@akagilnc/pi-workflow-roles 0.1.2521 → 0.1.2653-next.71811ca

package/src/institutional-resolution.ts

@@ -0,0 +1,135 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import type { RoleTurnModelConfig } from "./host-contracts.ts";
+import { seatModelOnly, type PublicCliConfig } from "./public-cli/config.ts";
+
+export const INSTITUTIONAL_RESOLUTION_FILE = "institutional-resolution.json" as const;
+
+/** Non-secret per-seat model selection — alias of the single host-neutral RoleTurnModelConfig. */
+export type InstitutionalSeatSelection = RoleTurnModelConfig;
+
+export type InstitutionalResolutionPage = {
+  readonly version: 1;
+  readonly seats: {
+    readonly gatekeeper?: InstitutionalSeatSelection;
+    readonly inspector?: InstitutionalSeatSelection;
+    readonly notary?: InstitutionalSeatSelection;
+    readonly auditor?: InstitutionalSeatSelection;
+    readonly evidenceChild?: InstitutionalSeatSelection;
+    readonly [seat: string]: InstitutionalSeatSelection | undefined;
+  };
+};
+
+export class InstitutionalResolutionError extends Error {
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = "InstitutionalResolutionError";
+  }
+}
+
+function cleanSelection(model?: { provider?: string; model?: string; thinking?: string }): InstitutionalSeatSelection | undefined {
+  if (model === undefined) return undefined;
+  if (typeof model.provider !== "string" || typeof model.model !== "string") return undefined;
+  return {
+    provider: model.provider,
+    model: model.model,
+    ...(model.thinking === undefined ? {} : { thinking: model.thinking }),
+  };
+}
+
+/**
+ * Resolve effective per-seat institutional selections (#518 §2 Hop 1):
+ * - gatekeeper / inspector / notary: seat override > gatekeeper override > parent effective
+ * - auditor / evidenceChild: parent effective
+ */
+export function resolveInstitutionalSeatSelections(
+  config: PublicCliConfig,
+  parentEffectiveModel?: { provider: string; model: string; thinking?: string },
+): InstitutionalResolutionPage {
+  const parentSelection = cleanSelection(parentEffectiveModel);
+
+  const ownInspector = cleanSelection(seatModelOnly(config.seats?.inspector));
+  const ownNotary = cleanSelection(seatModelOnly(config.seats?.notary));
+  const ownGatekeeper = cleanSelection(seatModelOnly(config.seats?.gatekeeper));
+
+  const gatekeeper = ownGatekeeper ?? parentSelection;
+  const inspector = ownInspector ?? ownGatekeeper ?? parentSelection;
+  const notary = ownNotary ?? ownGatekeeper ?? parentSelection;
+  const auditor = parentSelection;
+  const evidenceChild = parentSelection;
+
+  return {
+    version: 1,
+    seats: {
+      ...(gatekeeper === undefined ? {} : { gatekeeper }),
+      ...(inspector === undefined ? {} : { inspector }),
+      ...(notary === undefined ? {} : { notary }),
+      ...(auditor === undefined ? {} : { auditor }),
+      ...(evidenceChild === undefined ? {} : { evidenceChild }),
+    },
+  };
+}
+
+/**
+ * Persist institutional resolution page to run directory (#518 §2 Hop 2).
+ * Rewritten on each dispatch and resume. Zero secrets inside page.
+ */
+export async function writeInstitutionalResolutionPage(
+  runDirectory: string,
+  page: InstitutionalResolutionPage,
+): Promise<void> {
+  const filePath = join(runDirectory, INSTITUTIONAL_RESOLUTION_FILE);
+  await writeFile(filePath, `${JSON.stringify(page, null, 2)}\n`, "utf8");
+}
+
+/**
+ * Read institutional seat selection from run directory (#518 §2 Hop 3).
+ * Fails loud if page is missing, corrupted, or does not contain a resolution for the seat.
+ */
+export async function readInstitutionalSeatSelection(
+  runDirectory: string,
+  seat: string,
+): Promise<InstitutionalSeatSelection> {
+  const filePath = join(runDirectory, INSTITUTIONAL_RESOLUTION_FILE);
+  let raw: string;
+  try {
+    raw = await readFile(filePath, "utf8");
+  } catch (error) {
+    throw new InstitutionalResolutionError(
+      `institutional resolution page is missing at ${filePath}`,
+      { cause: error },
+    );
+  }
+
+  let page: unknown;
+  try {
+    page = JSON.parse(raw);
+  } catch (error) {
+    throw new InstitutionalResolutionError(
+      `institutional resolution page is corrupted at ${filePath}`,
+      { cause: error },
+    );
+  }
+
+  if (typeof page !== "object" || page === null || (page as { version?: unknown }).version !== 1) {
+    throw new InstitutionalResolutionError(
+      `institutional resolution page format is invalid at ${filePath}`,
+    );
+  }
+
+  const seats = (page as { seats?: Record<string, unknown> }).seats;
+  if (typeof seats !== "object" || seats === null) {
+    throw new InstitutionalResolutionError(
+      `institutional resolution page missing seats object at ${filePath}`,
+    );
+  }
+
+  const selection = cleanSelection(seats[seat] as InstitutionalSeatSelection | undefined);
+  if (selection === undefined) {
+    throw new InstitutionalResolutionError(
+      `institutional resolution page has no resolution for seat "${seat}" at ${filePath}`,
+    );
+  }
+
+  return selection;
+}

