@akagilnc/pi-workflow-roles 0.1.2521 → 0.1.2653-next.71811ca

package/dist/reviewer-child-executor.js

@@ -15,7 +15,12 @@ export function projectSharedChildFailure(error) {
 /** Reviewer policy adapter over the shared evidence-child lifecycle seam. */
 export async function executeReviewerChild(workspace, leg, context, options = {}) {
     try {
-        return await executeEvidenceChild(workspace, leg.prompt, context, options);
+        return await executeEvidenceChild(workspace, leg.prompt, context, {
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+            ...(options.credentialScratchParent === undefined ? {} : { credentialScratchParent: options.credentialScratchParent }),
+            ...(options.runDirectory === undefined ? {} : { runDirectory: options.runDirectory }),
+            ...(options.packageRoot === undefined ? {} : { packageRoot: options.packageRoot }),
+        });
     }
     catch (error) {
         throw projectSharedChildFailure(error);

package/dist/session-opening-materials.js

@@ -1,13 +1,13 @@
 /**
- * Session opening materials (#443): factory constitution + role soul + role-owned
- * extras, composed at the three existing loader seams. Missing files fail as
- * native readFile errors — no exists/hash/empty guards, no second loader.
- *
- * Auditor composition stays owned by loadAuditorSoul (blank-soul identity);
- * main roles and gatekeeper family share joinPackageMaterials here.
+ * Session opening materials (#443 / #524). Missing files fail as native readFile
+ * errors. Main-role materials derive from PUBLIC_ROLE_RECORDS; gatekeeper seats
+ * stay independent except notary (shared NOTARY_SESSION_MATERIALS). Navigator is
+ * name-only here, not a public role record. Auditor composition stays in
+ * loadAuditorSoul; loaders share joinPackageMaterials.
  */
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
+import { NOTARY_SESSION_MATERIALS, PUBLIC_ROLE_RECORDS, } from "./packaged-role-registry.js";
 const packageRootUrl = new URL("..", import.meta.url);
 /** Self-locate one package-relative material. Native I/O errors propagate. */
 export async function readPackageMaterial(relativePath) {
@@ -21,43 +21,15 @@ export async function joinPackageMaterials(relativePaths) {
     }
     return chunks.join("\n\n");
 }
-/** Seven public main roles + Navigator. Ticket #443 injection roster. */
+/** Derived projection: public records + navigator name-only materials. */
 export const MAIN_ROLE_SESSION_MATERIALS = {
-    judge: [
-        "CLAUDE.md",
-        "souls/judge.md",
-        "souls/audit-law.md",
-        "souls/quality-law.md",
-        "souls/judge-output-guide.md",
-    ],
-    fixer: [
-        "CLAUDE.md",
-        "souls/fixer.md",
-        "souls/quality-law.md",
-        "souls/fixer-output-guide.md",
-    ],
-    coder: [
-        "CLAUDE.md",
-        "souls/coder.md",
-        "souls/quality-law.md",
-        "souls/coder-output-guide.md",
-    ],
-    reviewer: [
-        "CLAUDE.md",
-        "souls/reviewer.md",
-        "souls/audit-law.md",
-        "souls/quality-law.md",
-    ],
-    collector: ["CLAUDE.md", "souls/collector.md"],
-    doctor: ["CLAUDE.md", "souls/doctor.md"],
-    merger: ["CLAUDE.md", "souls/merger.md"],
-    notary: ["CLAUDE.md", "souls/notary.md", "souls/gate-output-guide.md"],
+    ...Object.fromEntries(PUBLIC_ROLE_RECORDS.map((record) => [record.role, record.sessionMaterials])),
     navigator: ["CLAUDE.md", "souls/navigator.md"],
 };
 export function loadMainRoleSessionMaterials(role) {
     return joinPackageMaterials(MAIN_ROLE_SESSION_MATERIALS[role]);
 }
-/** Gatekeeper province + Inspector/Notary officer sessions. */
+/** Gatekeeper province; notary reuses the public notary materials definition. */
 export const GATEKEEPER_SESSION_MATERIALS = {
     gatekeeper: [
         "CLAUDE.md",
@@ -71,7 +43,7 @@ export const GATEKEEPER_SESSION_MATERIALS = {
         "souls/quality-law.md",
         "souls/gate-output-guide.md",
     ],
-    notary: ["CLAUDE.md", "souls/notary.md", "souls/gate-output-guide.md"],
+    notary: NOTARY_SESSION_MATERIALS,
 };
 export function loadGatekeeperSessionMaterials(role) {
     return joinPackageMaterials(GATEKEEPER_SESSION_MATERIALS[role]);

