@akagilnc/pi-workflow-roles 0.1.2521 → 0.1.2653-next.71811ca

package/src/archivist-record-entry.ts

@@ -4,15 +4,11 @@
  * 「谁调了谁」复用 Pi parentSession + ADR 0047 correlation，不新增 caller 字段。
  */
 import { createHash } from "node:crypto";
-import { existsSync, realpathSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, resolve, join, relative, sep } from "node:path";
+import { existsSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { dirname, resolve, join } from "node:path";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
 
 import { resolveBookKeyFromGit } from "./activation-ledger-git.ts";
-export {
-  roleRunSessionCoordinates,
-  type RoleRunSessionCoordinates,
-} from "./archivist-role-run-coordinates.ts";
 import {
   ActivationLedgerError,
   activationBookDirectory,
@@ -23,12 +19,42 @@ import {
   resolveActivationLedgerHome,
 } from "./activation-ledger-topology.ts";
 
-// continueRecent always allocates a deferred sessionFile; this is the discovery result.
-const { findMostRecentSession } = await import(
-  new URL("./core/session-manager.js", import.meta.resolve("@earendil-works/pi-coding-agent")).href,
-) as {
-  findMostRecentSession: (sessionDir: string, cwd?: string) => string | null;
-};
+const CURRENT_SESSION_LEDGER = "current-session.json";
+
+type CurrentSessionRecord = { readonly sessionFile: string };
+
+function readCurrentSession(sessionDir: string): string {
+  const ledger = join(sessionDir, CURRENT_SESSION_LEDGER);
+  try {
+    const value: unknown = JSON.parse(readFileSync(ledger, "utf8"));
+    if (
+      typeof value !== "object"
+      || value === null
+      || typeof (value as CurrentSessionRecord).sessionFile !== "string"
+      || (value as CurrentSessionRecord).sessionFile.length === 0
+    ) {
+      throw new Error("sessionFile is missing");
+    }
+    return (value as CurrentSessionRecord).sessionFile;
+  } catch (error) {
+    throw new ActivationLedgerError(
+      `archivist current-session ledger is unavailable or invalid (${ledger}): ${errorText(error)}`,
+      { cause: error },
+    );
+  }
+}
+
+function writeCurrentSession(sessionDir: string, sessionFile: string): void {
+  const ledger = join(sessionDir, CURRENT_SESSION_LEDGER);
+  try {
+    writeFileSync(ledger, `${JSON.stringify({ sessionFile })}\n`, { flag: "wx" });
+  } catch (error) {
+    throw new ActivationLedgerError(
+      `archivist current-session ledger cannot be created (${ledger}): ${errorText(error)}`,
+      { cause: error },
+    );
+  }
+}
 
 /** Parent session surface needed to link and (when already under home) nest the record. */
 export type RecordSessionParent = {
@@ -53,44 +79,28 @@ export const WORKER_SUBMISSION_GATE_KIND = "worker-submission-gate";
  * Sole file-level placement lock for a resumed same-nest principal (ADR 0065 / #221).
  * ensureRealDirectoryTree already owns the sessionDir chain; a final .jsonl symlink is
  * invisible to that directory walk, so this runs once before SessionManager.open.
- * Circle is the book physical root that owns sessionDir — not merely ledger home — so a
- * books/A nest cannot resume a final file whose realpath lands in books/B.
+ * Circle is the authorized nest (sessionDir) itself — lexical path and realpath must both
+ * stay inside it. Same-book cross-nest pointers and cross-book symlinks are refused alike.
  * realpath/stat failures stay typed ActivationLedgerError with original cause — never
  * wash through physicalPathIdentity's non-ENOENT lexical fallback.
  */
-function assertRecentFinalFileUnderLedgerHome(
-  ledgerHome: string,
+function assertRecentFinalFileUnderSessionDir(
   sessionDir: string,
   recentFile: string,
 ): void {
-  const absoluteHome = resolve(ledgerHome);
   const absoluteSessionDir = resolve(sessionDir);
   const absoluteFile = resolve(recentFile);
-  // sessionDir just passed ensureRealDirectoryTree: derive the owning book lexically.
-  const relToHome = relative(absoluteHome, absoluteSessionDir);
-  const segments = relToHome.split(sep);
-  if (
-    relToHome === ""
-    || isAbsolute(relToHome)
-    || relToHome === ".."
-    || relToHome.startsWith(`..${sep}`)
-    || segments[0] !== "books"
-    || segments[1] === undefined
-    || segments[1] === ""
-    || segments[1] === "."
-    || segments[1] === ".."
-  ) {
+  if (absoluteFile !== absoluteSessionDir && !pathContainedIn(absoluteSessionDir, absoluteFile)) {
     throw new ActivationLedgerError(
-      `archivist record sessionDir must be under a ledger book (${ledgerHome}): ${sessionDir}`,
+      `archivist record session must be under the authorized nest (${sessionDir}): ${recentFile}`,
     );
   }
-  const bookRoot = join(absoluteHome, "books", segments[1]);
-  let realBookRoot: string;
+  let realSessionDir: string;
   try {
-    realBookRoot = realpathSync(bookRoot);
+    realSessionDir = realpathSync(absoluteSessionDir);
   } catch (error) {
     throw new ActivationLedgerError(
-      `activation ledger book is not resolvable (${bookRoot}): ${errorText(error)}`,
+      `archivist record sessionDir is not resolvable (${absoluteSessionDir}): ${errorText(error)}`,
       { cause: error },
     );
   }
@@ -103,9 +113,9 @@ function assertRecentFinalFileUnderLedgerHome(
       { cause: error },
     );
   }
-  if (realFile !== realBookRoot && !pathContainedIn(realBookRoot, realFile)) {
+  if (realFile !== realSessionDir && !pathContainedIn(realSessionDir, realFile)) {
     throw new ActivationLedgerError(
-      `archivist record session must be under the ledger book (${bookRoot}): ${recentFile}`,
+      `archivist record session must be under the authorized nest (${sessionDir}): ${recentFile}`,
     );
   }
 }
@@ -117,7 +127,7 @@ function assertRecentFinalFileUnderLedgerHome(
  * identity is checked once before SessionManager.open (directory walk cannot see a
  * trailing .jsonl symlink). New principals mint under the already-validated sessionDir
  * via destination-free SessionManager.create — no derived postcondition.
- * Resume via Pi findMostRecentSession is limited to subject-keyed identity and the
+ * Resume via the AK-owned current-session ledger is limited to subject-keyed identity and the
  * authorized worker-submission-gate durable path. Ordinary no-subject children
  * (evidence-children, auditor-roles, …) always mint a fresh session — never reopen
  * a sibling volume selected only by kind/cwd/mtime.
@@ -156,18 +166,17 @@ export function createRecordSession(options: CreateRecordSessionOptions): Sessio
     parentSession = parentFile;
   }
 
