() {
-    activationLatch = undefined;
-}
-/** Active activation latch, if any (legs inherit parent seat activation). */
-export function activationEngineLaborFallbackLatch() {
-    return activationLatch;
-}
-/** Read fallback field from the active activation latch. */
-export function readActivationEngineLaborFallbackField() {
-    return readEngineLaborFallbackField(activationLatch);
-}
-/**
- * Read a previously attached declaration from a typed receipt / details object.
- * Rebuilds via the sole construction site — callers must spread, never re-key.
- */
-export function readEngineLaborFallbackFieldFrom(source) {
-    if (typeof source !== "object" || source === null || Array.isArray(source)) {
-        return undefined;
-    }
-    let raw;
+const SEAT_FALLBACK_STATUS_SUFFIX = "-by-fallback";
+function isSeatFallbackTaintedStatus(status) {
+  return status.endsWith(SEAT_FALLBACK_STATUS_SUFFIX);
+}
+function seatFallbackBaseStatus(status) {
+  return isSeatFallbackTaintedStatus(status) ? status.slice(0, -SEAT_FALLBACK_STATUS_SUFFIX.length) : status;
+}
+function seatFallbackStatusHasLawfulEvidence(status, source) {
+  if (!isSeatFallbackTaintedStatus(status)) return true;
+  return readEngineLaborFallbackFieldFrom(source) !== void 0;
+}
+function taintStatusForSeatFallback(status) {
+  if (status.length === 0 || isSeatFallbackTaintedStatus(status)) return status;
+  return `${status}${SEAT_FALLBACK_STATUS_SUFFIX}`;
+}
+const STATUS_DISCRIMINATOR_KEYS = ["judgeStatus", "status"];
+function taintReceiptStatusDiscriminators(receipt) {
+  let next;
+  for (const key of STATUS_DISCRIMINATOR_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(receipt, key)) continue;
+    let value;
     try {
-        raw = source.engineLaborFallback;
-    }
-    catch {
-        return undefined;
+      value = receipt[key];
+    } catch {
+      continue;
     }
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
-        return undefined;
-    const rec = raw;
-    if (typeof rec.engine !== "string" ||
-        typeof rec.failure !== "string" ||
-        rec.laborBy !== "seat") {
-        return undefined;
+    if (typeof value !== "string" || value.length === 0) continue;
+    const tainted = taintStatusForSeatFallback(value);
+    if (tainted === value) continue;
+    if (next === void 0) {
+      next = { ...receipt };
     }
-    return buildEngineLaborFallbackField({
-        engine: rec.engine,
-        failure: rec.failure,
-    });
+    next[key] = tainted;
+  }
+  return next === void 0 ? receipt : next;
 }
-/**
- * Restore activation latch from durable session tool results (#380 resume).
- * Scans existing same-session detour tool results only — no sidecar / new entry type.
- * Replays through recordEngineLaborFallback so first-wins + sole producer stay intact.
- */
-export function restoreEngineLaborFallbackFromSessionEntries(latch, entries, toolName) {
-    for (const entry of entries) {
-        if (typeof entry !== "object" || entry === null)
-            continue;
-        const row = entry;
-        if (row.type !== "message")
-            continue;
-        const message = row.message;
-        if (typeof message !== "object" || message === null)
-            continue;
-        const msg = message;
-        if (msg.role !== "toolResult")
-            continue;
-        if (msg.toolName !== toolName)
-            continue;
-        const field = readEngineLaborFallbackFieldFrom(msg.details);
-        if (field === undefined)
-            continue;
-        recordEngineLaborFallback(latch, {
-            engine: field.engineLaborFallback.engine,
-            failure: field.engineLaborFallback.failure,
-        });
-    }
+function createEngineLaborFallbackLatch() {
+  return { field: void 0 };
+}
+function recordEngineLaborFallback(latch, input) {
+  const field = buildEngineLaborFallbackField(input);
+  if (latch.field === void 0) latch.field = field;
+  return latch.field;
+}
+function readEngineLaborFallbackField(latch) {
+  return latch?.field;
+}
+function withEngineLaborFallbackField(receipt, field) {
+  if (field !== void 0) {
+    const taintedReceipt = taintReceiptStatusDiscriminators(receipt);
+    return { ...taintedReceipt, ...field };
+  }
+  if (!Object.prototype.hasOwnProperty.call(receipt, "engineLaborFallback")) {
+    return receipt;
+  }
+  const { engineLaborFallback: _forged, ...rest } = receipt;
+  return rest;
+}
+function installActivationEngineLaborFallbackLatch(latch) {
+  activationLatch = latch;
+}
+function clearActivationEngineLaborFallbackLatch() {
+  activationLatch = void 0;
+}
+function activationEngineLaborFallbackLatch() {
+  return activationLatch;
+}
+function readActivationEngineLaborFallbackField() {
+  return readEngineLaborFallbackField(activationLatch);
+}
+function readEngineLaborFallbackFieldFrom(source) {
+  if (typeof source !== "object" || source === null || Array.isArray(source)) {
+    return void 0;
+  }
+  let raw;
+  try {
+    raw = source.engineLaborFallback;
+  } catch {
+    return void 0;
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
+  const rec = raw;
+  if (typeof rec.engine !== "string" || typeof rec.failure !== "string" || rec.laborBy !== "seat") {
+    return void 0;
+  }
+  return buildEngineLaborFallbackField({
+    engine: rec.engine,
+    failure: rec.failure
+  });
+}
+function restoreEngineLaborFallbackFromSessionEntries(latch, entries, toolName) {
+  for (const entry of entries) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const row = entry;
+    if (row.type !== "message") continue;
+    const message = row.message;
+    if (typeof message !== "object" || message === null) continue;
+    const msg = message;
+    if (msg.role !== "toolResult") continue;
+    if (msg.toolName !== toolName) continue;
+    const field = readEngineLaborFallbackFieldFrom(msg.details);
+    if (field === void 0) continue;
+    recordEngineLaborFallback(latch, {
+      engine: field.engineLaborFallback.engine,
+      failure: field.engineLaborFallback.failure
+    });
+  }
 }
+export {
+  SEAT_FALLBACK_STATUS_SUFFIX,
+  activationEngineLaborFallbackLatch,
+  buildEngineLaborFallbackField,
+  clearActivationEngineLaborFallbackLatch,
+  createEngineLaborFallbackLatch,
+  installActivationEngineLaborFallbackLatch,
+  isSeatFallbackTaintedStatus,
+  readActivationEngineLaborFallbackField,
+  readEngineLaborFallbackField,
+  readEngineLaborFallbackFieldFrom,
+  recordEngineLaborFallback,
+  restoreEngineLaborFallbackFromSessionEntries,
+  seatFallbackBaseStatus,
+  seatFallbackStatusHasLawfulEvidence,
+  taintStatusForSeatFallback,
+  withEngineLaborFallbackField
+};

