@akagilnc/pi-workflow-roles 0.1.2312 → 0.1.2322

package/dist/public-cli/main.js

@@ -14473,6 +14473,9 @@ var init_packaged_role_registry = __esm({
 });
 
 // src/public-cli/registry.ts
+function isAutomaticConfigurableSeat(value) {
+  return AUTOMATIC_CONFIGURABLE_SEATS.includes(value);
+}
 function publicStartupCandidates(seat) {
   return STARTUP_CANDIDATES[seat];
 }
@@ -14508,7 +14511,7 @@ function isPublicConfigurableSeat(value) {
 function isPublicCliSupportCommand(value) {
   return PUBLIC_CLI_SUPPORT_COMMANDS.includes(value);
 }
-var INTERNAL_ROLE_ENTRYPOINT_RELATIVE, PUBLIC_CALLABLE_ROLES, AUTOMATIC_NAVIGATOR_SEAT, PUBLIC_CONFIGURABLE_SEATS, PUBLIC_CLI_SUPPORT_COMMANDS, STARTUP_CANDIDATES, PUBLIC_DETERMINISTIC_COMMANDS;
+var INTERNAL_ROLE_ENTRYPOINT_RELATIVE, PUBLIC_CALLABLE_ROLES, AUTOMATIC_NAVIGATOR_SEAT, AUTOMATIC_GATEKEEPER_SEAT, AUTOMATIC_INSPECTOR_SEAT, AUTOMATIC_CONFIGURABLE_SEATS, PUBLIC_CONFIGURABLE_SEATS, PUBLIC_CLI_SUPPORT_COMMANDS, STARTUP_CANDIDATES, PUBLIC_DETERMINISTIC_COMMANDS;
 var init_registry2 = __esm({
   "src/public-cli/registry.ts"() {
     "use strict";
@@ -14518,9 +14521,16 @@ var init_registry2 = __esm({
       (entry) => entry.role
     );
     AUTOMATIC_NAVIGATOR_SEAT = "navigator";
+    AUTOMATIC_GATEKEEPER_SEAT = "gatekeeper";
+    AUTOMATIC_INSPECTOR_SEAT = "inspector";
+    AUTOMATIC_CONFIGURABLE_SEATS = [
+      AUTOMATIC_GATEKEEPER_SEAT,
+      AUTOMATIC_INSPECTOR_SEAT,
+      AUTOMATIC_NAVIGATOR_SEAT
+    ];
     PUBLIC_CONFIGURABLE_SEATS = [
       ...PUBLIC_CALLABLE_ROLES,
-      AUTOMATIC_NAVIGATOR_SEAT
+      ...AUTOMATIC_CONFIGURABLE_SEATS
     ];
     PUBLIC_CLI_SUPPORT_COMMANDS = [
       "roles",
@@ -14561,6 +14571,9 @@ var init_registry2 = __esm({
         { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "high" },
         { provider: "xai", model: "grok-4.5", thinking: "high" }
       ],
+      // #453: automatic menxia seats have no startup default — unset means inherit parent.
+      gatekeeper: [],
+      inspector: [],
       navigator: [
         { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "medium" },
         { provider: "xai", model: "grok-4.5", thinking: "high" }
@@ -14574,6 +14587,9 @@ var init_registry2 = __esm({
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname as dirname2, join as join3 } from "node:path";
+function isMenxiaOfficerSeat(value) {
+  return MENXIA_OFFICER_SEATS.includes(value);
+}
 function publicCliConfigPath(home = homedir()) {
   return join3(home, ".ak-roles", "public-cli.json");
 }
@@ -14612,6 +14628,21 @@ function setPersistentSeatConfig(config, seat, selection) {
     }
   };
 }
+function clearPersistentSeatConfig(config, seat) {
+  const previous = config.seats[seat];
+  if (previous === void 0) return config;
+  if (seat === "notary" && previous.engine !== void 0) {
+    return {
+      ...config,
+      seats: {
+        ...config.seats,
+        notary: { engine: previous.engine }
+      }
+    };
+  }
+  const { [seat]: _dropped, ...seats } = config.seats;
+  return { ...config, seats };
+}
 function isEngineAxisSeat(seat) {
   return isPublicCallableRole(seat);
 }
@@ -14624,6 +14655,10 @@ function setPersistentSeatEngine(config, seat, engine) {
   }
   if (engine === void 0) {
     const { engine: _dropped, ...modelOnly } = previous;
+    if (seatModelOnly(modelOnly) === void 0) {
+      const { [seat]: _row, ...seats } = config.seats;
+      return { ...config, seats };
+    }
     return {
       ...config,
       seats: {
@@ -14652,6 +14687,7 @@ function setAutoResumeLimit(config, limit) {
   return { ...config, autoResumeLimit: parseAutoResumeLimit(limit) };
 }
 function seatModelOnly(seat) {
+  if (seat?.provider === void 0 || seat.model === void 0) return void 0;