+  const nestAlreadyExists = existsSync(sessionDir);
   // Directory-chain ownership: containment + physical components (no parallel assert).
   ensureRealDirectoryTree(ledgerHome, sessionDir);
   // Subject-keyed nests continue by subject digest; gate durable resume is the only
   // authorized no-subject same-nest continuation. All other kinds mint fresh.
   const mayResumeSameNest =
     options.subject !== undefined || options.kind === WORKER_SUBMISSION_GATE_KIND;
-  if (mayResumeSameNest) {
-    const recentFile = findMostRecentSession(sessionDir, cwd);
-    if (recentFile !== null) {
-      assertRecentFinalFileUnderLedgerHome(ledgerHome, sessionDir, recentFile);
-      return SessionManager.open(recentFile, sessionDir, cwd);
-    }
+  if (mayResumeSameNest && nestAlreadyExists) {
+    const recentFile = readCurrentSession(sessionDir);
+    assertRecentFinalFileUnderSessionDir(sessionDir, recentFile);
+    return SessionManager.open(recentFile, sessionDir, cwd);
   }
 
   const session = SessionManager.create(
@@ -188,6 +197,9 @@ export function createRecordSession(options: CreateRecordSessionOptions): Sessio
         session.setSessionFile(file);
       }
     }
+    if (mayResumeSameNest && file !== undefined) {
+      writeCurrentSession(sessionDir, file);
+    }
   }
   return session;
 }

package/src/auditor-dossier-tool.ts

@@ -1,6 +1,7 @@
 import { dirname, join, resolve } from "node:path";
 
 import type { AgentToolResult, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { HostContext } from "./host-contracts.ts";
 import { Type } from "typebox";
 
 export const AUDITOR_DOSSIER_TOOL_NAME = "ak_get_run_dossier" as const;
@@ -14,9 +15,10 @@ export type AuditorDossierLocation = {
 };
 
 /** Resolve the exact run binding already carried by the parent record session. */
-export function auditorRunDirectory(context: ExtensionContext): string | undefined {
+export function auditorRunDirectory(context: ExtensionContext | HostContext): string | undefined {
   const sessionFile = context.sessionManager?.getSessionFile?.();
-  return sessionFile === undefined ? undefined : resolve(dirname(dirname(sessionFile)));
+  if (sessionFile !== undefined) return resolve(dirname(dirname(sessionFile)));
+  return undefined;
 }
 
 /** The one shared, run-bound dossier locator exposed to every auditor seat. */

package/src/canonical-skill-binding.ts

@@ -2,7 +2,8 @@ import { readFile, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
 
