@akagilnc/pi-workflow-roles 0.1.2521 → 0.1.2653-next.71811ca

package/src/public-cli/invocation.ts

@@ -19,7 +19,11 @@ import {
   resolveActivationLedgerHome,
 } from "../activation-ledger-topology.ts";
 import { resolveBookKeyFromGit } from "../activation-ledger-git.ts";
-import { roleRunSessionCoordinates } from "../archivist-role-run-coordinates.ts";
+import type {
+  DurablePrincipal,
+  DurablePrincipalAuthority,
+} from "../host-contracts.ts";
+import { decodePiDurablePrincipal } from "../pi/durable-principal.ts";
 import { resolveTicketNumberFromAttachmentBodies } from "../ticket-frontmatter.ts";
 import {
   loadDoctorCase,
@@ -69,6 +73,12 @@ import {
   type OptionOwner,
   type PublicOptionDefinition,
 } from "./option-definitions.ts";
+import { loadPublicCliConfig, THINKING_LEVELS } from "./config.ts";
+import type { PublicThinkingLevel } from "./registry.ts";
+import {
+  resolveInstitutionalSeatSelections,
+  writeInstitutionalResolutionPage,
+} from "../institutional-resolution.ts";
 
 export type FrozenAttachment = {
   /** Original caller path retained only as provenance. */
@@ -91,9 +101,8 @@ export type AdmittedRoleInvocationBase = {
   readonly instructionEmpty: boolean;
   readonly attachments: readonly FrozenAttachment[];
   readonly runDirectory: string;
-  readonly sessionDirectory: string;
-  /** Exact Pi session file principal (bound at admission; reopened on resume). */
-  readonly sessionFile: string;
+  /** Host-issued opaque durable principal (coordinates only via authority.decode). */
+  readonly principal: DurablePrincipal;
   readonly admittedRequestPath: string;
   /**
    * Optional opaque invocation correlation restored from a prior admitted page
@@ -105,6 +114,8 @@ export type AdmittedRoleInvocationBase = {
    * Absent when no attachment carries a valid contract field (unbound).
    */
   readonly ticketNumber?: number;
+  /** Effective model from invocation identity; restored on resume when no CLI model is given. */
+  readonly model?: InvocationEffectiveModel;
 };
 
 export type AdmittedJudgeInvocation = AdmittedRoleInvocationBase & {
@@ -197,19 +208,83 @@ export type AdmittedRoleInvocation =
   | AdmittedReviewerInvocation
   | AdmittedMergerInvocation;
 
+/** Persistence projection only — not carried on Admitted (opaque principal owns identity). */
 type RoleInvocationLedgerSource = Pick<
   AdmittedRoleInvocationBase,
-  "runId" | "bookKey" | "projectRoot" | "runDirectory" | "sessionDirectory" | "sessionFile" | "correlationId" | "ticketNumber"
->;
+  "runId" | "bookKey" | "projectRoot" | "runDirectory" | "correlationId" | "ticketNumber"
+> & {
+  readonly sessionDirectory: string;
+  readonly sessionFile: string;
+};
+
+/** Shared admission placement from an injected host authority (no consumer Pi default). */
+export type AdmissionPlacement = {
+  readonly principal: DurablePrincipal;
+  readonly sessionDirectory: string;
+  readonly sessionFile: string;
+  readonly runDirectory: string;
+  readonly ledgerHome: string;
+  readonly bookKey: string;
+};
+
+/** Issue principal + derive ledger placement through the injected authority only. */
+export function issueAdmissionPlacement(
+  authority: DurablePrincipalAuthority,
+  request: {
+    readonly cwd: string;
+    readonly runId: string;
+    readonly role: AdmittedRoleInvocation["role"];
+    readonly home?: string;
+  },
+): AdmissionPlacement {
+  const principal = authority.issue(request);
+  const { sessionDirectory, sessionFile } = decodePiDurablePrincipal(authority, principal);
+  const runDirectory = join(sessionDirectory, "..");
+  const ledgerHome = resolveActivationLedgerHome(
+    request.home === undefined ? undefined : () => request.home!,
+  );
+  const bookKey = resolveBookKeyFromGit(request.cwd);
+  return {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  };
+}
+
+/**
+ * Unique admitted-request.json persistence projection: top-level sessionDirectory/sessionFile
+ * (base wire shape). Memory Admitted keeps only the opaque principal — never dual-carry.
+ */
+async function writeAdmittedRequestPersistence(
+  admittedRequestPath: string,
+  body: Record<string, unknown>,
+  coordinates: { readonly sessionDirectory: string; readonly sessionFile: string },
+): Promise<void> {
+  const { principal: _omitPrincipal, ...rest } = body;
+  const projection = {
+    ...rest,
+    sessionDirectory: coordinates.sessionDirectory,
+    sessionFile: coordinates.sessionFile,
+  };
+  await writeFile(
+    admittedRequestPath,
+    `${JSON.stringify(projection, null, 2)}\n`,
+    "utf8",
+  );
+}
 
