@akagilnc/pi-workflow-roles 0.1.3280 → 0.1.3353

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (41) hide show
  1. package/README.md +5 -5
  2. package/README.zh-CN.md +5 -5
  3. package/dist/audit-escalation.js +31 -4
  4. package/dist/gatekeeper-role.js +25 -4
  5. package/dist/grok/production-host.js +1167 -862
  6. package/dist/inspector-contracts.js +5 -2
  7. package/dist/notary-contracts.js +16 -5
  8. package/dist/packaged-role-registry.js +0 -7
  9. package/dist/public-cli/main.js +867 -757
  10. package/package.json +1 -1
  11. package/src/audit-escalation.ts +52 -8
  12. package/src/collector-ledger.ts +309 -74
  13. package/src/collector-receipt.ts +0 -1
  14. package/src/collector-role.ts +21 -14
  15. package/src/diarist-mechanical.ts +16 -5
  16. package/src/gatekeeper-role.ts +33 -4
  17. package/src/grok/role-envelope.ts +68 -52
  18. package/src/inspector-contracts.ts +6 -3
  19. package/src/inspector-role.ts +5 -2
  20. package/src/notary-contracts.ts +20 -5
  21. package/src/notary-role.ts +2 -2
  22. package/src/packaged-role-registry.ts +0 -12
  23. package/src/public-cli/cli.ts +50 -125
  24. package/src/public-cli/coder-run.ts +5 -19
  25. package/src/public-cli/collector-run.ts +65 -21
  26. package/src/public-cli/countersign-run.ts +14 -40
  27. package/src/public-cli/doctor-run.ts +50 -6
  28. package/src/public-cli/fixer-run.ts +5 -19
  29. package/src/public-cli/gleaner-left-run.ts +14 -40
  30. package/src/public-cli/inspector-run.ts +51 -7
  31. package/src/public-cli/instruction-seat-run.ts +27 -0
  32. package/src/public-cli/judge-run.ts +11 -36
  33. package/src/public-cli/merger-run.ts +5 -19
  34. package/src/public-cli/notary-run.ts +54 -5
  35. package/src/public-cli/option-definitions.ts +3 -3
  36. package/src/public-cli/post-admission.ts +76 -0
  37. package/src/public-cli/reviewer-run.ts +5 -19
  38. package/src/public-cli/run-lifecycle.ts +342 -107
  39. package/src/public-cli/settlement.ts +134 -71
  40. package/src/role-runtime.ts +18 -1
  41. package/src/submission-ledger.ts +55 -5
@@ -1,7 +1,8 @@
1
1
  /**
2
2
  * Public Inspector Role run: admit instruction/attachments → shared post-admission
3
- * coordinator → settle Terminal result (#568 / ADR 0074). One-shot: pass/bounce, 无 resume.
4
- * Dual path with gate-province dispatch; this module is the direct command face.
3
+ * coordinator → settle Terminal result (#568 / ADR 0074). Lawful releases:
4
+ * pass/bounce/escalate. #633: manual resume continues the exact session. Dual path
5
+ * with gate-province dispatch; this module is the direct command face.
5
6
  */
6
7
  import type { DurablePrincipalAuthority, RoleTurnRequest } from "../host-contracts.ts";
7
8
  import { engineSessionMaterialFromOptions } from "../package-resources/engine-material.ts";
@@ -14,9 +15,16 @@ import {
14
15
  } from "./invocation.ts";
15
16
  import {
16
17
  runPostAdmissionOneShot,
18
+ type PostAdmissionAdapters,
17
19
  type PostAdmissionEnv,
20
+ runPostAdmissionSeatResume,
21
+ resumeTurnRequestProjectionOptions,
18
22
  } from "./post-admission.ts";
19
- import { markRunAdmitted } from "./run-lifecycle.ts";
23
+ import {
24
+ loadResumableInspectorRun,
25
+ markRunAdmitted,
26
+ type PublicResumeRequest,
27
+ } from "./run-lifecycle.ts";
20
28
  import {
21
29
  presentStructuralRejection,
22
30
  trySettleInspectorTerminalResult,
@@ -110,10 +118,46 @@ export async function runPublicInspector(
110
118
  env,
111
119
  io,
112
120
  request: turnRequest,
113
- adapters: {
114
- trySettle: (admitted, authority) => trySettleInspectorTerminalResult(admitted, authority),
115
- shouldPresentSettled: () => true,
116
- },
121
+ adapters: inspectorAdapters(),
122
+ ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
123
+ });
124
+ }
125
+
126
+ function inspectorAdapters(): PostAdmissionAdapters<AdmittedInspectorInvocation> {
127
+ return {
128
+ trySettle: (admitted, authority) => trySettleInspectorTerminalResult(admitted, authority),
129
+ shouldPresentSettled: () => true,
130
+ };
131
+ }
132
+
133
+ /**
134
+ * Resume a previously admitted Inspector run (#633); the session principal reopens.
135
+ */
136
+ export async function runPublicInspectorResume(
137
+ request: PublicResumeRequest,
138
+ env: InspectorRunEnv,
139
+ io: CliIo,
140
+ ): Promise<{
141
+ exitCode: number;
142
+ admitted?: AdmittedInspectorInvocation;
143
+ terminal?: TerminalResult;
144
+ }> {
145
+ return await runPostAdmissionSeatResume({
146
+ request,
147
+ env,
148
+ io,
149
+ load: () =>
150
+ loadResumableInspectorRun(
151
+ env.home,
152
+ request.runId,
153
+ env.principalAuthority,
154
+ ),
155
+ buildTurnRequest: (admitted) =>
156
+ buildInspectorTurnRequest(
157
+ admitted,
158
+ resumeTurnRequestProjectionOptions(admitted, request, env),
159
+ ),
160
+ adapters: inspectorAdapters(),
117
161
  ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
118
162
  });
119
163
  }
@@ -17,10 +17,14 @@ import {
17
17
  } from "./invocation.ts";
18
18
  import {
19
19
  runPostAdmissionOneShot,
20
+ runPostAdmissionSeatResume,
21
+ resumeTurnRequestProjectionOptions,
20
22
  type PostAdmissionEnv,
21
23
  } from "./post-admission.ts";
22
24
  import {
25
+ loadResumableInstructionSeatRun,
23
26
  markRunAdmitted,
27
+ type PublicResumeRequest,
24
28
  } from "./run-lifecycle.ts";
25
29
  import {
26
30
  presentStructuralRejection,
@@ -75,6 +79,29 @@ function instructionSeatAdapters() {
75
79
  };
76
80
  }
77
81
 