   return seat.thinking === void 0 ? { provider: seat.provider, model: seat.model } : { provider: seat.provider, model: seat.model, thinking: seat.thinking };
 }
 function validatePublicCliConfigEngines(config, _packageRoot) {
@@ -14752,6 +14788,23 @@ function parseSeatModelConfig(value, seat) {
     throw new Error(`config seat ${seat} must be an object`);
   }
   const raw = value;
+  const hasProvider = raw.provider !== void 0;
+  const hasModel = raw.model !== void 0;
+  if (hasProvider !== hasModel) {
+    throw new Error(`config seat ${seat} requires both provider and model`);
+  }
+  if (raw.engine !== void 0 && typeof raw.engine !== "string") {
+    throw new Error(`config seat ${seat} engine must be a string`);
+  }
+  if (!hasProvider) {
+    if (seat === "notary" && typeof raw.engine === "string") {
+      if (raw.thinking !== void 0) {
+        throw new Error(`config seat ${seat} thinking requires provider/model`);
+      }
+      return { engine: raw.engine };
+    }
+    throw new Error(`config seat ${seat} requires provider`);
+  }
   if (typeof raw.provider !== "string" || raw.provider.trim() === "") {
     throw new Error(`config seat ${seat} requires provider`);
   }
@@ -14766,14 +14819,9 @@ function parseSeatModelConfig(value, seat) {
   const parsed = {
     provider: raw.provider,
     model: raw.model,
-    ...raw.thinking === void 0 ? {} : { thinking: raw.thinking }
+    ...raw.thinking === void 0 ? {} : { thinking: raw.thinking },
+    ...raw.engine === void 0 ? {} : { engine: raw.engine }
   };
-  if (raw.engine !== void 0) {
-    if (typeof raw.engine !== "string") {
-      throw new Error(`config seat ${seat} engine must be a string`);
-    }
-    parsed.engine = raw.engine;
-  }
   return parsed;
 }
 function providerConfigured(credentials, provider) {
@@ -14821,14 +14869,14 @@ function attachEngineAxis(seat, config, invocation) {
   };
 }
 function resolveBaseSeat(config, seat, credentials) {
-  const automatic = seat === AUTOMATIC_NAVIGATOR_SEAT;
-  const persistent = config.seats[seat];
-  if (persistent !== void 0) {
+  const automatic = isAutomaticConfigurableSeat(seat);
+  const persistentModel = seatModelOnly(config.seats[seat]);
+  if (persistentModel !== void 0) {
     return {
       seat,
       automatic,
       source: "persistent",
-      selection: seatModelOnly(persistent),
+      selection: persistentModel,
       engineSource: "unconfigured"
     };
   }
@@ -14845,7 +14893,7 @@ function resolveBaseSeat(config, seat, credentials) {
   return { seat, automatic, source: "unconfigured", engineSource: "unconfigured" };
 }
 function resolveEffectiveSeat(config, seat, credentials, invocation) {
-  const automatic = seat === AUTOMATIC_NAVIGATOR_SEAT;
+  const automatic = isAutomaticConfigurableSeat(seat);
   const hasModelInvocation = invocation !== void 0 && (invocation.model !== void 0 || invocation.thinking !== void 0);
   let modelSeat;
   if (!hasModelInvocation || invocation === void 0) {
@@ -14906,12 +14954,17 @@ async function loadCredentialProviders(agentDir) {
     throw error;
   }
 }
-var THINKING_LEVELS;
+var MENXIA_OFFICER_SEATS, THINKING_LEVELS;
 var init_config2 = __esm({
   "src/public-cli/config.ts"() {
     "use strict";
     init_engine_material();
     init_registry2();
+    MENXIA_OFFICER_SEATS = [
+      "gatekeeper",
+      "inspector",
+      "notary"
+    ];
     THINKING_LEVELS = /* @__PURE__ */ new Set([
       "off",
       "minimal",
@@ -17411,12 +17464,14 @@ var init_option_definitions = __esm({
         summary: "Persistent seat model, labor-engine, and auto-resume defaults.",
         usage: [
           "ak-role config set <seat> <provider/model[:thinking]> [<seat> <spec> ...]",
+          "ak-role config unset <gatekeeper|inspector|notary>",