 /**
  * Effective provider/model selection recorded on the invocation identity page.
  * thinking is present only when the caller/seat supplied it — bare model omits it.
+ * Restored values are bounded to typed PublicThinkingLevel (never arbitrary string).
  */
 export type InvocationEffectiveModel = {
   readonly provider: string;
   readonly model: string;
-  readonly thinking?: string;
+  readonly thinking?: PublicThinkingLevel;
 };
 
 /** Project effective model onto ledger fields; absent thinking stays absent. */
@@ -224,6 +299,24 @@ function effectiveModelLedgerFields(
   };
 }
 
+function homeFromRunDirectory(runDirectory: string): string {
+  const marker = `${sep}.ak-roles${sep}`;
+  const idx = runDirectory.indexOf(marker);
+  if (idx !== -1) {
+    return runDirectory.slice(0, idx);
+  }
+  const altMarker = ".ak-roles";
+  const altIdx = runDirectory.indexOf(altMarker);
+  if (altIdx !== -1) {
+    const candidate = runDirectory.slice(0, altIdx);
+    return candidate.endsWith("/") || candidate.endsWith("\\") ? candidate.slice(0, -1) : candidate;
+  }
+  if (typeof process.env.HOME === "string" && process.env.HOME.length > 0) {
+    return process.env.HOME;
+  }
+  throw new Error(`cannot resolve home from runDirectory: ${runDirectory}`);
+}
+
 /**
  * Persist one `invocation.json` identity page for the public run.
  * Admission is the sole source for every field; this is the only identity
@@ -253,6 +346,10 @@ async function writeRoleInvocationLedger(
     `${JSON.stringify(identity, null, 2)}\n`,
     "utf8",
   );
+  const home = homeFromRunDirectory(source.runDirectory);
+  const config = await loadPublicCliConfig(home);
+  const institutionalPage = resolveInstitutionalSeatSelections(config, effectiveModel);
+  await writeInstitutionalResolutionPage(source.runDirectory, institutionalPage);
 }
 
 /**
@@ -291,6 +388,21 @@ export async function recordEffectiveInvocationModel(
     `${JSON.stringify(next, null, 2)}\n`,
     "utf8",
   );
+  const effectiveModel: InvocationEffectiveModel | undefined =
+    typeof next.provider === "string" && typeof next.model === "string"
+      ? {
+          provider: next.provider,
+          model: next.model,
+          ...(typeof next.thinking === "string" &&
+          THINKING_LEVELS.has(next.thinking as PublicThinkingLevel)
+            ? { thinking: next.thinking as PublicThinkingLevel }
+            : {}),
+        }
+      : undefined;
+  const home = homeFromRunDirectory(runDirectory);
+  const config = await loadPublicCliConfig(home);
+  const institutionalPage = resolveInstitutionalSeatSelections(config, effectiveModel);
+  await writeInstitutionalResolutionPage(runDirectory, institutionalPage);
 }
 