package/dist/sitian-appender.js

@@ -0,0 +1,146 @@
+/**
+ * Sitian Appender kernel (ADR 0065).
+ * Computes destination automatically from ledger topology without destination parameters.
+ * Owns volume open, torn-tail recovery, entry-level idempotency, and commit boundary.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { appendFileSync, existsSync, readFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
+import { activationBookDirectory, ensureRealDirectoryTree, errorText, physicallyContainedIn, resolveActivationLedgerHome, } from "./activation-ledger-topology.js";
+import { SitianInfrastructureError, } from "./sitian-contracts.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Authorized S4 submission ledger kinds that share a common run submission volume. */
+export const S4_SUBMISSION_LEDGER_KINDS = new Set([
+    "candidate",
+    "batchContext",
+    "outcome",
+    "sealed",
+    "post-seal-anomaly",
+]);
+/** Compute the volume partition key for directory placement. */
+export function resolveSitianVolumeCategory(kind) {
+    if (S4_SUBMISSION_LEDGER_KINDS.has(kind)) {
+        return "submission-ledger";
+    }
+    return kind;
+}
+function safeBookKey(cwd) {
+    try {
+        return resolveBookKeyFromGit(cwd);
+    }
+    catch {
+        return basename(resolve(cwd)) || "default";
+    }
+}
+/** Compute the destination directory and record file from ledger topology (ADR 0065). */
+export function resolveSitianRecordPath(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const ledgerHome = resolveActivationLedgerHome();
+    const category = resolveSitianVolumeCategory(input.kind);
+    let sessionDir;
+    if (input.sessionParent !== undefined && input.sessionParent.length > 0 && physicallyContainedIn(ledgerHome, input.sessionParent)) {
+        sessionDir = join(dirname(input.sessionParent), category);
+    }
+    else {
+        const bookKey = safeBookKey(cwd);
+        const bookDir = activationBookDirectory(ledgerHome, bookKey);
+        if (input.subject !== undefined) {
+            let subjectStr;
+            if (typeof input.subject === "string") {
+                subjectStr = input.subject;
+            }
+            else if (typeof input.subject.runId === "string" && input.subject.runId.length > 0) {
+                subjectStr = input.subject.runId;
+            }
+            else {
+                subjectStr = JSON.stringify(input.subject);
+            }
+            const digest = createHash("sha256").update(subjectStr).digest("hex").slice(0, 32);
+            sessionDir = join(bookDir, category, digest);
+        }
+        else {
+            sessionDir = join(bookDir, category);
+        }
+    }
+    const recordFile = join(sessionDir, "records.jsonl");
+    return { sessionDir, recordFile, ledgerHome };
+}
+/**
+ * Appends a canonical record to its self-computed volume under the Sitian contract.
+ * - Idempotency: checks volume by deterministic canonical identity; returns existing pointer on hit.
+ * - Torn-tail recovery: checks file tail; un-terminated trailing bytes are sealed with a newline and re-parsed.
+ *   Substate a (valid JSON): committed on recovery, returns existing pointer.
+ *   Substate b (malformed): preserved as bad line, check misses, appends new row.
+ * - Commit point: full JSON string ending with newline.
+ */
+export function appendSitianRecord(input) {
+    try {
+        const { sessionDir, recordFile, ledgerHome } = resolveSitianRecordPath(input);
+        ensureRealDirectoryTree(ledgerHome, sessionDir);
+        const identity = input.identity ?? randomUUID();
+        const timestamp = input.timestamp ?? new Date().toISOString();
+        const host = input.host ?? "pi";
+        const record = {
+            level: input.level,
+            kind: input.kind,
+            identity,
+            ...(input.subject === undefined ? {} : { subject: input.subject }),
+            ...(input.sessionParent === undefined ? {} : { sessionParent: input.sessionParent }),
+            ...(input.priorEventId === undefined ? {} : { priorEventId: input.priorEventId }),
+            timestamp,
+            host,
+            ...(input.source === undefined ? {} : { source: input.source }),
+            ...(input.payload === undefined ? {} : { payload: input.payload }),
+            ...(input.raw === undefined ? {} : { raw: input.raw }),
+            ...(input.usage === undefined ? {} : { usage: input.usage }),
+        };
+        if (existsSync(recordFile)) {
+            const buffer = readFileSync(recordFile);
+            if (buffer.length > 0) {
+                // Torn-tail check: if last byte is not newline, seal the fragment with \n
+                if (buffer[buffer.length - 1] !== 0x0a) {
+                    appendFileSync(recordFile, "\n", "utf8");
+                }
+                // Self-check volume by canonical identity
+                const text = readFileSync(recordFile, "utf8");
+                for (const line of text.split("\n")) {
+                    const trimmed = line.trim();
+                    if (!trimmed)
+                        continue;
+                    try {
+                        const parsed = JSON.parse(trimmed);
+                        if (isRecord(parsed) && parsed.identity === identity) {
+                            // Existing record found (or substate a recovered record) -> return existing pointer
+                            return {
+                                identity,
+                                recordFile,
+                                kind: record.kind,
+                                level: record.level,
+                            };
+                        }
+                    }
+                    catch {
+                        // Malformed lines (including substate b preserved bad lines) are ignored during self-check
+                    }
+                }
+            }
+        }
+        // Not found -> append new canonical row terminating with newline
+        const row = `${JSON.stringify(record)}\n`;
+        appendFileSync(recordFile, row, "utf8");
+        return {
+            identity,
+            recordFile,
+            kind: record.kind,
+            level: record.level,
+        };
+    }
+    catch (error) {
+        if (error instanceof SitianInfrastructureError)
+            throw error;
+        throw new SitianInfrastructureError(`Sitian appender persistence failure: ${errorText(error)}`, { cause: error });
+    }
+}