           "ak-role config set-engine <seat> <name>",
           "ak-role config unset-engine <seat>",
           "ak-role config set-auto-resume-limit <N>"
         ],
         examples: [
           "ak-role config set judge openai-codex/gpt-5.6-sol:high",
+          "ak-role config unset gatekeeper",
           "ak-role config set-engine judge opus",
           "ak-role config set-auto-resume-limit 3"
         ]
@@ -20062,6 +20117,7 @@ var init_evidence_child_executor = __esm({
     init_engine_detour_tool();
     init_engine_detour();
     init_engine_material();
+    init_config2();
     init_receipt_delivery_policy();
     init_reviewer_construction();
     init_stream_idle_guard();
@@ -28740,9 +28796,9 @@ function requireLegalEngineName(name) {
   }
 }
 function requireEngineAxisSeat(seat, verb) {
-  if (seat === AUTOMATIC_NAVIGATOR_SEAT) {
+  if (isAutomaticConfigurableSeat(seat)) {
     throw new CliUsageError(
-      `config ${verb} refuses navigator: no independent activation path; storing would be silently ineffective`
+      `config ${verb} refuses ${seat}: no independent activation path; storing would be silently ineffective`
     );
   }
   if (!isEngineAxisSeat(seat)) {
@@ -28838,7 +28894,7 @@ function renderHelp() {
   lines.push(
     "",
     "Role options: ak-role help <command>",
-    "Persistent config: ak-role config set <seat> <provider/model[:thinking]>",
+    "Persistent config: ak-role config set <seat> <provider/model[:thinking]> | unset <gatekeeper|inspector|notary>",
     "Persistent engine (callable roles): ak-role config set-engine <seat> <name> | unset-engine <seat>",
     "Effective seats: ak-role roles"
   );
@@ -28879,6 +28935,10 @@ function renderRoles(seats) {
   return `${lines.join("\n")}
 `;
 }
+function renderPersistentSeatModel(selection) {
+  const model = seatModelOnly(selection);
+  return model === void 0 ? "-" : formatModelSpec(model);
+}
 function renderConfig(config) {
   const lines = ["seat	model	engine"];
   const keys = Object.keys(config.seats);
@@ -28889,7 +28949,7 @@ function renderConfig(config) {
       const selection = config.seats[seat];
       if (selection === void 0) continue;
       const engine = selection.engine === void 0 ? "-" : selection.engine;
-      lines.push(`${seat}	${formatModelSpec(selection)}	${engine}`);
+      lines.push(`${seat}	${renderPersistentSeatModel(selection)}	${engine}`);
     }
   }
   lines.push(`autoResumeLimit	${config.autoResumeLimit ?? AUTO_RESUME_LIMIT}`);
@@ -28909,8 +28969,10 @@ async function runConfigCommand(args, home, packageRoot2, io) {
 `);
       } else {
         const engine = selection.engine === void 0 ? "-" : selection.engine;
-        io.stdout(`${args[1]}	${formatModelSpec(selection)}	${engine}
-`);
+        io.stdout(
+          `${args[1]}	${renderPersistentSeatModel(selection)}	${engine}
+`
+        );
       }
       return 0;
     }
@@ -28942,6 +29004,26 @@ async function runConfigCommand(args, home, packageRoot2, io) {
     io.stdout(renderConfig(config));
     return 0;
   }
+  if (args[0] === "unset") {
+    if (args.length !== 2) {
+      throw new CliUsageError(
+        "usage: ak-role config unset <gatekeeper|inspector|notary>"
+      );
+    }
+    const seat = args[1];
+    if (!isMenxiaOfficerSeat(seat)) {
+      throw new CliUsageError(
+        `config unset serves menxia officer overrides only (gatekeeper|inspector|notary); got ${seat}`
+      );
+    }
+    const config = clearPersistentSeatConfig(
+      await loadAndValidateConfig(home, packageRoot2),
+      seat
+    );
+    await savePublicCliConfig(config, home);
+    io.stdout(renderConfig(config));
+    return 0;
+  }
   if (args[0] === "set-engine") {
     if (args.length !== 3) {
       throw new CliUsageError(