package/src/judge-auditor.ts

@@ -3,7 +3,6 @@ import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   createComplianceDecisionTool,
   runComplianceAudit,
-  type ComplianceCompletion,
   type ComplianceDecision,
 } from "./compliance-transport.ts";
 import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
@@ -32,9 +31,7 @@ const auditDecisionTool = createComplianceDecisionTool(
  * parent-session books. Public CLI injects AK_ROLE_RUN_DIR; bare Pi (ADR 0052)
  * proceeds without that pointer and self-locates per soul.
  */
-export function createPiJudgeAuditor(
-  runCompletion?: ComplianceCompletion,
-): (options: JudgeAuditOptions) => Promise<ComplianceDecision> {
+export function createPiJudgeAuditor(): (options: JudgeAuditOptions) => Promise<ComplianceDecision> {
   return async (options) => {
     const dossier = resolveAuditDossier();
     requireAuditMaterials(dossier);
@@ -46,7 +43,6 @@ export function createPiJudgeAuditor(
       systemPrompt: await loadAuditorSoul("judge"),
       roleLabel: "Judge compliance audit",
       invalidDecisionLabel: "invalid judge audit decision",
-      ...(runCompletion === undefined ? {} : { runCompletion }),
       context: options.context,
       ...(auditorRunDirectory(options.context) === undefined ? {} : { runDirectory: auditorRunDirectory(options.context) }),
       ...(options.signal === undefined ? {} : { signal: options.signal }),

package/src/judge-role.ts

@@ -1,18 +1,9 @@
-import { StringEnum } from "@earendil-works/pi-ai";
-import type {
-  ExtensionAPI,
-  ExtensionContext,
-  AgentToolResult,
-} from "@earendil-works/pi-coding-agent";
+import type { RoleHost, HostContext, HostToolResult, HostGatekeeperActions } from "./host-contracts.ts";
+import { stringEnum } from "./host-contracts.ts";
 import { Type, type Static } from "typebox";
 
 import { disposeComplianceDecision } from "./audit-escalation.ts";
 import type { ComplianceDecision } from "./compliance-transport.ts";
-import { requireGatekeeperPass, type GatekeeperPassHostActions } from "./gatekeeper-role.ts";
-import {
-  failOnInfrastructureFailureDeclaration,
-  withInfrastructureFailureDeclaration,
-} from "./package-contracts/terminating-infrastructure.ts";
 
 import {
   JUDGE_ACCEPTED_AUDIT_NO_RECEIPT_TEXT,
@@ -25,36 +16,34 @@ import {
 export { JUDGE_OUTPUT_TOOL_NAME };
 export type { JudgeVerdict };
 