82
+ export async function runPublicInstructionSeatResume(
83
+ request: PublicResumeRequest,
84
+ env: InstructionSeatRunEnv,
85
+ io: CliIo,
86
+ ): Promise<{ exitCode: number; terminal?: TerminalResult }> {
87
+ return await runPostAdmissionSeatResume({
88
+ request,
89
+ env,
90
+ io,
91
+ load: () => loadResumableInstructionSeatRun(
92
+ env.home,
93
+ request.runId,
94
+ env.principalAuthority,
95
+ ),
96
+ buildTurnRequest: (admitted) => buildInstructionSeatTurnRequest(
97
+ admitted,
98
+ resumeTurnRequestProjectionOptions(admitted, request, env),
99
+ ),
100
+ adapters: instructionSeatAdapters(),
101
+ ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
102
+ });
103
+ }
104
+
78
105
  export async function runPublicInstructionSeat(
79
106
  argv: readonly string[],
80
107
  env: InstructionSeatRunEnv,
@@ -34,10 +34,11 @@ import {
34
34
  type RoleTurnRequestProjectionOptions,
35
35
  } from "./turn-request.ts";
36
36
  import {
37
- runPostAdmissionManualResume,
38
37
  runPostAdmissionResumable,
39
38
  type PostAdmissionAdapters,
40
39
  type PostAdmissionEnv,
40
+ runPostAdmissionSeatResume,
41
+ resumeTurnRequestProjectionOptions,
41
42
  } from "./post-admission.ts";
42
43
 