package/dist/public-cli/registry.js

@@ -0,0 +1,121 @@
+/**
+ * Typed public CLI registry — sole source for discoverable commands, seats,
+ * and startup model candidates (ADR 0052 / #105).
+ */
+import { PACKAGED_ROLE_REGISTRY, } from "../packaged-role-registry.js";
+/** Package-relative path of the Internal role entrypoint (explicit load only). */
+export const INTERNAL_ROLE_ENTRYPOINT_RELATIVE = "extensions/role-runtime.ts";
+export const PUBLIC_CALLABLE_ROLES = PACKAGED_ROLE_REGISTRY.map((entry) => entry.role);
+/** Automatic attendance seat — configurable, never a caller-selected command. */
+export const AUTOMATIC_NAVIGATOR_SEAT = "navigator";
+/** Automatic menxia seats — configurable model only; never caller commands (#453). */
+export const AUTOMATIC_GATEKEEPER_SEAT = "gatekeeper";
+export const AUTOMATIC_INSPECTOR_SEAT = "inspector";
+/** All automatic configurable seats (no independent public activation command). */
+export const AUTOMATIC_CONFIGURABLE_SEATS = [
+    AUTOMATIC_GATEKEEPER_SEAT,
+    AUTOMATIC_INSPECTOR_SEAT,
+    AUTOMATIC_NAVIGATOR_SEAT,
+];
+export const PUBLIC_CONFIGURABLE_SEATS = [
+    ...PUBLIC_CALLABLE_ROLES,
+    ...AUTOMATIC_CONFIGURABLE_SEATS,
+];
+export function isAutomaticConfigurableSeat(value) {
+    return AUTOMATIC_CONFIGURABLE_SEATS.includes(value);
+}
+export const PUBLIC_CLI_SUPPORT_COMMANDS = [
+    "roles",
+    "config",
+    "help",
+    "resume",
+];
+/**
+ * Package startup candidates (#11): Codex family first, then Grok 4.5.
+ * Selection among candidates is credential-driven at resolve time.
+ */
+const STARTUP_CANDIDATES = {
+    judge: [
+        { provider: "openai-codex", model: "gpt-5.6-sol", thinking: "high" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+    reviewer: [
+        { provider: "openai-codex", model: "gpt-5.6-sol", thinking: "medium" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+    coder: [
+        { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "high" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+    fixer: [
+        { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "high" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+    collector: [
+        { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "high" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+    doctor: [
+        { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "high" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+    merger: [
+        { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "high" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+    notary: [
+        { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "high" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+    // #453: automatic menxia seats have no startup default — unset means inherit parent.
+    gatekeeper: [],
+    inspector: [],
+    navigator: [
+        { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "medium" },
+        { provider: "xai", model: "grok-4.5", thinking: "high" },
+    ],
+};
+export function publicStartupCandidates(seat) {
+    return STARTUP_CANDIDATES[seat];
+}
+/** Deterministic public commands — discoverable, never LLM-configurable seats. */
+export const PUBLIC_DETERMINISTIC_COMMANDS = ["analyst"];
+/**
+ * Typed help surface. Presentation formats these facts; tests must not assert
+ * exact help prose or layout (锚定宪法 / ADR 0016 / #105 AC).
+ * analyst is a deterministic analysis command on the public CLI — not an LLM seat.
+ */
+export function listHelpCapabilities() {
+    const support = PUBLIC_CLI_SUPPORT_COMMANDS.map((name) => ({
+        kind: "support",
+        name,
+    }));
+    const roles = PACKAGED_ROLE_REGISTRY.map((entry) => {
+        const phases = entry.phases;
+        const defaultPhase = phases.length === 1 && phases[0] === null
+            ? null
+            : phases.includes("apply")
+                ? "apply"
+                : (phases[0] ?? null);
+        return {
+            kind: "role",
+            name: entry.role,
+            phases,
+            defaultPhase,
+        };
+    });
+    const deterministic = PUBLIC_DETERMINISTIC_COMMANDS.map((name) => ({
+        kind: "deterministic",
+        name,
+    }));
+    return [...support, ...roles, ...deterministic];
+}
+export function isPublicCallableRole(value) {
+    return PUBLIC_CALLABLE_ROLES.includes(value);
+}
+export function isPublicConfigurableSeat(value) {
+    return PUBLIC_CONFIGURABLE_SEATS.includes(value);
+}
+export function isPublicCliSupportCommand(value) {
+    return PUBLIC_CLI_SUPPORT_COMMANDS.includes(value);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.2312",
+  "version": "0.1.2322",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/evidence-child-executor.ts