 /** Merge observed launch-time fields into the single existing invocation.json identity page. */
@@ -763,6 +875,7 @@ export type AdmitJudgeInvocationOptions = {
   project?: string;
   /** Injectable clock/id for tests. */
   createRunId?: () => string;
+  principalAuthority: DurablePrincipalAuthority;
   /** Effective model for this invocation — written onto invocation.json. */
   model?: InvocationEffectiveModel;
 };
@@ -780,8 +893,19 @@ export async function admitJudgeInvocation(
   }
   const projectRoot = resolve(options.project ?? options.cwd);
   const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } =
-    roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "judge", home: options.home });
+  const {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  } = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: projectRoot,
+    runId,
+    role: "judge",
+    home: options.home,
+  });
   const attachmentsDirectory = join(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
@@ -800,8 +924,7 @@ export async function admitJudgeInvocation(
     bookKey,
     projectRoot,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     ...ticketFields,
     instruction,
     instructionEmpty,
@@ -814,8 +937,11 @@ export async function admitJudgeInvocation(
     })),
   };
   const admittedRequestPath = join(runDirectory, "admitted-request.json");
-  await writeFile(admittedRequestPath, `${JSON.stringify(admitted, null, 2)}\n`, "utf8");
-  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
+  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    sessionDirectory,
+    sessionFile,
+  });
+  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
 
   return {
     role: "judge",
@@ -826,8 +952,7 @@ export async function admitJudgeInvocation(
     instructionEmpty,
     attachments,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     admittedRequestPath,
     ...ticketFields,
   };
@@ -885,6 +1010,7 @@ export async function ensureRunArtifactsDir(runDirectory: string): Promise<strin
 
 export type AdmitCoderInvocationOptions = {
   home: string;
+  principalAuthority: DurablePrincipalAuthority;
   cwd: string;
   phase: CoderPhase;
   instruction: string;
@@ -918,8 +1044,19 @@ export async function admitCoderInvocation(
 
   const projectRoot = resolve(options.project ?? options.cwd);
   const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } =
-    roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "coder", home: options.home });
+  const {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  } = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: projectRoot,
+    runId,
+    role: "coder",
+    home: options.home,
+  });
   const attachmentsDirectory = join(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
@@ -940,8 +1077,7 @@ export async function admitCoderInvocation(
     bookKey,
     projectRoot,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     ...ticketFields,
     instruction,
     instructionEmpty: false,
@@ -955,8 +1091,11 @@ export async function admitCoderInvocation(
     })),
   };
   const admittedRequestPath = join(runDirectory, "admitted-request.json");
-  await writeFile(admittedRequestPath, `${JSON.stringify(admitted, null, 2)}\n`, "utf8");
-  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
+  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    sessionDirectory,
+    sessionFile,
+  });
+  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
 
   return {
     role: "coder",
@@ -968,8 +1107,7 @@ export async function admitCoderInvocation(
     instructionEmpty: false,
     attachments,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     admittedRequestPath,
     taskPath,
     ...ticketFields,
@@ -998,6 +1136,7 @@ export function buildCoderTransportPrompt(
 
 export type AdmitFixerInvocationOptions = {
   home: string;
+  principalAuthority: DurablePrincipalAuthority;
   cwd: string;
   phase: FixerPhase;
   instruction: string;
@@ -1058,8 +1197,19 @@ export async function admitFixerInvocation(
 
   const projectRoot = resolve(options.project ?? options.cwd);
   const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } =
-    roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "fixer", home: options.home });
+  const {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  } = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: projectRoot,
+    runId,
+    role: "fixer",
+    home: options.home,
+  });
   const attachmentsDirectory = join(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
@@ -1090,8 +1240,7 @@ export async function admitFixerInvocation(
     bookKey,
     projectRoot,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     ...ticketFields,
     instruction,
     instructionEmpty: false,
@@ -1110,8 +1259,11 @@ export async function admitFixerInvocation(
     })),
   };
   const admittedRequestPath = join(runDirectory, "admitted-request.json");
-  await writeFile(admittedRequestPath, `${JSON.stringify(admitted, null, 2)}\n`, "utf8");
-  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
+  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    sessionDirectory,
+    sessionFile,
+  });
+  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
 
   return {
     role: "fixer",
@@ -1123,8 +1275,7 @@ export async function admitFixerInvocation(
     instructionEmpty: false,
     attachments,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     admittedRequestPath,
     packetPath,
     ...(prerequisitesPath === undefined ? {} : { prerequisitesPath }),
@@ -1295,6 +1446,7 @@ function stripGitSuffix(name: string): string {
 