package/dist/evidence-child-executor.js

@@ -11,7 +11,6 @@ import { AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE, AUDITOR_PARENT_ATTEMPT_BINDING_E
 import { createEngineDetourToolDefinition } from "./engine-detour-tool.js";
 import { engineNameFromEnv } from "./engine-detour.js";
 import { appendEngineSessionMaterial, engineSessionMaterialFromOptions, } from "./package-resources/engine-material.js";
-import { wrapPackageOwnedToolDefinition } from "./package-owned-tool-idle.js";
 import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT } from "./receipt-delivery-policy.js";
 import { REVIEWER_VERIFICATION_BOUNDARY } from "./reviewer-construction.js";
 import { createStreamIdleGuard, isStreamIdleTimeoutError } from "./stream-idle-guard.js";
@@ -599,7 +598,7 @@ export async function executeAuditorChild(options) {
         let decisionToolFailure;
         const decisionToolFailures = new Map();
         const delivery = createReceiptDeliveryPolicy();
-        const tool = wrapPackageOwnedToolDefinition({
+        const tool = {
             ...options.tool,
             label: options.roleLabel,
             async execute(...args) {
@@ -625,7 +624,7 @@ export async function executeAuditorChild(options) {
                     throw error;
                 }
             },
-        });
+        };
         const parentSessionManager = options.context.sessionManager;
         const parentHeader = parentSessionManager?.getHeader?.();
         const parentSessionFile = parentSessionManager?.getSessionFile?.();
@@ -644,7 +643,7 @@ export async function executeAuditorChild(options) {
             thinkingLevel: options.context.thinkingLevel ?? "off",
             modelRuntime: inherited.runtime,
             systemPrompt: options.systemPrompt,
-            customTools: [wrapPackageOwnedToolDefinition({ ...options.dossierTool, label: options.roleLabel }), tool],
+            customTools: [{ ...options.dossierTool, label: options.roleLabel }, tool],
             sessionManager: auditorSessionManager,
         });
         const binding = {