@@ -36,6 +36,13 @@ import {
   engineSessionMaterialFromOptions,
   type EngineSessionMaterial,
 } from "./package-resources/engine-material.ts";
+import {
+  formatModelSpec,
+  loadPublicCliConfig,
+  resolveMenxiaOfficerModelSelection,
+  type MenxiaOfficerSeat,
+} from "./public-cli/config.ts";
+import type { PublicThinkingLevel } from "./public-cli/registry.ts";
 import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT, type NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 import { REVIEWER_VERIFICATION_BOUNDARY } from "./reviewer-construction.ts";
 import type { ReviewerPromptText } from "./reviewer-prompt-identity.ts";
@@ -129,6 +136,11 @@ export type InheritedRuntimeOptions = {
   readonly signal?: AbortSignal;
   /** When true, wrap provider streams with ADR 0059 idle-only retry. */
   readonly idleRetry?: boolean;
+  /**
+   * Explicit child model. When set, auth/availability failures do not fall back
+   * to the parent session model (#453 menxia overrides).
+   */
+  readonly model?: Model<Api>;
 };
 
 export type InheritedRuntime = {
@@ -145,7 +157,8 @@ export type InheritedRuntime = {
  */
 export async function createInheritedRuntime(options: InheritedRuntimeOptions): Promise<InheritedRuntime> {
   const { ModelRuntime } = await import("@earendil-works/pi-coding-agent");
-  const activeModel = options.context.model;
+  // Explicit override wins; never silent-fallback to parent when override is set (#453).
+  const activeModel = options.model ?? options.context.model;
   if (activeModel === undefined) throw new Error(`${options.label} requires an active model`);
   const dispatch = await prepareComplianceDispatch(activeModel, options.context, options.label);
   const parentProvider = options.runCompletion === undefined
@@ -333,9 +346,11 @@ export async function createInheritedRuntime(options: InheritedRuntimeOptions):
     return wrapped as ReturnType<Provider["stream"]>;
   };
 
+  // Provider id must match activeModel.provider so ModelRuntime auth lookup
+  // finds this registration when a menxia override changes provider (#453).
   const provider: Provider = options.idleRetry === true || options.runCompletion !== undefined
     ? {
-      id: parentProvider?.id ?? activeModel.provider,
+      id: activeModel.provider,
       name: parentProvider?.name ?? options.label,
       auth: {
         apiKey: {
@@ -716,8 +731,39 @@ export type AuditorRoleOptions = {
   signal?: AbortSignal;
   runCompletion?: AuditorCompletion;
   retainResponse?(response: AssistantMessage): void;
+  /**
+   * Province seat identity only — shared executor owns config load, registry
+   * resolve, and loud auth/availability failure (#453 / ADR 0018).
+   */
+  menxiaSeat?: MenxiaOfficerSeat;
 };
 
+/**
+ * Resolve province child model from public-cli persistent config (#453).
+ * Own override > gatekeeper override > unset (inherit parent). Availability
+ * failures throw — createInheritedRuntime must not silent-fallback to parent.
+ */
+async function resolveMenxiaSeatModelOptions(
+  context: ExtensionContext,
+  seat: MenxiaOfficerSeat,
+  roleLabel: string,
+): Promise<{ model?: Model<Api>; thinkingLevel?: PublicThinkingLevel }> {
+  const selection = resolveMenxiaOfficerModelSelection(await loadPublicCliConfig(), seat);
+  if (selection === undefined) return {};
+  const find = context.modelRegistry.find?.bind(context.modelRegistry);
+  if (typeof find !== "function") {
+    throw new Error(`${roleLabel} model registry cannot resolve models`);
+  }
+  const model = find(selection.provider, selection.model);
+  if (model === undefined) {
+    throw new Error(`${roleLabel} model is unavailable: ${formatModelSpec(selection)}`);
+  }
+  return {
+    model,
+    ...(selection.thinking === undefined ? {} : { thinkingLevel: selection.thinking }),
+  };
+}
+
 /**
  * Auditor lifecycle via the shared in-process helper.
  * Adapter keeps role label / soul / decision tool / result projection only.
@@ -730,10 +776,19 @@ export async function executeAuditorChild(
   const { createRecordSession } = await import("./archivist-record-entry.ts");
 