-export const judgeVerdictSchema = withInfrastructureFailureDeclaration(
-  Type.Object(
-    {
-      judgeStatus: StringEnum(["converged", "continue", "escalate"] as const, { description: "converged | continue | escalate — 形状指引，非 schema 闸" }),
-      fix: Type.Optional(
-        Type.Object(
-          { summary: Type.String({ minLength: 1, description: "continue 时的补救摘要" }) },
-          { additionalProperties: false, description: "continue 时的补救说明" },
-        ),
+const judgeVerdictSchema = Type.Object(
+  {
+    judgeStatus: stringEnum(["converged", "continue", "escalate"] as const, { description: "converged | continue | escalate — 形状指引，非 schema 闸" }),
+    fix: Type.Optional(
+      Type.Object(
+        { summary: Type.String({ minLength: 1, description: "continue 时的补救摘要" }) },
+        { additionalProperties: false, description: "continue 时的补救说明" },
       ),
-      classes: Type.Optional(Type.Array(Type.Object({
-        name: Type.String({ minLength: 1 }),
-        owner: Type.String({ minLength: 1 }),
-        boundary: Type.String({ minLength: 1 }),
-        disposition: Type.String({ minLength: 1 }),
-      }, { additionalProperties: false }), { minItems: 1, description: "已裁决 finding 类及其 owner 与修理边界" })),
-      note: Type.Optional(Type.String({ minLength: 1, description: "可选裁决附注" })),
-      evidence: Type.Optional(Type.Unknown({ description: "留存的裁决证据" })),
-      decisionGate: Type.Optional(
-        Type.Object(
-          {
-            question: Type.String({ minLength: 1 }),
-            options: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
-          },
-          { additionalProperties: false, description: "需人权威处置的问题与选项" },
-        ),
+    ),
+    classes: Type.Optional(Type.Array(Type.Object({
+      name: Type.String({ minLength: 1 }),
+      owner: Type.String({ minLength: 1 }),
+      boundary: Type.String({ minLength: 1 }),
+      disposition: Type.String({ minLength: 1 }),
+    }, { additionalProperties: false }), { minItems: 1, description: "已裁决 finding 类及其 owner 与修理边界" })),
+    note: Type.Optional(Type.String({ minLength: 1, description: "可选裁决附注" })),
+    evidence: Type.Optional(Type.Unknown({ description: "留存的裁决证据" })),
+    decisionGate: Type.Optional(
+      Type.Object(
+        {
+          question: Type.String({ minLength: 1 }),
+          options: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+        },
+        { additionalProperties: false, description: "需人权威处置的问题与选项" },
       ),
-    },
-    { additionalProperties: true },
-  ),
+    ),
+  },
+  { additionalProperties: true },
 );
 (judgeVerdictSchema as unknown as { required: string[] }).required = [];
 
@@ -65,11 +54,11 @@ export type SoulAuditResult = ComplianceDecision;
 export type JudgeRoleDependencies = {
   loadSoul(): Promise<string>;
   auditSoulCompliance(
-    options: { context: ExtensionContext; signal?: AbortSignal },
+    options: { context: HostContext; signal?: AbortSignal },
   ): Promise<SoulAuditResult>;
 };
 
-export type JudgeRoleHostActions = GatekeeperPassHostActions;
+export type JudgeRoleHostActions = HostGatekeeperActions;
 
 export function validateVerdict(verdict: JudgeVerdictParameters): JudgeVerdict {
   return validateAcceptedJudgeDetails(verdict);
@@ -77,13 +66,13 @@ export function validateVerdict(verdict: JudgeVerdictParameters): JudgeVerdict {
 
 function requireSingletonSubmissionCall(
   toolCallId: string,
-  ctx: ExtensionContext,
+  ctx: HostContext,
 ): void {
   const leaf = ctx.sessionManager.getLeafEntry();
-  if (leaf?.type !== "message" || leaf.message.role !== "assistant") {
+  if (leaf?.type !== "message" || leaf.message === undefined || leaf.message.role !== "assistant" || !Array.isArray(leaf.message.content)) {
     throw new Error("大理寺回执非唯一终局工具调用");
   }
-  const calls = leaf.message.content.filter((part) => part.type === "toolCall");
+  const calls = leaf.message.content.filter((part): part is Extract<typeof part, { type: "toolCall" }> => part.type === "toolCall");
   const call = calls[0];
   if (
     calls.length !== 1 || call === undefined || call.id !== toolCallId ||
@@ -94,7 +83,7 @@ function requireSingletonSubmissionCall(
 }
 