-import { parseSkillBlock, stripFrontmatter } from "@earendil-works/pi-coding-agent";
+import { stripFrontmatter } from "@earendil-works/pi-coding-agent";
+import type { HostSkillExpansionEvidence } from "./host-contracts.ts";
 export type CanonicalSkillName = "tdd" | "code-review";
 
 export type CanonicalSkillSnapshot = Readonly<{
@@ -26,7 +27,7 @@ export type CanonicalSkillBinding<Name extends CanonicalSkillName = CanonicalSki
   snapshot: CanonicalSkillSnapshot;
   invocation(originalRequest: string): string;
   captureExpansion(
-    prompt: string,
+    evidence: HostSkillExpansionEvidence | undefined,
     originalRequest: string,
   ): CanonicalSkillEvidence<Name> | undefined;
 }>;
@@ -35,6 +36,33 @@ export type AnyCanonicalSkillBinding =
   | CanonicalSkillBinding<"tdd">
   | CanonicalSkillBinding<"code-review">;
 
+export function captureCanonicalSkillExpansion<Name extends CanonicalSkillName>(
+  name: Name,
+  snapshot: CanonicalSkillSnapshot,
+  configuredPath: string,
+  evidence: HostSkillExpansionEvidence | undefined,
+  originalRequest: string,
+): CanonicalSkillEvidence<Name> | undefined {
+  const matchedPath =
+    evidence?.location === configuredPath
+      ? configuredPath
+      : evidence?.location === snapshot.path
+        ? snapshot.path
+        : undefined;
+  const expectedContent = matchedPath === undefined
+    ? undefined
+    : `References are relative to ${dirname(matchedPath)}.\n\n${snapshot.body}`;
+  if (
+    evidence?.name !== name
+    || matchedPath === undefined
+    || evidence.content !== expectedContent
+    || evidence.userMessage !== originalRequest
+  ) {
+    return undefined;
+  }
+  return Object.freeze({ ...evidence, name });
+}
+
 export class CanonicalSkillUnavailableError extends Error {
   readonly code = "canonical-skill-unavailable" as const;
   constructor(readonly skillName: CanonicalSkillName, path: string, cause: unknown) {
@@ -75,32 +103,14 @@ export async function loadCanonicalSkillBinding(
     invocation(originalRequest) {
       return `/skill:${name} ${originalRequest}`;
     },
-    captureExpansion(prompt, originalRequest) {
-      const parsed = parseSkillBlock(prompt);
-      const matchedPath =
-        parsed?.location === configuredPath
-          ? configuredPath
-          : parsed?.location === snapshot.path
-            ? snapshot.path
-            : undefined;
-      const expectedContent = matchedPath === undefined
-        ? undefined
-        : `References are relative to ${dirname(matchedPath)}.\n\n${snapshot.body}`;
-      const userMessage = parsed?.userMessage ?? "";
-      if (
-        parsed?.name !== name ||
-        matchedPath === undefined ||
-        parsed.content !== expectedContent ||
-        userMessage !== originalRequest
-      ) {
-        return undefined;
-      }
-      return Object.freeze({
+    captureExpansion(evidence, originalRequest) {
+      return captureCanonicalSkillExpansion(
         name,
-        location: parsed.location,
-        content: parsed.content,
-        userMessage,
-      });
+        snapshot,
+        configuredPath,
+        evidence,
+        originalRequest,
+      );
     },
   };
   return Object.freeze(binding) as AnyCanonicalSkillBinding;

package/src/collector-role.ts

@@ -1,7 +1,4 @@
-import type {
-  ExtensionAPI,
-  ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
+import type { RoleHost, HostContext, HostToolResult } from "./host-contracts.ts";
 import type { Static } from "typebox";
 
 import {
@@ -30,9 +27,6 @@ import {
   buildCollectorReceipt,
   type CollectorReceipt,
 } from "./collector-receipt.ts";
-import {
-  failOnInfrastructureFailureDeclaration,
-} from "./package-contracts/terminating-infrastructure.ts";
 import {
   collectorObserveArgsSchema,
   collectorOutputArgsSchema,
@@ -73,7 +67,7 @@ export type CollectorRoleDependencies = {
 };
 
 export type CollectorRoleHostActions = {
-  failInfrastructure(error: unknown, ctx: ExtensionContext, toolCallId?: string): never;
+  failInfrastructure(error: unknown, ctx: HostContext, toolCallId?: string): never;
 };
 
 type CollectorActivation = {
@@ -89,13 +83,13 @@ type CollectorActivation = {
 /** Sole-final at the output execution seam (same shape as other terminating roles). */
 function assertSoleFinalCollectorOutput(
   toolCallId: string,
-  ctx: ExtensionContext,
+  ctx: HostContext,
 ): void {
   const leaf = ctx.sessionManager.getLeafEntry();
-  if (leaf?.type !== "message" || leaf.message.role !== "assistant") {
+  if (leaf?.type !== "message" || leaf.message === undefined || leaf.message.role !== "assistant" || !Array.isArray(leaf.message.content)) {
     throw new Error("通进司回执非唯一终局工具调用");
   }
-  const calls = leaf.message.content.filter((part) => part.type === "toolCall");
+  const calls = leaf.message.content.filter((part): part is Extract<typeof part, { type: "toolCall" }> => part.type === "toolCall");
   const call = calls[0];
   if (
     calls.length !== 1 ||
@@ -119,12 +113,12 @@ function buildMethodContext(activation: CollectorActivation): string {
 }
 