   return withInProcessScratch({ prefix: "ak-auditor-role-" }, async (scratch) => {
+    const menxia =
+      options.menxiaSeat === undefined
+        ? {}
+        : await resolveMenxiaSeatModelOptions(
+            options.context,
+            options.menxiaSeat,
+            options.roleLabel,
+          );
     const inherited = await createInheritedRuntime({
       context: options.context,
       label: options.roleLabel,
       idleRetry: true,
+      ...(menxia.model === undefined ? {} : { model: menxia.model }),
       ...(options.runCompletion === undefined
         ? {}
         : { runCompletion: options.runCompletion, injectedSystemPrompt: options.systemPrompt }),
@@ -792,7 +847,7 @@ export async function executeAuditorChild(
       cwd,
       agentDir: scratch,
       model: inherited.model,
-      thinkingLevel: options.context.thinkingLevel ?? "off",
+      thinkingLevel: menxia.thinkingLevel ?? options.context.thinkingLevel ?? "off",
       modelRuntime: inherited.runtime,
       systemPrompt: options.systemPrompt,
       customTools: [{ ...options.dossierTool, label: options.roleLabel }, tool],

package/src/gatekeeper-role.ts

@@ -215,9 +215,11 @@ export async function runGatekeeper(options: RunGatekeeperOptions): Promise<Gate
   const loadSoul = options.loadSoul ?? defaultLoadSoul;
   let provinceRun: Awaited<ReturnType<typeof executeAuditorChild>>;
   try {
+    // Seat identity only — shared executor owns model config/registry/auth (#453 / ADR 0018).
     provinceRun = await executeAuditorChild({
       context: options.context,
       roleLabel: "Gatekeeper",
+      menxiaSeat: "gatekeeper",
       systemPrompt: `${await loadSoul("gatekeeper")}\n\n${INVOCATION_OVERLAY}`,
       prompt: "Read the admitted subject with ak_gatekeeper_subject, then dispatch it or submit typed incomplete.",
       tool: createGatekeeperOutputTool(),
@@ -236,9 +238,11 @@ export async function runGatekeeper(options: RunGatekeeperOptions): Promise<Gate
 
   const officer = province.officer;
   try {
+    const roleLabel = officer === "inspector" ? "Inspector" : "Notary";
     const officerRun = await executeAuditorChild({
       context: options.context,
-      roleLabel: officer === "inspector" ? "Inspector" : "Notary",
+      roleLabel,
+      menxiaSeat: officer,
       systemPrompt: `${await loadSoul(officer)}\n\n${INVOCATION_OVERLAY}`,
       prompt: "Read the admitted subject with ak_gatekeeper_subject, then submit one typed decision on only your assigned axes.",
       tool: createOfficerDecisionTool(officer === "inspector" ? INSPECTOR_OUTPUT_TOOL : NOTARY_OUTPUT_TOOL),

package/src/public-cli/cli.ts

@@ -9,14 +9,17 @@ import {
   assertLegalEngineName,
 } from "../package-resources/engine-material.ts";
 import {
+  clearPersistentSeatConfig,
   effectiveSeatConfigurations,
   formatModelSpec,
   isEngineAxisSeat,
+  isMenxiaOfficerSeat,
   loadCredentialProviders,
   loadPublicCliConfig,
   parseModelSpec,
   resolveEffectiveSeat,
   savePublicCliConfig,
+  seatModelOnly,
   setAutoResumeLimit,
   setPersistentSeatConfig,
   setPersistentSeatEngine,
@@ -63,8 +66,8 @@ import { runPublicReviewer, runPublicReviewerResume } from "./reviewer-run.ts";
 import { runPublicAnalyst } from "./analyst-run.ts";
 import { AUTO_RESUME_LIMIT, peekRoleRunRole } from "./run-lifecycle.ts";
 import {
-  AUTOMATIC_NAVIGATOR_SEAT,
   INTERNAL_ROLE_ENTRYPOINT_RELATIVE,
+  isAutomaticConfigurableSeat,
   isPublicCallableRole,
   isPublicCliSupportCommand,
   isPublicConfigurableSeat,
@@ -351,15 +354,15 @@ function requireLegalEngineName(name: string): string {
 