package/dist/sitian-contracts.js

@@ -0,0 +1,21 @@
+/**
+ * Sitian (司天台) canonical contracts, Layout schema, and pointer definitions.
+ * ADR 0065 single record entry + ADR 0068 Taishi analysis.
+ */
+/** Lift direct-cause fs errno onto a wrap error (no chain walk). */
+export function attachDirectErrnoCode(error, cause) {
+    if (cause === null || typeof cause !== "object" || !("code" in cause))
+        return;
+    const code = cause.code;
+    if (typeof code === "string")
+        error.code = code;
+}
+/** Typed infrastructure error for real ledger persistence / IO failures. */
+export class SitianInfrastructureError extends Error {
+    knownCause = "session";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "SitianInfrastructureError";
+        attachDirectErrnoCode(this, options?.cause);
+    }
+}

package/dist/sitian-facade.js

@@ -0,0 +1,15 @@
+/**
+ * Sitian Facade (司天门面) — Sole entrypoint for record reporting across all producers.
+ * ADR 0065 single record entry, #520 r8.
+ */
+import { appendSitianRecord } from "./sitian-appender.js";
+export * from "./sitian-contracts.js";
+export * from "./sitian-appender.js";
+export * from "./sitian-reader.js";
+/**
+ * Sole write API for Sitian canonical records.
+ * Returns typed RecordPointer with durable record identity and readable file location.
+ */
+export function sitianReport(input) {
+    return appendSitianRecord(input);
+}