 export function createJudgeRoleRuntime(
-  pi: ExtensionAPI,
+  pi: RoleHost,
   dependencies: JudgeRoleDependencies,
   hostActions: JudgeRoleHostActions,
 ): { activate(): Promise<void> } {
@@ -113,17 +102,14 @@ export function createJudgeRoleRuntime(
           description: "提交大理寺终局判词；受理前经审刑院审计。",
           promptSnippet: "提交大理寺终局判词",
           parameters: judgeVerdictSchema,
-          async execute(toolCallId, parameters, signal, _onUpdate, ctx): Promise<AgentToolResult<unknown>> {
+          async execute(toolCallId: string, parameters: Static<typeof judgeVerdictSchema>, signal: AbortSignal | undefined, _onUpdate: unknown, ctx: HostContext): Promise<HostToolResult<unknown>> {
             if (soul === undefined) throw new Error("大理寺职分未装载");
-            // #541: infra declaration fails via the shared host seam before any
-            // Gatekeeper + audit courtyard work.
-            failOnInfrastructureFailureDeclaration(parameters, hostActions, ctx, toolCallId);
             requireSingletonSubmissionCall(toolCallId, ctx);
             const verdict = validateVerdict(parameters);
             // Candidate verdict is already on the parent session books as this
             // tool-call leaf (first-record-then-audit; run 019fea05 L61/L62).
             // Gatekeeper runs after the draft is booked and before existing auditor.
-            await requireGatekeeperPass({
+            await pi.requireGatekeeperPass!({
               context: ctx,
               subject: { kind: "judge_draft", material: JSON.stringify(verdict) },
               ...(signal === undefined ? {} : { signal }),
@@ -141,7 +127,7 @@ export function createJudgeRoleRuntime(
               hostActions.failInfrastructure(error, ctx, toolCallId);
             }
             const acceptedDetails = verdict;
-            return disposeComplianceDecision<AgentToolResult<unknown>>(
+            return disposeComplianceDecision<HostToolResult<unknown>>(
               audit,
               {
                 pass: (usage) => ({

package/src/merger-contracts.ts

@@ -3,7 +3,6 @@ import { isFullGitObjectId } from "./git-object-id.ts";
 import { exactUtf8 } from "./exact-utf8.ts";
 import { sha256Hex } from "./sha256.ts";
 import { openToolObjectFromUnion } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
 
 const oidPattern = "^(?:[0-9a-f]{40}|[0-9a-f]{64})$";
 const materialSchema = Type.Object({ bytesBase64: Type.String(), sha256: Type.String() }, { additionalProperties: false });
@@ -20,9 +19,7 @@ const mergerOutputVariants = Type.Union([
   Type.Object({ status: Type.Literal("completed", { description: "completed — 形状指引，非 schema 闸" }), attemptId: Type.String({ minLength: 1, description: "已受理合并 attempt 身份" }), report: Type.String({ minLength: 1, description: "如实结果报告" }), mergeCommitId: Type.String({ pattern: oidPattern, description: "已核验的完成合并 commit object ID" }) }, { additionalProperties: false }),
   Type.Object({ status: Type.Literal("escalate", { description: "escalate — 形状指引，非 schema 闸" }), attemptId: Type.String({ minLength: 1, description: "已受理合并 attempt 身份" }), diagnosis: Type.String({ minLength: 1, description: "合并完成需升级的原因" }), report: Type.String({ minLength: 1, description: "如实结果报告" }) }, { additionalProperties: false }),
 ]);
-export const mergerOutputSchema = withInfrastructureFailureDeclaration(
-  openToolObjectFromUnion(mergerOutputVariants),
-);
+export const mergerOutputSchema = openToolObjectFromUnion(mergerOutputVariants);
 
 export type DeepReadonly<T> = T extends (...args: never[]) => unknown ? T : T extends readonly (infer U)[] ? readonly DeepReadonly<U>[] : T extends object ? { readonly [K in keyof T]: DeepReadonly<T[K]> } : T;
 export type MergerMaterial = DeepReadonly<Static<typeof materialSchema>>;

package/src/merger-role.ts

@@ -1,7 +1,6 @@
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { RoleHost, HostContext, HostToolResult } from "./host-contracts.ts";
 import { MERGER_ACCEPTED_TEXT, MERGER_OUTPUT_TOOL_NAME, mergerOutputSchema, validateMergerInput, validateMergerOutput, type MergerInput } from "./merger-contracts.ts";
 import type { MergerGitState } from "./merger-git-state.ts";
-import { failOnInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
 import { exactUtf8 } from "./exact-utf8.ts";
 import { isFullGitObjectId } from "./git-object-id.ts";
 