 /**
  * Persistent engine axis gate (#391 E1): PUBLIC_CALLABLE_ROLES only.
- * Navigator is a configurable model seat but has no independent activation path.
+ * Automatic seats are configurable for model but have no independent activation path.
  */
 function requireEngineAxisSeat(
   seat: string,
   verb: "set-engine" | "unset-engine",
 ): asserts seat is PublicCallableRole {
-  if (seat === AUTOMATIC_NAVIGATOR_SEAT) {
+  if (isAutomaticConfigurableSeat(seat)) {
     throw new CliUsageError(
-      `config ${verb} refuses navigator: no independent activation path; storing would be silently ineffective`,
+      `config ${verb} refuses ${seat}: no independent activation path; storing would be silently ineffective`,
     );
   }
   if (!isEngineAxisSeat(seat)) {
@@ -478,7 +481,7 @@ function renderHelp(): string {
   lines.push(
     "",
     "Role options: ak-role help <command>",
-    "Persistent config: ak-role config set <seat> <provider/model[:thinking]>",
+    "Persistent config: ak-role config set <seat> <provider/model[:thinking]> | unset <gatekeeper|inspector|notary>",
     "Persistent engine (callable roles): ak-role config set-engine <seat> <name> | unset-engine <seat>",
     "Effective seats: ak-role roles",
   );
@@ -521,6 +524,15 @@ function renderRoles(seats: readonly EffectiveSeat[]): string {
   return `${lines.join("\n")}\n`;
 }
 
+function renderPersistentSeatModel(selection: {
+  provider?: string;
+  model?: string;
+  thinking?: PublicThinkingLevel;
+}): string {
+  const model = seatModelOnly(selection);
+  return model === undefined ? "-" : formatModelSpec(model);
+}
+
 function renderConfig(config: PublicCliConfig): string {
   const lines: string[] = ["seat\tmodel\tengine"];
   const keys = Object.keys(config.seats) as (keyof typeof config.seats)[];
@@ -531,7 +543,7 @@ function renderConfig(config: PublicCliConfig): string {
       const selection = config.seats[seat];
       if (selection === undefined) continue;
       const engine = selection.engine === undefined ? "-" : selection.engine;
-      lines.push(`${seat}\t${formatModelSpec(selection)}\t${engine}`);
+      lines.push(`${seat}\t${renderPersistentSeatModel(selection)}\t${engine}`);
     }
   }
   // #422: show the effective auto-resume ceiling (configured value or default).
@@ -557,7 +569,9 @@ async function runConfigCommand(
       } else {
         const engine =
           selection.engine === undefined ? "-" : selection.engine;
-        io.stdout(`${args[1]}\t${formatModelSpec(selection)}\t${engine}\n`);
+        io.stdout(
+          `${args[1]}\t${renderPersistentSeatModel(selection)}\t${engine}\n`,
+        );
       }
       return 0;
     }
@@ -594,6 +608,28 @@ async function runConfigCommand(
     return 0;
   }
 
+  // #453: clear menxia officer model override only (engine axis preserved).
+  if (args[0] === "unset") {
+    if (args.length !== 2) {
+      throw new CliUsageError(
+        "usage: ak-role config unset <gatekeeper|inspector|notary>",
+      );
+    }
+    const seat = args[1]!;
+    if (!isMenxiaOfficerSeat(seat)) {
+      throw new CliUsageError(
+        `config unset serves menxia officer overrides only (gatekeeper|inspector|notary); got ${seat}`,
+      );
+    }
+    const config = clearPersistentSeatConfig(
+      await loadAndValidateConfig(home, packageRoot),
+      seat,
+    );
+    await savePublicCliConfig(config, home);
+    io.stdout(renderConfig(config));
+    return 0;
+  }
+
   if (args[0] === "set-engine") {
     if (args.length !== 3) {
       throw new CliUsageError(