 export function createCollectorRoleRuntime(
-  pi: ExtensionAPI,
+  pi: RoleHost,
   dependencies: CollectorRoleDependencies,
   hostActions: CollectorRoleHostActions,
 ): {
   activate(
-    ctx: ExtensionContext,
+    ctx: HostContext,
     event: { reason: string },
   ): Promise<void>;
 } {
@@ -288,7 +282,7 @@ export function createCollectorRoleRuntime(
       description: "抓取配置目标的完整 GitHub PR 证据，存不可变快照入卷。",
       promptSnippet: "抓取配置目标 PR 证据",
       parameters: observeSchema,
-      async execute(toolCallId, _params, signal, _onUpdate, ctx) {
+      async execute(toolCallId: string, _params: unknown, signal: AbortSignal | undefined, _onUpdate: unknown, ctx: HostContext) {
         if (activation === undefined) {
           throw new Error("通进司未激活");
         }
@@ -323,7 +317,7 @@ export function createCollectorRoleRuntime(
       description: "按配置请求体与关联标记，在所引最新快照 HEAD 发一次请求。",
       promptSnippet: "按配置发一次请求",
       parameters: requestSchema,
-      async execute(toolCallId, params: RequestParams, signal, _onUpdate, ctx) {
+      async execute(toolCallId: string, params: RequestParams, signal: AbortSignal | undefined, _onUpdate: unknown, ctx: HostContext) {
         if (activation === undefined) {
           throw new Error("通进司未激活");
         }
@@ -355,7 +349,7 @@ export function createCollectorRoleRuntime(
       description: "再观察前等待；单次上限五分钟且不超剩余资格。",
       promptSnippet: "资格截止前等待",
       parameters: waitSchema,
-      async execute(toolCallId, params: WaitParams, signal, _onUpdate, ctx) {
+      async execute(toolCallId: string, params: WaitParams, signal: AbortSignal | undefined, _onUpdate: unknown, ctx: HostContext) {
         if (activation === undefined) {
           throw new Error("通进司未激活");
         }
@@ -386,14 +380,11 @@ export function createCollectorRoleRuntime(
       description: "观察完成后提交；回执由 runtime 组装。",
       promptSnippet: "提交通进司回执",
       parameters: outputSchema,
-      async execute(toolCallId, params: OutputParams, _signal, _onUpdate, ctx) {
+      async execute(toolCallId: string, params: OutputParams, _signal: AbortSignal | undefined, _onUpdate: unknown, ctx: HostContext) {
         if (activation === undefined) {
           throw new Error("通进司未激活");
         }
         try {
-          // #541: infra declaration fails via the shared host seam before the
-          // operational ledger begins / a receipt is built.
-          failOnInfrastructureFailureDeclaration(params, hostActions, ctx, toolCallId);
           assertSoleFinalCollectorOutput(toolCallId, ctx);
           activation.ledger.beginOperational(COLLECTOR_OUTPUT_TOOL, toolCallId);
           const receipt: CollectorReceipt = buildCollectorReceipt(

package/src/collector-tool-schemas.ts

@@ -1,6 +1,5 @@
 import { Type, type Static } from "typebox";
 import { COLLECTOR_ELIGIBILITY_MS } from "./collector-evidence.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
 
 export const collectorObserveArgsSchema = Type.Object({}, { additionalProperties: false });
 export const collectorRequestArgsSchema = Type.Object({
@@ -11,9 +10,7 @@ export const collectorWaitArgsSchema = Type.Object({
   durationMs: Type.Integer({ minimum: 1, maximum: COLLECTOR_ELIGIBILITY_MS, description: "等待毫秒；单次上限五分钟且不超剩余资格" }),
 }, { additionalProperties: false });
 /** Runtime owns the observed groups; the model only signals sole-final submission. */
-export const collectorOutputArgsSchema = withInfrastructureFailureDeclaration(
-  Type.Object({}, { additionalProperties: true }),
-);
+export const collectorOutputArgsSchema = Type.Object({}, { additionalProperties: true });
 (collectorOutputArgsSchema as unknown as { required: string[] }).required = [];
 
 export type CollectorObserveArgs = Static<typeof collectorObserveArgsSchema>;