package/dist/sitian-reader.js

@@ -0,0 +1,52 @@
+/**
+ * Sitian Reader kernel (ADR 0068 / #520 r8).
+ * Sole authoritative read path for canonical Sitian records.
+ * Traversal contract:
+ * - Malformed lines are exposed as typed malformed diagnostics and traversal continues.
+ * - Zero whitewashing, zero deduplication.
+ * - Canonical rows after malformed lines are always reachable.
+ */
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Read a Sitian record volume with full traversal and non-destructive diagnostics. */
+export async function readSitianRecords(recordFile) {
+    if (!existsSync(recordFile)) {
+        return { records: [], diagnostics: [] };
+    }
+    const text = await readFile(recordFile, "utf8");
+    const lines = text.split("\n");
+    const records = [];
+    const diagnostics = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index];
+        if (!line.trim())
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (isRecord(parsed)) {
+                records.push(parsed);
+            }
+            else {
+                const typeDesc = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
+                diagnostics.push({
+                    kind: "malformed",
+                    line: index + 1,
+                    raw: line,
+                    error: `expected JSON object, got ${typeDesc}`,
+                });
+            }
+        }
+        catch (error) {
+            diagnostics.push({
+                kind: "malformed",
+                line: index + 1,
+                raw: line,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return { records, diagnostics };
+}

package/extensions/role-runtime.ts

@@ -4,6 +4,7 @@ import { resolve } from "node:path";
 
 import { loadDoctorCase } from "../src/doctor-evidence.ts";
 import { loadNotarySourceRunLocator } from "../src/notary-source-run.ts";
+import { createPiRoleHostAdapter, toPiContext } from "../src/pi/adapter.ts";
 import { loadAdmittedJudgeRequest } from "../src/public-cli/invocation.ts";
 