package/dist/merger-contracts.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { isFullGitObjectId } from "./git-object-id.js";
 import { exactUtf8 } from "./exact-utf8.js";
+import { seatFallbackBaseStatus, seatFallbackStatusHasLawfulEvidence, } from "./engine-labor-fallback.js";
 import { sha256Hex } from "./sha256.js";
 import { openToolObjectFromUnion } from "./open-tool-schema.js";
 const oidPattern = "^(?:[0-9a-f]{40}|[0-9a-f]{64})$";
@@ -68,9 +69,15 @@ export function validateMergerInput(value) {
 export function validateMergerOutput(value, expectedAttemptId) {
     if (!record(value) || (expectedAttemptId !== undefined && value.attemptId !== expectedAttemptId))
         throw new Error("Merger output attempt mismatch");
-    if (value.status === "completed" && isFullGitObjectId(value.mergeCommitId))
+    const status = typeof value.status === "string" ? value.status : undefined;
+    const statusBase = status !== undefined ? seatFallbackBaseStatus(status) : undefined;
+    // ADR 0071: tainted status requires latch-shaped engineLaborFallback evidence.
+    if (status !== undefined && !seatFallbackStatusHasLawfulEvidence(status, value)) {
+        throw new Error("Merger output has no recognized execution discriminator");
+    }
+    if (statusBase === "completed" && isFullGitObjectId(value.mergeCommitId))
         return structuredClone(value);
-    if (value.status === "escalate")
+    if (statusBase === "escalate")
         return structuredClone(value);
     throw new Error("Merger output has no recognized execution discriminator");
 }

package/dist/navigator-attendance.js

@@ -6,6 +6,7 @@ import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 import { createAssistantMessageEventStream } from "@earendil-works/pi-ai";
 import { Type } from "typebox";
 import { Value } from "typebox/value";
+import { seatFallbackBaseStatus } from "./engine-labor-fallback.js";
 import {
   NAVIGATOR_INVOCATION_ENTRY,
   mintNavigatorInvocationId
@@ -14,7 +15,6 @@ import { PACKAGED_ROLE_REGISTRY, packagedRoleMetadata } from "./packaged-role-re
 import { openInProcessAgentSession } from "./in-process-session.js";
 import { renderPublicAkRoleCommand } from "./public-command-renderer.js";
 import { issueRoot, subjectPath } from "./work-subject-identity.js";
-import { wrapPackageOwnedToolDefinition } from "./package-owned-tool-idle.js";
 import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT } from "./receipt-delivery-policy.js";
 import { recordTypedProviderHttpStatus } from "./typed-provider-http.js";
 import {
@@ -247,7 +247,7 @@ function parseNavigatorModelSetting(value) {
   return { provider, model, thinkingLevel: suffix === "max" ? "max" : "off" };
 }
 function createNavigatorPrepareTool(onOutput) {
-  return wrapPackageOwnedToolDefinition({
+  return {
     name: NAVIGATOR_PREPARE_TOOL_NAME,
     label: "Navigator preparation",
     description: "Submit Navigator direction advice. Provide candidates with next.role (phase when meaningful). route/matches/reason/command are optional context, not acceptance gates.",
@@ -256,7 +256,14 @@ function createNavigatorPrepareTool(onOutput) {
       onOutput(value);
       return { content: [{ type: "text", text: "Navigator preparation accepted" }], details: value, terminate: true };
     }
-  });
+  };
+}
+function statusListMatchesSettlement(candidateStatuses, settlementStatus) {
+  if (candidateStatuses.includes(settlementStatus)) return true;
+  const settlementBase = seatFallbackBaseStatus(settlementStatus);
+  return candidateStatuses.some(
+    (status) => seatFallbackBaseStatus(status) === settlementBase
+  );
 }
 function selectNavigatorCandidate(candidates, settlement) {
   if (settlement.kind !== "accepted") return void 0;
@@ -268,7 +275,7 @@ function selectNavigatorCandidate(candidates, settlement) {
   if (rolePhaseMatched.length > 0) {
     if (settlement.status !== void 0) {
       const statusSpecific = rolePhaseMatched.find(
-        (candidate) => candidate.matches?.statuses?.includes(settlement.status) === true
+        (candidate) => candidate.matches?.statuses !== void 0 && statusListMatchesSettlement(candidate.matches.statuses, settlement.status)
       );
       if (statusSpecific !== void 0) {
         return { candidate: statusSpecific, matchedToSettlement: true };