package/src/compliance-transport.ts

@@ -1,15 +1,13 @@
-import type { Api, AssistantMessage, Model, Usage } from "@earendil-works/pi-ai";
+import type { AssistantMessage, Usage } from "@earendil-works/pi-ai";
 import type { AgentToolResult, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import {
   executeAuditorChild,
-  type AuditorCompletion,
 } from "./evidence-child-executor.ts";
 import { createAuditorDossierTool } from "./auditor-dossier-tool.ts";
 import type { DossierObservation } from "./dossier-resolution.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 
-export type ComplianceCompletion = AuditorCompletion;
 export type ComplianceArgumentRootType = "null" | "array" | "undefined" | "string" | "number" | "boolean" | "bigint" | "symbol" | "function";
 export type ComplianceAuditObservation =
   | { kind: "non-object-arguments"; type: ComplianceArgumentRootType }
@@ -39,8 +37,6 @@ export class ComplianceCandidateUnreadableError extends Error {
     if (usage !== undefined) this.usage = usage;
   }
 }
-export type ComplianceDispatch = { model: Model<Api>; auth: { apiKey?: string; headers?: Record<string, string | null>; env?: Record<string, string> } };
-
 /** Zero-projection kickoff — soul already carries dossier-fetch duty; no hand-delivered materials. */
 export const AUDITOR_DOSSIER_PROMPT = "本 run 卷宗已就绪。" as const;
 
@@ -55,15 +51,6 @@ export function createComplianceDecisionTool(name: string, description: string)
   return { name, description, parameters: complianceDecisionSchema, async execute(_id: string, params: unknown): Promise<AgentToolResult<unknown>> { return { content: [{ type: "text", text: "审计决议已收" }], details: params, terminate: true }; } };
 }
 
-export async function prepareComplianceDispatch(model: Model<Api>, context: ExtensionContext, label: string): Promise<ComplianceDispatch> {
-  const resolution = await context.modelRegistry.getProviderAuth(model.provider).catch((error: unknown) => { throw new Error(`${label} authentication failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error }); });
-  if (resolution === undefined) throw new Error(`${label} authentication failed: provider is not configured: ${model.provider}`);
-  const auth = await context.modelRegistry.getApiKeyAndHeaders(model);
-  if (!auth.ok) throw new Error(`${label} authentication failed: ${auth.error}`);
-  const env = auth.env ?? resolution.env;
-  return { model: resolution.auth.baseUrl ? { ...model, baseUrl: resolution.auth.baseUrl } : model, auth: { ...(auth.apiKey === undefined ? {} : { apiKey: auth.apiKey }), ...(auth.headers === undefined ? {} : { headers: auth.headers }), ...(env === undefined ? {} : { env }) } };
-}
-
 export const COMPLIANCE_RESPONSE_ENTRY_TYPE = "ak_compliance_response" as const;
 export const AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE = "ak_auditor_parent_attempt_binding" as const;
 export const AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE = "ak_auditor_compliance_failure" as const;
@@ -76,43 +63,32 @@ export type AuditorParentAttemptBinding = {
     readonly attemptEntryId?: string;
   };
 };
+import { attachDirectErrnoCode, sitianReport } from "./sitian-facade.ts";
+
 export class ComplianceResponseRetentionError extends Error {
-  constructor(message: string, options?: ErrorOptions) { super(message, options); this.name = "ComplianceResponseRetentionError"; }
-}
-export type ActiveSessionResponseAppender = { appendCustomEntry(customType: string, data?: unknown): string };
-/** Unique owner for session custom-entry append with availability check and typed failure. */
-export function appendActiveSessionCustomEntry(
-  context: ExtensionContext,
-  customType: string,
-  data?: unknown,
-  labels: { unavailable?: string; failed?: string } = {},
-): string {
-  const manager = context.sessionManager as unknown as Partial<ActiveSessionResponseAppender> | undefined;
-  if (typeof manager?.appendCustomEntry !== "function") {
-    throw new ComplianceResponseRetentionError(
-      labels.unavailable ?? "session custom entry append is unavailable",
-    );
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = "ComplianceResponseRetentionError";
+    attachDirectErrnoCode(this, options?.cause);
   }
+}
+function retainComplianceResponse(context: ExtensionContext, response: AssistantMessage): void {
   try {
-    return manager.appendCustomEntry(customType, data);
+    sitianReport({
+      level: "event",
+      kind: "auditor",
+      cwd: context.cwd,
+      sessionParent: context.sessionManager.getSessionFile(),
+      payload: { version: 1, response },
+      source: "compliance-transport",
+    });
   } catch (error) {
     throw new ComplianceResponseRetentionError(
-      labels.failed ?? "session custom entry append failed",
+      `compliance response retention failed: ${error instanceof Error ? error.message : String(error)}`,
       { cause: error },
     );
   }
 }
-function retainComplianceResponse(context: ExtensionContext, response: AssistantMessage): void {
-  appendActiveSessionCustomEntry(
-    context,
-    COMPLIANCE_RESPONSE_ENTRY_TYPE,
-    { version: 1, response },
-    {
-      unavailable: "compliance response retention is unavailable",
-      failed: "compliance response retention failed",
-    },
-  );
-}
 function readListField(value: unknown): readonly unknown[] { return Array.isArray(value) ? value : value === undefined ? [] : [value]; }
 export function readComplianceCandidate(arguments_: unknown, usage?: Usage): ComplianceDecision {
   if (typeof arguments_ !== "object" || arguments_ === null || Array.isArray(arguments_)) {
@@ -140,7 +116,6 @@ export type RunComplianceAuditOptions = {
   serializedInput?: string;
   roleLabel: string;
   invalidDecisionLabel: string;
-  runCompletion?: ComplianceCompletion;
   context: ExtensionContext;
   /** Exact machine-owned run binding; never sourced from AK_ROLE_RUN_DIR. */
   runDirectory?: string | undefined;
@@ -157,7 +132,7 @@ export async function runComplianceAudit(options: RunComplianceAuditOptions): Pr
     roleLabel: options.roleLabel,
     context: options.context,
     retainResponse: (response) => retainComplianceResponse(options.context, response),
-    ...(options.runCompletion === undefined ? {} : { runCompletion: options.runCompletion }),
+    ...(options.runDirectory === undefined ? {} : { runDirectory: options.runDirectory }),
     ...(options.signal === undefined ? {} : { signal: options.signal }),
   });
   if (receipt.noReceiptLifecycle !== undefined) {