43
44
  export type JudgeRunEnv = PostAdmissionEnv & {
@@ -176,43 +177,17 @@ export async function runPublicResume(
176
177
  admitted?: AdmittedJudgeInvocation;
177
178
  terminal?: TerminalResult;
178
179
  }> {
179
- let loaded;
180
- try {
181
- loaded = await loadResumableJudgeRun(env.home, request.runId, env.principalAuthority);
182
- } catch (error) {
183
- if (error instanceof CliUsageError) {
184
- presentStructuralRejection(error, io);
185
- return { exitCode: 2 };
186
- }
187
- throw error;
188
- }
189
-
190
- const { admitted } = loaded;
191
- const turnRequest = buildJudgeTurnRequest(admitted, {
192
- packageRoot: env.packageRoot,
193
- home: env.home,
194
- agentDir: env.agentDir,
195
- ...(env.model === undefined ? {} : { model: env.model }),
196
- ...(env.engine === undefined ? {} : { engine: env.engine }),
197
- ...(env.timeoutMs === undefined ? {} : { timeoutMs: env.timeoutMs }),
198
- ...(admitted.correlationId === undefined && env.correlationId === undefined
199
- ? {}
200
- : { correlationId: admitted.correlationId ?? env.correlationId }),
201
- continuation: {
202
- kind: "resume",
203
- prompt: buildResumeContinuationPrompt({
204
- packageRoot: env.packageRoot,
205
- ...(env.engine === undefined ? {} : { engine: env.engine }),
206
- ...(request.message === undefined ? {} : { message: request.message }),
207
- }),
208
- },
209
- });
210
-
211
- return await runPostAdmissionManualResume({
212
- admitted,
180
+ return await runPostAdmissionSeatResume({
181
+ request,
213
182
  env,
214
183
  io,
215
- request: turnRequest,
184
+ load: () =>
185
+ loadResumableJudgeRun(env.home, request.runId, env.principalAuthority),
186
+ buildTurnRequest: (admitted) =>
187
+ buildJudgeTurnRequest(
188
+ admitted,
189
+ resumeTurnRequestProjectionOptions(admitted, request, env),
190
+ ),
216
191
  adapters: judgeAdapters(),
217
192
  ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
218
193
  });
@@ -53,6 +53,7 @@ import {
53
53
  runPostAdmissionResumable,
54
54
  type PostAdmissionAdapters,
55
55
  type PostAdmissionEnv,
56
+ resumeTurnRequestProjectionOptions,
56
57
  } from "./post-admission.ts";
57
58
 
58
59
  export type MergerRunEnv = PostAdmissionEnv & {
@@ -403,25 +404,10 @@ export async function runPublicMergerResume(
403
404
  )) as { exitCode: number; admitted: AdmittedMergerInvocation; terminal: TerminalResult };
404
405
  }
405
406
 
406
- const turnRequest = buildMergerTurnRequest(admitted, {
407
- packageRoot: env.packageRoot,
408
- home: env.home,
409
- agentDir: env.agentDir,
410
- ...(env.model === undefined ? {} : { model: env.model }),
411
- ...(env.engine === undefined ? {} : { engine: env.engine }),
412
- ...(env.timeoutMs === undefined ? {} : { timeoutMs: env.timeoutMs }),
413
- ...(admitted.correlationId === undefined && env.correlationId === undefined
414
- ? {}
415
- : { correlationId: admitted.correlationId ?? env.correlationId }),
416
- continuation: {
417
- kind: "resume",
418
- prompt: buildResumeContinuationPrompt({
419
- packageRoot: env.packageRoot,
420
- ...(env.engine === undefined ? {} : { engine: env.engine }),
421
- ...(request.message === undefined ? {} : { message: request.message }),
422
- }),
423
- },
424
- });
407
+ const turnRequest = buildMergerTurnRequest(
408
+ admitted,
409
+ resumeTurnRequestProjectionOptions(admitted, request, env),
410
+ );
425
411
 