@@ -9,13 +8,13 @@ export { MERGER_OUTPUT_TOOL_NAME };
 export const MERGER_INPUT_FLAG = { name: "ak-merger-input", definition: { description: "Path to an immutable digest-bound Merger v1 input JSON file", type: "string" as const } } as const;
 export const MERGER_ACTIVE_TOOLS = ["read", "grep", "find", "ls", "bash", "write", "edit", MERGER_OUTPUT_TOOL_NAME] as const;
 export type MergerRoleDependencies = { loadSoul(): Promise<string>; loadInput(path: string): Promise<unknown>; gitState: MergerGitState };
-export type MergerRoleHostActions = { failInfrastructure(error: unknown, ctx: ExtensionContext, toolCallId?: string): never };
+export type MergerRoleHostActions = { failInfrastructure(error: unknown, ctx: HostContext, toolCallId?: string): never };
 
 function same(a: readonly string[], b: readonly string[]): boolean { return a.length === b.length && a.every((value, i) => value === b[i]); }
-function singleton(id: string, ctx: ExtensionContext): void { const leaf = ctx.sessionManager.getLeafEntry(); if (leaf?.type !== "message" || leaf.message.role !== "assistant") throw new Error("合并回执非唯一终局工具调用"); const calls = leaf.message.content.filter(part => part.type === "toolCall"); if (calls.length !== 1 || calls[0]?.id !== id || calls[0]?.name !== MERGER_OUTPUT_TOOL_NAME) throw new Error("合并回执非唯一终局工具调用"); }
+function singleton(id: string, ctx: HostContext): void { const leaf = ctx.sessionManager.getLeafEntry(); if (leaf?.type !== "message" || leaf.message === undefined || leaf.message.role !== "assistant" || !Array.isArray(leaf.message.content)) throw new Error("合并回执非唯一终局工具调用"); const calls = leaf.message.content.filter((part): part is Extract<typeof part, { type: "toolCall" }> => part.type === "toolCall"); if (calls.length !== 1 || calls[0]?.id !== id || calls[0]?.name !== MERGER_OUTPUT_TOOL_NAME) throw new Error("合并回执非唯一终局工具调用"); }
 function materialText(input: MergerInput, key: keyof MergerInput["materials"]): string { return exactUtf8(Buffer.from(input.materials[key].bytesBase64, "base64"), `Merger ${key}`); }
 
-export function createMergerRoleRuntime(pi: ExtensionAPI, dependencies: MergerRoleDependencies, host: MergerRoleHostActions) {
+export function createMergerRoleRuntime(pi: RoleHost, dependencies: MergerRoleDependencies, host: MergerRoleHostActions) {
   let activation: { soul: string; input: Readonly<MergerInput>; automaticMergeTreeId: string } | undefined;
   let registered = false;
   let accepted = false;
@@ -29,13 +28,10 @@ export function createMergerRoleRuntime(pi: ExtensionAPI, dependencies: MergerRo
     if (state.targetObjectId !== input.targetObjectId || state.sourceObjectId !== input.sourceObjectId || !same(state.unmergedPaths, input.expectedConflictPaths) || state.unmergedPaths.length === 0 || !isFullGitObjectId(state.automaticMergeTreeId) || state.automaticMergeTreeId.length !== input.targetObjectId.length) throw new Error("Merger activation rejected repository parent, merge, automatic-result, or complete conflict-set drift");
     activation = { soul, input, automaticMergeTreeId: state.automaticMergeTreeId }; accepted = false;
     if (!registered) { registered = true;
-      pi.registerTool({ name: MERGER_OUTPUT_TOOL_NAME, label: "合并输出", description: "提交合并结果；输出分支为 completed 与 escalate", promptSnippet: "提交合并结果", parameters: mergerOutputSchema,
-        async execute(id, params, _signal, _update, ctx) {
+      pi.registerTool({ name: MERGER_OUTPUT_TOOL_NAME, label: "合并输出", description: "提交合并结果；输出分支为 completed 与 escalate；基础设施及 Git 失败由 abort 通道承接。", promptSnippet: "提交合并结果", parameters: mergerOutputSchema,
+        async execute(id: string, params: unknown, _signal: AbortSignal | undefined, _update: unknown, ctx: HostContext) {
           if (!activation) throw new Error("校书郎未激活");
           if (accepted) throw new Error("合并回执已受理");
-          // #541: infra declaration fails via the shared host seam before output
-          // validation / Git verification / accepted=true.
-          failOnInfrastructureFailureDeclaration(params, host, ctx, id);
           let output;
           try {
             singleton(id, ctx);
@@ -54,7 +50,7 @@ export function createMergerRoleRuntime(pi: ExtensionAPI, dependencies: MergerRo
           const acceptedDetails = output;
           return { content: [{ type: "text" as const, text: MERGER_ACCEPTED_TEXT }], details: acceptedDetails, terminate: true as const };
         } });
-      pi.on("before_agent_start", event => { if (!activation) throw new Error("校书郎未激活"); const admitted = { attemptId: activation.input.attemptId, targetObjectId: activation.input.targetObjectId, sourceObjectId: activation.input.sourceObjectId, task: materialText(activation.input, "task"), authority: materialText(activation.input, "authority"), targetIntent: materialText(activation.input, "targetIntent"), sourceIntent: materialText(activation.input, "sourceIntent"), expectedConflictPaths: activation.input.expectedConflictPaths, resolutionScope: activation.input.resolutionScope, authorizedChecks: activation.input.authorizedChecks }; return { systemPrompt: `${event.systemPrompt}\n\n<merger_soul>\n${activation.soul}\n</merger_soul>\n\n<merger_assignment>\n${JSON.stringify(admitted)}\n</merger_assignment>` }; });
+      pi.on("before_agent_start", (event) => { if (!activation) throw new Error("校书郎未激活"); const admitted = { attemptId: activation.input.attemptId, targetObjectId: activation.input.targetObjectId, sourceObjectId: activation.input.sourceObjectId, task: materialText(activation.input, "task"), authority: materialText(activation.input, "authority"), targetIntent: materialText(activation.input, "targetIntent"), sourceIntent: materialText(activation.input, "sourceIntent"), expectedConflictPaths: activation.input.expectedConflictPaths, resolutionScope: activation.input.resolutionScope, authorizedChecks: activation.input.authorizedChecks }; return { systemPrompt: `${event.systemPrompt}\n\n<merger_soul>\n${activation.soul}\n</merger_soul>\n\n<merger_assignment>\n${JSON.stringify(admitted)}\n</merger_assignment>` }; });
     }
     const all = pi.getAllTools().map(tool => tool.name);
     for (const name of MERGER_ACTIVE_TOOLS) if (all.filter(item => item === name).length !== 1) throw new Error(`Merger required tool collision or missing: ${name}`);