package/src/doctor-auditor.ts

@@ -5,7 +5,6 @@ import { loadAuditorSoul } from "./auditor-soul.ts";
 import {
   createComplianceDecisionTool,
   runComplianceAudit,
-  type ComplianceCompletion,
   type ComplianceDecision,
 } from "./compliance-transport.ts";
 import {
@@ -30,9 +29,7 @@ const tool = createComplianceDecisionTool(
  * Doctor auditor: zero hand-delivered materials.
  * Candidate testimony must already be on the parent-session books.
  */
-export function createPiDoctorAuditor(
-  runCompletion?: ComplianceCompletion,
-): (options: DoctorAuditOptions) => Promise<ComplianceDecision> {
+export function createPiDoctorAuditor(): (options: DoctorAuditOptions) => Promise<ComplianceDecision> {
   return async (options) => {
     const dossier = resolveAuditDossier();
     requireAuditMaterials(dossier);
@@ -47,7 +44,6 @@ export function createPiDoctorAuditor(
       context: options.context,
       ...(auditorRunDirectory(options.context) === undefined ? {} : { runDirectory: auditorRunDirectory(options.context) }),
       ...(options.signal === undefined ? {} : { signal: options.signal }),
-      ...(runCompletion === undefined ? {} : { runCompletion }),
     });
   };
 }

package/src/doctor-contracts.ts

@@ -1,7 +1,6 @@
 import { Type } from "typebox";
 import { canonicalJson } from "./canonical-json.ts";
 import { openToolObjectFromUnion } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
 
 export const DOCTOR_EVIDENCE_TOOL_NAME = "ak_doctor_evidence";
 export const DOCTOR_OUTPUT_TOOL_NAME = "ak_doctor_output";
@@ -88,9 +87,7 @@ const doctorSubmissionVariants = Type.Union([
     missingEvidence: Type.Array(Type.Object({ need: nonblank, targetKeys: Type.Array(nonblank, { minItems: 1 }) }, { additionalProperties: false }), { minItems: 1, description: "如实证词所需而尚缺的证据" }),
   }, { additionalProperties: false, description: "证据不足以支撑如实案证词" }),
 ]);
-export const doctorSubmissionSchema = withInfrastructureFailureDeclaration(
-  openToolObjectFromUnion(doctorSubmissionVariants),
-);
+export const doctorSubmissionSchema = openToolObjectFromUnion(doctorSubmissionVariants);
 export const doctorOutputSchema = Type.Union([
   Type.Object({ status: Type.Literal("completed"), case: caseIdentity, findings: Type.Array(finding), cost }, { additionalProperties: false }),
   doctorSubmissionVariants.anyOf[1]!,

package/src/doctor-role.ts

@@ -1,19 +1,42 @@
-import type { AgentToolResult, ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { RoleHost, HostContext, HostToolResult } from "./host-contracts.ts";
 import { disposeComplianceDecision } from "./audit-escalation.ts";
-import { appendActiveSessionCustomEntry, type ComplianceDecision } from "./compliance-transport.ts";
+import { ComplianceResponseRetentionError, type ComplianceDecision } from "./compliance-transport.ts";
 import { DOCTOR_CANDIDATE_ENTRY_TYPE } from "./dossier-resolution.ts";
-import { failOnInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
 import { DOCTOR_ACCEPTED_AUDIT_NO_RECEIPT_TEXT, DOCTOR_ACCEPTED_TEXT, DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_DESCRIPTION, DOCTOR_OUTPUT_TOOL_NAME, DoctorEvidenceStore, doctorEvidenceReadSchema, doctorSubmissionSchema, validateDoctorOutput, type DoctorCase } from "./doctor-contracts.ts";
 