package/dist/package-contracts/judge-output.js

@@ -1,4 +1,5 @@
 /** Package-owned Judge output leaf — no role registration surface. */
+import { seatFallbackBaseStatus, seatFallbackStatusHasLawfulEvidence, } from "../engine-labor-fallback.js";
 export const JUDGE_OUTPUT_TOOL_NAME = "ak_judge_output";
 export const JUDGE_ACCEPTED_TEXT = "Judge verdict accepted";
 export function validateAcceptedJudgeDetails(verdict) {
@@ -11,7 +12,13 @@ export function validateAcceptedJudgeDetails(verdict) {
     catch {
         throw new Error("Judge verdict has no execution discriminator");
     }
-    if (["converged", "continue", "escalate"].includes(String(judgeStatus)))
+    if (typeof judgeStatus !== "string") {
+        throw new Error("Judge verdict has no execution discriminator");
+    }
+    const base = seatFallbackBaseStatus(judgeStatus);
+    if (["converged", "continue", "escalate"].includes(base) &&
+        seatFallbackStatusHasLawfulEvidence(judgeStatus, verdict)) {
         return verdict;
+    }
     throw new Error("Judge verdict has no execution discriminator");
 }

package/dist/package-contracts/reviewer-output.js

@@ -1,4 +1,5 @@
 /** Package-owned Reviewer intent and runtime-receipt leaves — no role registration surface. */
+import { seatFallbackBaseStatus, seatFallbackStatusHasLawfulEvidence, } from "../engine-labor-fallback.js";
 export const REVIEWER_OUTPUT_TOOL_NAME = "ak_reviewer_output";
 export const REVIEWER_ACCEPTED_TEXT = "Reviewer report accepted";
 function isRecord(value) {
@@ -24,6 +25,11 @@ export function validateReviewerIntent(output) {
 }
 /** Validate runtime-owned facts at their real identity seams (target pins + plain text). */
 export function validateRuntimeReviewerReceipt(output) {
+    const status = read(output, "status");
+    // ADR 0071: tainted top-level status requires latch-shaped engineLaborFallback evidence.
+    if (typeof status === "string" && !seatFallbackStatusHasLawfulEvidence(status, output)) {
+        throw new Error("Reviewer receipt has no recognized execution discriminator");
+    }
     const acceptedBatch = read(output, "acceptedBatch");
     const identities = read(output, "identities");
     const construction = read(identities, "construction");
@@ -91,7 +97,9 @@ export function validateRuntimeReviewerReceipt(output) {
 export function projectReviewerIntentToReceipt(intentValue, receiptValue) {
     const intent = validateReviewerIntent(intentValue);
     const receipt = validateRuntimeReviewerReceipt(receiptValue);
-    if (receipt.status !== intent.status || (intent.status === "completed" ? receipt.diagnostic !== undefined : receipt.diagnostic !== intent.diagnostic)) {
+    const receiptStatus = String(receipt.status);
+    const receiptBase = seatFallbackBaseStatus(receiptStatus);
+    if (receiptBase !== intent.status || (intent.status === "completed" ? receipt.diagnostic !== undefined : receipt.diagnostic !== intent.diagnostic)) {
         throw new Error("Reviewer intent and runtime receipt disagree");
     }
     return receipt;