 export type AdmitCollectorInvocationOptions = {
   home: string;
+  principalAuthority: DurablePrincipalAuthority;
   cwd: string;
   prNumber: number;
   instruction?: string;
@@ -1355,8 +1507,19 @@ export async function admitCollectorInvocation(
   const manifestDigest = manifest.digest;
 
   const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } =
-    roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "collector", home: options.home });
+  const {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  } = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: projectRoot,
+    runId,
+    role: "collector",
+    home: options.home,
+  });
   const attachmentsDirectory = join(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
@@ -1381,8 +1544,7 @@ export async function admitCollectorInvocation(
     bookKey,
     projectRoot,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     ...ticketFields,
     instruction,
     instructionEmpty,
@@ -1400,12 +1562,11 @@ export async function admitCollectorInvocation(
     })),
   };
   const admittedRequestPath = join(runDirectory, "admitted-request.json");
-  await writeFile(
-    admittedRequestPath,
-    `${JSON.stringify(admitted, null, 2)}\n`,
-    "utf8",
-  );
-  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
+  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    sessionDirectory,
+    sessionFile,
+  });
+  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
 
   return {
     role: "collector",
@@ -1416,8 +1577,7 @@ export async function admitCollectorInvocation(
     instructionEmpty,
     attachments,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     admittedRequestPath,
     prNumber,
     repository,
@@ -1533,6 +1693,7 @@ export function parseDoctorArgv(args: readonly string[]): ParseDoctorArgvResult
 
 export type AdmitDoctorInvocationOptions = {
   home: string;
+  principalAuthority: DurablePrincipalAuthority;
   cwd: string;
   issueNumber: number;
   /** Optional project-relative retained runs root override. */
@@ -1639,8 +1800,19 @@ export async function admitDoctorInvocation(
 
   const projectRoot = resolve(options.project ?? options.cwd);
   const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } =
-    roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "doctor", home: options.home });
+  const {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  } = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: projectRoot,
+    runId,
+    role: "doctor",
+    home: options.home,
+  });
 
   let caseRunsPath: string;
   try {
@@ -1700,8 +1872,7 @@ export async function admitDoctorInvocation(
     bookKey,
     projectRoot,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     ...ticketFields,
     instruction,
     instructionEmpty,
@@ -1717,12 +1888,11 @@ export async function admitDoctorInvocation(
     })),
   };
   const admittedRequestPath = join(runDirectory, "admitted-request.json");
-  await writeFile(
-    admittedRequestPath,
-    `${JSON.stringify(admitted, null, 2)}\n`,
-    "utf8",
-  );
-  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
+  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    sessionDirectory,
+    sessionFile,
+  });
+  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
 
   return {
     role: "doctor",
@@ -1733,8 +1903,7 @@ export async function admitDoctorInvocation(
     instructionEmpty,
     attachments,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     admittedRequestPath,
     issueNumber: options.issueNumber,
     caseRunsPath,
@@ -1821,6 +1990,7 @@ export function parseNotaryArgv(args: readonly string[]): ParseNotaryArgvResult
 
 export async function admitNotaryInvocation(options: {
   readonly home: string;
+  readonly principalAuthority: DurablePrincipalAuthority;
   readonly cwd: string;
   readonly sourceRun: string;
   readonly project?: string;
@@ -1848,13 +2018,19 @@ export async function admitNotaryInvocation(options: {
   }
 
   const runId = options.createRunId?.() ?? uuidv7();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } =
-    roleRunSessionCoordinates({
-      cwd: projectRoot,
-      runId,
-      role: "notary",
-      home: options.home,
-    });
+  const {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  } = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: projectRoot,
+    runId,
+    role: "notary",
+    home: options.home,
+  });
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
 
   const admitted = {
@@ -1863,8 +2039,7 @@ export async function admitNotaryInvocation(options: {
     bookKey,
     projectRoot,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     instruction: "",
     instructionEmpty: true,
     attachments: [] as const,
@@ -1875,12 +2050,11 @@ export async function admitNotaryInvocation(options: {
       : { correlationId: options.correlationId }),
   };
   const admittedRequestPath = join(runDirectory, "admitted-request.json");
-  await writeFile(
-    admittedRequestPath,
-    `${JSON.stringify(admitted, null, 2)}\n`,
-    "utf8",
-  );
-  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
+  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    sessionDirectory,
+    sessionFile,
+  });
+  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
 