 import {
@@ -243,6 +244,7 @@ export async function loadNavigatorWorkContext(
 
 export default function roleRuntime(pi: ExtensionAPI): void {
   const reviewerAgent = createReviewerAgentRunner({ packageRoot });
+  const piHostAdapter = createPiRoleHostAdapter(pi, { transcriptFromContext });
   registerNavigatorModelCommand(pi);
   const navigatorSessionFactory = createNativeNavigatorSessionFactory();
   // #351: static provider list from extension setting (default ["kimi-coding"]).
@@ -263,13 +265,13 @@ export default function roleRuntime(pi: ExtensionAPI): void {
     collectorPackageExtensionPath: extensionPath,
     loadDoctorSoul: () => loadMainRoleSessionMaterials("doctor"),
     loadDoctorCase,
-    auditDoctorCompliance: createPiDoctorAuditor(),
+    auditDoctorCompliance: (options) => createPiDoctorAuditor()({ ...options, context: toPiContext(options.context) }),
     loadNotarySoul: () => loadMainRoleSessionMaterials("notary"),
     loadNotarySourceRun: loadNotarySourceRunLocator,
-    loadNavigatorWorkContext: (options) => loadNavigatorWorkContext(pi, options),
+    loadNavigatorWorkContext: (options) => loadNavigatorWorkContext(pi, { ...options, context: toPiContext(options.context) }),
     createNavigatorAttendance: (options) => {
       return createNavigatorAttendance({
-        context: options.context,
+        context: toPiContext(options.context),
         role: options.role,
         phase: options.phase,
         subjectKey: options.subjectKey,
@@ -301,9 +303,9 @@ export default function roleRuntime(pi: ExtensionAPI): void {
       }
       return loadHomeCanonicalSkillBinding(name);
     },
-    runReviewerDispatch: (dispatch, options) => reviewerAgent.run(dispatch, options),
+    runReviewerDispatch: (dispatch, options) => reviewerAgent.run(dispatch, { ...options, context: toPiContext(options.context) }),
     shutdownReviewerAgent: () => reviewerAgent.shutdown(),
-    transcriptFromContext,
-    auditSoulCompliance: createPiJudgeAuditor(),
-  })(pi);
+    transcriptFromContext: (context) => context.transcript?.() ?? "",
+    auditSoulCompliance: (options) => createPiJudgeAuditor()({ ...options, context: toPiContext(options.context) }),
+  }, piHostAdapter)(pi);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.2521",
+  "version": "0.1.2653-next.71811ca",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",
@@ -42,11 +42,11 @@
   "scripts": {
     "build": "tsx scripts/generate-tool-execution-observation-schema.ts && tsc -p tsconfig.build.json && node scripts/build-package.mjs",
     "prepack": "npm run build",
-    "test": "node --import tsx --import ./scripts/test-process-env-preload.mjs --test test/unit/**/*.test.ts test/contract/**/*.test.ts",
-    "test:fast": "node --import tsx --import ./scripts/test-process-env-preload.mjs --test test/unit/**/*.test.ts test/contract/**/*.test.ts",
-    "test:integration": "node --import tsx --import ./scripts/test-process-env-preload.mjs --test test/unit/**/*.test.ts test/contract/**/*.test.ts test/integration/**/*.test.ts",
+    "test": "node --import tsx --test test/unit/**/*.test.ts test/contract/**/*.test.ts",
+    "test:fast": "node --import tsx --test test/unit/**/*.test.ts test/contract/**/*.test.ts",
+    "test:integration": "node --import tsx --test test/unit/**/*.test.ts test/contract/**/*.test.ts test/integration/**/*.test.ts",
     "test:all": "node scripts/run-test-all.mjs",
-    "test:adjudication": "node --import tsx --import ./scripts/test-process-env-preload.mjs --test test/adjudication/**/*.test.ts",
+    "test:adjudication": "node --import tsx --test test/adjudication/**/*.test.ts",
     "typecheck": "tsc --noEmit"
   },
   "pi": {

package/resources/engines/cursor.md

@@ -7,40 +7,26 @@ Before invoking the engine, read `../engine-dispatch.md`, resolving that path
 relative to this note. This note only covers this engine's CLI technical
 parameters.
 
-## Entrypoint (verified 2026-08-28)
+## Invocation examples (local Cursor Agent CLI)
 
-The machine entrypoint is **`cursor-agent`**. Do NOT use the bare `agent`
-name on this host: PATH resolves `agent` to the Grok CLI (`~/.grok/bin/agent`
-→ grok 1.0.5, a different product billed to grok.com Build) — its flags
-differ and it fails labor invocations (`--force` unknown; billing 402 when
-the Grok Build balance is exhausted).
-
-## Invocation (local Cursor Agent CLI)
-
-Run from the role project root. Non-interactive print mode; `-f/--force`
-allows command execution headlessly; `-p` prints responses for scripts:
+The machine entrypoint is `agent` (also exposed as `cursor-agent`). Run from the
+role project root. Non-interactive print mode:
 
 ```bash
-cursor-agent -p -f --output-format text --model <MODEL_ID> "YOUR_LABOR_PROMPT"
+agent -p --force --output-format text "YOUR_LABOR_PROMPT"
 ```
 
-- Model ids come from `cursor-agent models`. Effort tiers are encoded in the
-  id itself (e.g. `cursor-grok-4.6-low`, `cursor-grok-4.6-medium`,
-  `cursor-grok-4.6-high`, plus `-fast` variants); some models also accept a
-  bracket override form (`'claude-opus-4-8[context=1m,effort=high]'` — see
-  `cursor-agent --help`).
-- Owner pool directive 2026-08-28: default labor model = `cursor-grok-4.6-low`.
-- Stream JSON events for long labor: `--output-format stream-json`.
+Choose a model explicitly when the seat needs a known Cursor model id:
 