package/src/navigator-attendance.ts

@@ -13,6 +13,11 @@ import {
   mintNavigatorInvocationId,
 } from "./navigator-invocation-identity.ts";
 import { PACKAGED_ROLE_REGISTRY, type PackagedRole, packagedRoleMetadata } from "./packaged-role-registry.ts";
+import {
+  activationBookDirectory,
+  resolveActivationLedgerHome,
+} from "./activation-ledger-topology.ts";
+import { sitianReport } from "./sitian-facade.ts";
 import { openInProcessAgentSession } from "./in-process-session.ts";
 import { renderPublicAkRoleCommand } from "./public-command-renderer.ts";
 import { issueRoot, subjectPath } from "./work-subject-identity.ts";
@@ -1308,7 +1313,21 @@ export function createNativeNavigatorSessionFactory(defaultModelSettingPath = na
         }
       },
       providerFailure: () => providerFailure,
-      appendEntry: (customType, data) => { opened.session.sessionManager.appendCustomEntry(customType, data); },
+      appendEntry: (customType, data) => {
+        opened.session.sessionManager.appendCustomEntry(customType, data);
+        try {
+          sitianReport({
+            level: "event",
+            kind: "attendance",
+            cwd: context.cwd,
+            sessionParent: opened.session.sessionManager.getSessionFile(),
+            payload: { customType, data },
+            source: "navigator-attendance",
+          });
+        } catch {
+          // best-effort persistence in attendance adapter
+        }
+      },
       entries: () => opened.session.sessionManager.getEntries(),
       setModel: async (next, thinkingLevel) => {
         let nextParsed: ReturnType<typeof parseNavigatorModelSetting>;

package/src/notary-contracts.ts

@@ -6,7 +6,6 @@
 import { Type } from "typebox";
 
 import { openToolObject } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
 
 export const NOTARY_OUTPUT_TOOL_NAME = "ak_notary_output";
 export const NOTARY_ACCEPTED_TEXT = "符宝郎回执已接受";
@@ -22,17 +21,15 @@ export const NOTARY_SOURCE_RUN_FLAG = {
 export const NOTARY_FIXED_KICKOFF =
   "符宝郎案卷已受理；来源 run 定位见会话材料。";
 