   return {
     role: "notary",
@@ -1891,8 +2065,7 @@ export async function admitNotaryInvocation(options: {
     instructionEmpty: true,
     attachments: [],
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     admittedRequestPath,
     sourceRunPath: sourceRun.runDirectory,
     sourceRun,
@@ -1973,6 +2146,7 @@ export function parseReviewerArgv(
 
 export type AdmitReviewerInvocationOptions = {
   home: string;
+  principalAuthority: DurablePrincipalAuthority;
   cwd: string;
   /** Optional caller prose retained only as admitted provenance — never semantic control. */
   instruction: string;
@@ -2006,8 +2180,19 @@ export async function admitReviewerInvocation(
 
   const projectRoot = resolve(options.project ?? options.cwd);
   const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } =
-    roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "reviewer", home: options.home });
+  const {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  } = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: projectRoot,
+    runId,
+    role: "reviewer",
+    home: options.home,
+  });
   const attachmentsDirectory = join(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
@@ -2027,8 +2212,7 @@ export async function admitReviewerInvocation(
     bookKey,
     projectRoot,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     ...ticketFields,
     instruction,
     instructionEmpty,
@@ -2043,12 +2227,11 @@ export async function admitReviewerInvocation(
     })),
   };
   const admittedRequestPath = join(runDirectory, "admitted-request.json");
-  await writeFile(
-    admittedRequestPath,
-    `${JSON.stringify(admitted, null, 2)}\n`,
-    "utf8",
-  );
-  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
+  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    sessionDirectory,
+    sessionFile,
+  });
+  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
 
   return {
     role: "reviewer",
@@ -2059,8 +2242,7 @@ export async function admitReviewerInvocation(
     instructionEmpty,
     attachments,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     admittedRequestPath,
     baseRevision: options.baseRevision,
     authorityRefs,
@@ -2190,6 +2372,7 @@ export async function deriveMergerEnvelopeFromActiveMerge(
 
 export type AdmitMergerInvocationOptions = {
   home: string;
+  principalAuthority: DurablePrincipalAuthority;
   cwd: string;
   instruction: string;
   attachmentPaths: readonly string[];
@@ -2226,8 +2409,19 @@ export async function admitMergerInvocation(
   );
 
   const runId = (options.createRunId ?? uuidv7)();
-  const { ledgerHome, bookKey, runDirectory, sessionDirectory, sessionFile } =
-    roleRunSessionCoordinates({ cwd: projectRoot, runId, role: "merger", home: options.home });
+  const {
+    principal,
+    sessionDirectory,
+    sessionFile,
+    runDirectory,
+    ledgerHome,
+    bookKey,
+  } = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: projectRoot,
+    runId,
+    role: "merger",
+    home: options.home,
+  });
   const attachmentsDirectory = join(runDirectory, "attachments");
   ensureRealDirectoryTree(ledgerHome, sessionDirectory);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
@@ -2279,8 +2473,7 @@ export async function admitMergerInvocation(
     bookKey,
     projectRoot,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     ...ticketFields,
     instruction,
     instructionEmpty: false,
@@ -2301,12 +2494,11 @@ export async function admitMergerInvocation(
     })),
   };
   const admittedRequestPath = join(runDirectory, "admitted-request.json");
-  await writeFile(
-    admittedRequestPath,
-    `${JSON.stringify(admitted, null, 2)}\n`,
-    "utf8",
-  );
-  await writeRoleInvocationLedger(admitted, admitted.role, options.model);
+  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    sessionDirectory,
+    sessionFile,
+  });
+  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
 
   return {
     role: "merger",
@@ -2317,8 +2509,7 @@ export async function admitMergerInvocation(
     instructionEmpty: false,
     attachments,
     runDirectory,
-    sessionDirectory,
-    sessionFile,
+    principal,
     admittedRequestPath,
     mergerInputPath,
     derived: admitted.derived,