-Prefer `cursor-agent --help` on the host over any remembered flag set. Do not
-wrap this engine behind `ak-role` flags.
+```bash
+agent -p --force --model grok-4.5 --output-format text "YOUR_LABOR_PROMPT"
+```
 
-## Smoke test (run before first labor leg of a session)
+Stream JSON events for long labor:
 
 ```bash
-cursor-agent -p -f --output-format text --model cursor-grok-4.6-low "Reply with exactly one word: OK"
+agent -p --force --output-format stream-json "YOUR_LABOR_PROMPT"
 ```
 
-Expected: stdout ends with exactly `OK`, exit code 0. Verified 2026-08-28 on
-this host (Cursor subscription login). If it asks about directory trust, the
-`-f` flag (or `--trust`) is missing.
+Prefer `agent --help` on the host over any remembered flag set. Do not wrap this
+engine behind `ak-role` flags.

package/resources/engines/hermes.md

@@ -33,16 +33,8 @@ hermes -z "YOUR_LABOR_PROMPT" --in /path/to/project --no-restore-cwd \
 - `--usage-file PATH` (works with `-z` only) writes a JSON spend report
   (`estimated_cost_usd`, token counts, model, provider, `completed`/`failed`)
   **even when the run fails** — attach it to the leg's receipt for accounting.
-- Long prompts in scripting mode: write the prompt to a file, then pass it as
-  the single `-z` argument — `hermes -z "$(cat PATH)" ...`. The substitution
-  result is one argv entry; file content is not re-parsed by the shell.
-  Smoke-verified 2026-08-28: clean final-response-only stdout.
-- `--query-file PATH` belongs to the `hermes chat` subcommand only (mutually
-  exclusive with its `-q`); it is NOT a top-level flag and does NOT combine
-  with `-z` — `hermes -z --query-file ...` fails with
-  `-z/--oneshot: expected one argument` (incident: Ming #1585 fixer leg,
-  2026-08-28). `hermes chat --query-file` also prints a session summary
-  instead of the bare final response, so it is unfit for labor pipelines.
+- Long or untrusted prompts: `--query-file PATH` reads the prompt from a file
+  verbatim ("nothing is shell-interpreted"); mutually exclusive with `-q`.
 - Model/provider default comes from host `~/.hermes/config.yaml`
   (owner-selected; verified 2026-08-28: `poolside/laguna-s-2.1:free` on Nous
   Portal). Override with `-m provider/model` + `--provider` only when the
@@ -58,23 +50,10 @@ hermes -z "YOUR_LABOR_PROMPT" --in /path/to/project --no-restore-cwd \
   intermediate steps on stdout (unlike `-z`) — use when a labor run needs its
   steps inspected.
 
-## Measured constraints (host, 2026-08-28)
-
-- The Nous free tier (`poolside/laguna-s-2.1:free`) rate-limits concurrent
-  labor calls on one account. Measured: with ~5 factory legs dispatching
-  simultaneously, losing legs saw sustained HTTP 429 across 9-29 detour
-  attempts while the 1-2 winners completed normally (Ming_LLM books runs
-  01a046ec-*/01a046f4-*, 14:55-15:04 window).
-  No concurrency ceiling has been measured beyond this observation; policy on
-  concurrency and retries is the dispatcher's call, not this note's.
-
 ## Smoke test (run before first labor leg of a session)
 
 ```bash
 hermes -z "Reply with exactly one word: OK" --no-restore-cwd
-# long-prompt form used by labor legs:
-printf 'Reply with exactly one word: OK' > /tmp/smoke.txt
-hermes -z "$(cat /tmp/smoke.txt)" --no-restore-cwd
 ```
 