+import { sitianReport } from "./sitian-facade.ts";
+
 export { DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_NAME };
 export const DOCTOR_CASE_FLAG = { name: "ak-doctor-case", definition: { description: "Retained .ak-roles/books/<book>/issues/<n>/runs directory", type: "string" as const } } as const;
-export type DoctorRoleDependencies = { loadSoul(): Promise<string>; loadCase(path: string): Promise<DoctorCase>; auditCompliance(options: { context: ExtensionContext; signal?: AbortSignal }): Promise<ComplianceDecision> };
-function singleton(toolCallId: string, ctx: ExtensionContext) { const leaf = ctx.sessionManager.getLeafEntry(); if (leaf?.type !== "message" || leaf.message.role !== "assistant") throw new Error("太医署回执非唯一终局工具调用"); const calls = leaf.message.content.filter((part) => part.type === "toolCall"); if (calls.length !== 1 || calls[0]?.id !== toolCallId || calls[0]?.name !== DOCTOR_OUTPUT_TOOL_NAME) throw new Error("太医署回执非唯一终局工具调用"); }
-export function createDoctorRoleRuntime(pi: ExtensionAPI, dependencies: DoctorRoleDependencies, host: { failInfrastructure(error: unknown, ctx: ExtensionContext, toolCallId?: string): never }) {
+export type DoctorRoleDependencies = { loadSoul(): Promise<string>; loadCase(path: string): Promise<DoctorCase>; auditCompliance(options: { context: HostContext; signal?: AbortSignal }): Promise<ComplianceDecision> };
+function appendCandidate(ctx: HostContext, data: unknown): void {
+  try {
+    sitianReport({
+      level: "event",
+      kind: "candidate",
+      cwd: ctx.cwd,
+      sessionParent: ctx.sessionManager.getSessionFile(),
+      payload: data,
+      source: "doctor-role",
+    });
+  } catch (error) {
+    throw new ComplianceResponseRetentionError(`太医署候选留存失败: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+  const append = ctx.sessionManager.appendCustomEntry;
+  if (typeof append === "function") {
+    try {
+      append.call(ctx.sessionManager, DOCTOR_CANDIDATE_ENTRY_TYPE, data);
+    } catch (error) {
+      throw new ComplianceResponseRetentionError(`太医署候选留存失败: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+  }
+}
+function singleton(toolCallId: string, ctx: HostContext) { const leaf = ctx.sessionManager.getLeafEntry(); if (leaf?.type !== "message" || leaf.message === undefined || leaf.message.role !== "assistant" || !Array.isArray(leaf.message.content)) throw new Error("太医署回执非唯一终局工具调用"); const calls = leaf.message.content.filter((part): part is Extract<typeof part, { type: "toolCall" }> => part.type === "toolCall"); if (calls.length !== 1 || calls[0]?.id !== toolCallId || calls[0]?.name !== DOCTOR_OUTPUT_TOOL_NAME) throw new Error("太医署回执非唯一终局工具调用"); }
+export function createDoctorRoleRuntime(pi: RoleHost, dependencies: DoctorRoleDependencies, host: { failInfrastructure(error: unknown, ctx: HostContext, toolCallId?: string): never }) {
   let activation: { soul: string; patient: DoctorCase; store: DoctorEvidenceStore } | undefined; let registered = false; pi.registerFlag(DOCTOR_CASE_FLAG.name, DOCTOR_CASE_FLAG.definition);
   return { async activate() { const path = pi.getFlag(DOCTOR_CASE_FLAG.name); if (typeof path !== "string" || !path.trim()) throw new Error("Doctor requires --ak-doctor-case"); const soul = (await dependencies.loadSoul()).trim(); if (!soul) throw new Error("Doctor soul is empty"); const patient = await dependencies.loadCase(path); activation = { soul, patient, store: new DoctorEvidenceStore(patient) };
-    if (!registered) { registered = true; pi.registerTool({ name: DOCTOR_EVIDENCE_TOOL_NAME, label: "太医署证据", description: "分页读取留存的 Pi session 字节。", parameters: doctorEvidenceReadSchema, async execute(_id, params: { evidenceId: string; offset?: number; limit?: number }) { if (!activation) throw new Error("太医署未激活"); const details = activation.store.read(params.evidenceId, params.offset, params.limit); return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details }; } });