-export const notaryOutputSchema = withInfrastructureFailureDeclaration(
-  openToolObject(
-    Type.Object({
-      status: Type.Unknown({
-        description: "pass | bounce — 形状指引，非 schema 闸",
-      }),
-      findings: Type.Unknown({
-        description: "string[] findings，随 pass 或 bounce 留存",
-      }),
+export const notaryOutputSchema = openToolObject(
+  Type.Object({
+    status: Type.Unknown({
+      description: "pass | bounce — 形状指引，非 schema 闸",
     }),
-  ),
+    findings: Type.Unknown({
+      description: "string[] findings，随 pass 或 bounce 留存",
+    }),
+  }),
 );
 
 export type NotarySourceRunLocator = {

package/src/notary-role.ts

@@ -1,12 +1,8 @@
+import type { RoleHost, HostContext, HostToolResult } from "./host-contracts.ts";
 /**
  * Public Notary role runtime — direct officer seat (not through Gatekeeper province).
  * Caller supplies only a source-run locator; Notary self-fetches authoritative materials.
  */
-import type {
-  AgentToolResult,
-  ExtensionAPI,
-  ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
 
 import {
   NOTARY_ACCEPTED_TEXT,
@@ -17,9 +13,6 @@ import {
   retainNotarySubmission,
   type NotarySourceRunLocator,
 } from "./notary-contracts.ts";
-import {
-  failOnInfrastructureFailureDeclaration,
-} from "./package-contracts/terminating-infrastructure.ts";
 
 export {
   NOTARY_ACCEPTED_TEXT,
@@ -35,20 +28,20 @@ export type NotaryRoleDependencies = {
 export type NotaryRoleHostActions = {
   failInfrastructure(
     error: unknown,
-    ctx: ExtensionContext,
+    ctx: HostContext,
     toolCallId?: string,
   ): never;
 };
 
 function requireSingletonSubmissionCall(
   toolCallId: string,
-  ctx: ExtensionContext,
+  ctx: HostContext,
 ): void {
   const leaf = ctx.sessionManager.getLeafEntry();
-  if (leaf?.type !== "message" || leaf.message.role !== "assistant") {
+  if (leaf?.type !== "message" || leaf.message === undefined || leaf.message.role !== "assistant" || !Array.isArray(leaf.message.content)) {
     throw new Error("符宝郎回执非唯一终局工具调用");
   }
-  const calls = leaf.message.content.filter((part) => part.type === "toolCall");
+  const calls = leaf.message.content.filter((part): part is Extract<typeof part, { type: "toolCall" }> => part.type === "toolCall");
   if (
     calls.length !== 1 ||
     calls[0]?.id !== toolCallId ||
@@ -59,7 +52,7 @@ function requireSingletonSubmissionCall(
 }
 
 export function createNotaryRoleRuntime(
-  pi: ExtensionAPI,
+  pi: RoleHost,
   dependencies: NotaryRoleDependencies,
   host: NotaryRoleHostActions,
 ) {
@@ -91,19 +84,10 @@ export function createNotaryRoleRuntime(
           description: "提交引文保真与票面对齐的 typed pass/bounce 决议。",
           promptSnippet: "提交符宝郎决议",
           parameters: notaryOutputSchema,
-          async execute(
-            toolCallId,
-            parameters,
-            _signal,
-            _onUpdate,
-            ctx,
-          ): Promise<AgentToolResult<unknown>> {
+          async execute(toolCallId: string, parameters: unknown, _signal: AbortSignal | undefined, _onUpdate: unknown, ctx: HostContext, ): Promise<HostToolResult<unknown>> {
             if (activation === undefined) {
               throw new Error("符宝郎未激活");
             }
-            // #541: infra declaration fails via the shared host seam before any
-            // pass/bounce projection.
-            failOnInfrastructureFailureDeclaration(parameters, host, ctx, toolCallId);
             // Unique submission + terminate only. Shape is not an admission gate
             // (第 0 条 / ADR 0055): lawful pass/bounce projected; else params as-is.
             requireSingletonSubmissionCall(toolCallId, ctx);

package/src/notary-source-run.ts

@@ -13,7 +13,7 @@ import {
   resolveActivationLedgerHome,
 } from "./activation-ledger-topology.ts";
 import type { NotarySourceRunLocator } from "./notary-contracts.ts";
-import { readRoleRunState } from "./public-cli/run-lifecycle.ts";
+import { readRoleRunIdentity } from "./public-cli/run-lifecycle.ts";
 
 const RUN_DIR_NAME =
   /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})@([A-Za-z][A-Za-z0-9_-]*)$/i;
@@ -109,7 +109,8 @@ export async function resolveNotarySourceRunLocator(options: {
   }
 