 Expected: stdout is exactly `OK`, exit code 0. Verified 2026-08-28 on this

package/resources/engines/opus.md

@@ -18,12 +18,7 @@ requires `--verbose` — without it the CLI exits immediately with
 Include `--verbose` in stream-json argv. Measured with separate fd redirects
 (`1>` / `2>`): NDJSON event rows land on stdout (including intermediate
 `system` / `assistant` activity and a final `type:"result"` row); stderr is
-empty on the success path — except when stdin is an open stream supplying no
-data (e.g. a shell test without redirection): then a benign
-`Warning: no stdin data received in 3s, proceeding without it` lands on stderr
-after a 3-second wait (host-verified 2026-08-28); redirect `< /dev/null` in
-shell tests. The packaged detour tool spawns engines with stdin ignored
-(`/dev/null`), which avoids this path:
+empty on the success path:
 
 ```bash
 claude -p --verbose --output-format=stream-json "YOUR_LABOR_PROMPT"
@@ -41,15 +36,5 @@ Use `--output-format=stream-json` (choices measured on this host: `text`, `json`
 works; take the labor body from the final `result` event's `result` field,
 not from intermediate stream rows.
 
-## Headless permissions
-
-`--dangerously-skip-permissions` is required in headless labor: the CLI's
-permission prompts cannot be answered without a TTY and are auto-denied. In
-particular, reading any path outside the project root — such as frozen
-attachments under `~/.ak-roles/books/<book>/runs/<run>/attachments/` — is
-refused without the flag ("The read was not permitted — I don't have access to
-that file outside the current worktree") and succeeds with it (host-verified
-2026-08-28, both directions).
-
 Prefer `claude --help` on the host over any remembered flag set. Do not wrap this
 engine behind `ak-role` flags.

package/resources/navigator-route-playbook.md

@@ -9,8 +9,8 @@
 御史台
   ↓
 大理寺
-  ├─ 有问题（通常） → 修内司 → 大理寺（修内司收卷不经御史台，直回大理寺）
-  ├─ 需要再审（大理寺点名） → 御史台 → 大理寺
+  ├─ 有问题（通常） → 修内司 → 大理寺
+  ├─ 需要再审       → 御史台 → 大理寺
   └─ 收敛           → 调用者合并、关票
 
 ## 线上审查材料

package/scripts/build-package.mjs

@@ -13,7 +13,6 @@ const entries = [
   "activation-ledger-git",
   "activation-ledger-topology",
   "activation-reconciliation",
-  "archivist-role-run-coordinates",
   "archivist-record-entry",
   "typed-provider-http",
   "upstream-error-testimony",

package/souls/quality-law.md

@@ -26,7 +26,7 @@
 
 名实必须相符：占着小型名义、消耗大型资源的测试，按错位缺陷处理。重型名单单列、串行调度，入列逐个有理由。
 
-日常施工只跑触及面的聚焦测试；全量到绿只在家族或批次的**最终待合并状态**跑一次——**家族车道上的逐腿交卷不是收尾，不得据此索取全量**；之后再有修复，在新的最终状态重跑全量。
+日常施工只跑触及面的聚焦测试；家族或批次收尾，在最终待合并状态跑一次全量到绿；之后再有修复，重跑全量。
 
 ## 未完成交卷
 

package/src/activation-ledger-topology.ts

@@ -28,7 +28,7 @@ export class ActivationLedgerError extends Error {
  * homes would split the family and can write into a consumer repository.
  * Process home must already be absolute; relative HOME is rejected before any write.
  */
-export function resolveActivationLedgerHome(home: () => string = homedir): string {
+export function resolveActivationLedgerHome(home: () => string = () => process.env.HOME ?? homedir()): string {
   const processHome = home();
   if (typeof processHome !== "string" || processHome.length === 0 || !isAbsolute(processHome)) {
     throw new ActivationLedgerError(