-      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "太医署输出", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id, params, signal, _update, ctx): Promise<AgentToolResult<unknown>> { if (!activation) throw new Error("太医署未激活"); failOnInfrastructureFailureDeclaration(params, host, ctx, id); singleton(id, ctx); const testimony = validateDoctorOutput(params, activation.patient, activation.store); try { appendActiveSessionCustomEntry(ctx, DOCTOR_CANDIDATE_ENTRY_TYPE, { version: 1, testimony, readRecord: activation.store.readRecord(), patientIdentity: activation.patient.identity }, { unavailable: "太医署候选留存不可用", failed: "太医署候选留存失败" }); } catch (error) { host.failInfrastructure(error, ctx, id); } let audit: ComplianceDecision; try { audit = await dependencies.auditCompliance(signal === undefined ? { context: ctx } : { context: ctx, signal }); } catch (error) { host.failInfrastructure(error, ctx, id); } const details = testimony.status === "completed" ? { ...testimony, cost: activation.patient.cost } : testimony; const acceptedDetails = details; return disposeComplianceDecision<AgentToolResult<unknown>>(audit, { pass: (usage) => ({ content: [{ type: "text" as const, text: DOCTOR_ACCEPTED_TEXT }], details: acceptedDetails, terminate: true as const, ...(usage === undefined ? {} : { usage }) }), noReceipt: (auditNoReceipt, usageProjection) => ({ content: [{ type: "text" as const, text: DOCTOR_ACCEPTED_AUDIT_NO_RECEIPT_TEXT }], details: { ...acceptedDetails, auditNoReceipt }, terminate: true as const, ...usageProjection }), revise: (violations) => { throw new Error(`太医署回执违 soul：${violations.join("; ")}`); }, escalate: (result) => result }, acceptedDetails); } });
+    if (!registered) { registered = true; pi.registerTool({ name: DOCTOR_EVIDENCE_TOOL_NAME, label: "太医署证据", description: "分页读取留存的 Pi session 字节。", parameters: doctorEvidenceReadSchema, async execute(_id: string, params: { evidenceId: string; offset?: number; limit?: number }) { if (!activation) throw new Error("太医署未激活"); const details = activation.store.read(params.evidenceId, params.offset, params.limit); return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details }; } });
+      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "太医署输出", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id: string, params: unknown, signal: AbortSignal | undefined, _update: unknown, ctx: HostContext): Promise<HostToolResult<unknown>> { if (!activation) throw new Error("太医署未激活"); singleton(id, ctx); const testimony = validateDoctorOutput(params, activation.patient, activation.store); try { appendCandidate(ctx, { version: 1, testimony, readRecord: activation.store.readRecord(), patientIdentity: activation.patient.identity }); } catch (error) { host.failInfrastructure(error, ctx, id); } let audit: ComplianceDecision; try { audit = await dependencies.auditCompliance(signal === undefined ? { context: ctx } : { context: ctx, signal }); } catch (error) { host.failInfrastructure(error, ctx, id); } const details = testimony.status === "completed" ? { ...testimony, cost: activation.patient.cost } : testimony; const acceptedDetails = details; return disposeComplianceDecision<HostToolResult<unknown>>(audit, { pass: (usage) => ({ content: [{ type: "text" as const, text: DOCTOR_ACCEPTED_TEXT }], details: acceptedDetails, terminate: true as const, ...(usage === undefined ? {} : { usage }) }), noReceipt: (auditNoReceipt, usageProjection) => ({ content: [{ type: "text" as const, text: DOCTOR_ACCEPTED_AUDIT_NO_RECEIPT_TEXT }], details: { ...acceptedDetails, auditNoReceipt }, terminate: true as const, ...usageProjection }), revise: (violations) => { throw new Error(`太医署回执违 soul：${violations.join("; ")}`); }, escalate: (result) => result }, acceptedDetails); } });
       pi.on("before_agent_start", (event) => { if (!activation) throw new Error("太医署未激活"); const catalog = { version: activation.patient.version, identity: activation.patient.identity, admittedMetrics: { provenance: "由留存 session 字节推导，封入受理回执。", cost: activation.patient.cost }, lawfulTargetKeys: ["case", ...activation.patient.cost.invocations.sources], evidence: activation.patient.evidence.map(({ id, kind, sha256, byteLength, contentLength }) => ({ id, kind, sha256, byteLength, contentLength })) }; return { systemPrompt: `${event.systemPrompt}\n\n<doctor_soul>\n${activation.soul}\n</doctor_soul>\n\n<doctor_case>\n${JSON.stringify(catalog)}\n</doctor_case>` }; }); }
     const required = [DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_NAME]; const names = pi.getAllTools().map((tool) => tool.name); for (const name of required) if (names.filter((item) => item === name).length !== 1) throw new Error(`Doctor required tool collision or missing: ${name}`); pi.setActiveTools(required); const active = pi.getActiveTools?.() ?? required; if (active.length !== 2 || !required.every((name) => active.includes(name))) throw new Error("Doctor active tool narrowing failed"); } };
 }