   // Authoritative retained record only — legal role/state via shared reader (DRY #14).
-  const runState = await readRoleRunState(real);
+  // Identity envelope only: principal payload is not interpreted here.
+  const runState = await readRoleRunIdentity(real);
   if (runState === undefined) {
     throw new NotarySourceRunError(
       "notary --source-run lacks retained run-state identity",
@@ -144,7 +145,7 @@ export async function loadNotarySourceRunLocator(
 ): Promise<NotarySourceRunLocator> {
   const real = await requireRunDirectory(path, path);
   const identity = parseRunDirectoryName(basename(real))!;
-  const runState = await readRoleRunState(real);
+  const runState = await readRoleRunIdentity(real);
   if (runState === undefined) {
     throw new NotarySourceRunError(
       "notary source-run lacks retained run-state identity",

package/src/package-contracts/fixer-output.ts

@@ -1,7 +1,6 @@
 import { Type, type Static } from "typebox";
 import { FIXER_PREREQUISITE_ID_PATTERN, type FixerInvocationInput } from "./fixer-packet.ts";
 import { openToolObjectFromUnion } from "../open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./terminating-infrastructure.ts";
 
 export const FIXER_OUTPUT_TOOL_NAME = "ak_fixer_output";
 export const FIXER_ACCEPTED_TEXT = "修内司回执已接受";
@@ -41,9 +40,7 @@ const fixerOutputVariants = Type.Union([
   Type.Object({ status: Type.Literal("refused", { description: "refused — 形状指引，非 schema 闸" }), report: Type.String({ minLength: 1, description: "如实结果报告" }), classResults: Type.Array(classResultSchema, { minItems: 1, description: "各类拒绝结算" }) }),
   Type.Object({ status: Type.Literal("partially_completed", { description: "partially_completed — 形状指引，非 schema 闸" }), report: Type.String({ minLength: 1, description: "如实结果报告" }), classResults: Type.Array(classResultSchema, { minItems: 1, description: "各类完成或拒绝结算" }), testEvidence: Type.Optional(testEvidenceSchema) }),
 ]);
-export const fixerOutputSchema = withInfrastructureFailureDeclaration(
-  openToolObjectFromUnion(fixerOutputVariants),
-);
+export const fixerOutputSchema = openToolObjectFromUnion(fixerOutputVariants);
 
 export type FixerBlocker = Static<typeof blockerSchema>;
 export type FixerClassResult = Static<typeof classResultSchema>;

package/src/package-resources/method-skill-binding.ts

@@ -1,15 +1,13 @@
 /**
  * Canonical Skill binding built from package-owned method material.
- * Lives beside the method seam but may import Pi skill parsers — used by the
- * Internal role runtime, not the public ak-role bin bundle.
+ * Lives beside the method seam — used by the Internal role runtime, not the
+ * public ak-role bin bundle.
  */
 import { dirname } from "node:path";
 
-import { parseSkillBlock } from "@earendil-works/pi-coding-agent";
-
 import {
+  captureCanonicalSkillExpansion,
   type CanonicalSkillBinding,
-  type CanonicalSkillEvidence,
   type CanonicalSkillName,
 } from "../canonical-skill-binding.ts";
 import {
@@ -51,36 +49,14 @@ export async function loadPackagedCanonicalSkillBinding<
     invocation(originalRequest) {
       return `/skill:${name} ${originalRequest}`;
     },
-    captureExpansion(
-      prompt,
-      originalRequest,
-    ): CanonicalSkillEvidence<Name> | undefined {
-      const parsed = parseSkillBlock(prompt);
-      const matchedPath =
-        parsed?.location === configuredPath
-          ? configuredPath
-          : parsed?.location === snapshot.path
-            ? snapshot.path
-            : undefined;
-      const expectedContent =
-        matchedPath === undefined
-          ? undefined
-          : `References are relative to ${dirname(matchedPath)}.\n\n${snapshot.body}`;
-      const userMessage = parsed?.userMessage ?? "";
-      if (
-        parsed?.name !== name ||
-        matchedPath === undefined ||
-        parsed.content !== expectedContent ||
-        userMessage !== originalRequest
-      ) {
-        return undefined;
-      }
-      return Object.freeze({
+    captureExpansion(evidence, originalRequest) {
+      return captureCanonicalSkillExpansion(
         name,
-        location: parsed.location,
-        content: parsed.content,
-        userMessage,
-      });
+        snapshot,
+        configuredPath,
+        evidence,
+        originalRequest,
+      );
     },
   };
   return Object.freeze(binding);