426
412
  return await runPostAdmissionManualResume({
427
413
  admitted,
@@ -14,9 +14,16 @@ import {
14
14
  } from "./invocation.ts";
15
15
  import {
16
16
  runPostAdmissionOneShot,
17
+ type PostAdmissionAdapters,
17
18
  type PostAdmissionEnv,
19
+ runPostAdmissionSeatResume,
20
+ resumeTurnRequestProjectionOptions,
18
21
  } from "./post-admission.ts";
19
- import { markRunAdmitted } from "./run-lifecycle.ts";
22
+ import {
23
+ loadResumableNotaryRun,
24
+ markRunAdmitted,
25
+ type PublicResumeRequest,
26
+ } from "./run-lifecycle.ts";
20
27
  import {
21
28
  presentStructuralRejection,
22
29
  trySettleNotaryTerminalResult,
@@ -109,11 +116,53 @@ export async function runPublicNotary(
109
116
  env,
110
117
  io,
111
118
  request: turnRequest,
112
- adapters: {
113
- trySettle: (admitted, authority) => trySettleNotaryTerminalResult(admitted, authority),
114
- // Accepted receipts and failure terminals both present via shared path.
115
- shouldPresentSettled: () => true,
119
+ adapters: notaryAdapters(),
120
+ ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
121
+ });
122
+ }
123
+
124
+ function notaryAdapters(): PostAdmissionAdapters<AdmittedNotaryInvocation> {
125
+ return {
126
+ trySettle: (admitted, authority) => trySettleNotaryTerminalResult(admitted, authority),
127
+ // Accepted receipts and failure terminals both present via shared path.
128
+ shouldPresentSettled: () => true,
129
+ };
130
+ }
131
+
132
+ /**
133
+ * Resume a previously admitted Notary run (#633). Source-run locator restores
134
+ * from the durable admitted request (never re-resolved); the session principal reopens.
135
+ */
136
+ export async function runPublicNotaryResume(
137
+ request: PublicResumeRequest,
138
+ env: NotaryRunEnv,
139
+ io: CliIo,
140
+ ): Promise<{
141
+ exitCode: number;
142
+ admitted?: AdmittedNotaryInvocation;
143
+ terminal?: TerminalResult;
144
+ }> {
145
+ return await runPostAdmissionSeatResume({
146
+ request,
147
+ env,
148
+ io,
149
+ load: () => {
150
+ if (request.message !== undefined) {
151
+ throw new CliUsageError(
152
+ "notary rejects caller prompt/instruction; only zero caller-prompt continuation admitted",
153
+ );
154
+ }
155
+ return loadResumableNotaryRun(
156
+ env.home,
157
+ request.runId,
158
+ env.principalAuthority,
159
+ );
116
160
  },
161
+ buildTurnRequest: (admitted) => buildNotaryTurnRequest(
162
+ admitted,
163
+ resumeTurnRequestProjectionOptions(admitted, request, env),
164
+ ),
165
+ adapters: notaryAdapters(),
117
166
  ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
118
167
  });
119
168
  }
@@ -1182,7 +1182,7 @@ const ROLE_COMMAND_HELP = {
1182
1182
  },
1183
1183
  collector: {
1184
1184
  command: "collector",
1185
- summary: "Collect GitHub PR review evidence (one-shot).",
1185
+ summary: "Collect GitHub PR review evidence.",
1186
1186
  usage: ["ak-role collector --pr <number> [options] [instruction]"],
1187
1187
  examples: [
1188
1188
  "ak-role collector --pr 42 --repo owner/repository",
@@ -1191,7 +1191,7 @@ const ROLE_COMMAND_HELP = {
1191
1191
  },
1192
1192
  doctor: {
1193
1193
  command: "doctor",
1194
- summary: "Diagnose one retained case (one-shot).",
1194
+ summary: "Diagnose one retained case.",
1195
1195
  usage: ["ak-role doctor --issue <number> [options] [instruction]"],
1196
1196
  examples: [
1197
1197
  'ak-role doctor --issue 115 "Diagnose this retained case."',
@@ -1290,7 +1290,7 @@ const SUPPORT_COMMAND_HELP = {
1290
1290
  resume: {
1291
1291
  command: "resume",
1292
1292
  summary:
1293
- "Resume a role run under the live seat table (model/host/engine); session principal must still exist.",
1293
+ "Resume a role run under the live seat table (model/host/engine); session principal must still exist. [message] applies only to seats that accept caller instruction; Notary/符宝郎 must omit message and derives evidence from the existing source-run/dossier binding.",
1294
1294
  usage: ["ak-role resume <runId> [message]"],
1295
1295
  examples: [
1296
1296
  "ak-role resume 01abc…",
@@ -8,6 +8,13 @@
8
8
  import { readFile, writeFile } from "node:fs/promises";
9
9
  import { join } from "node:path";
10
10
 
11
+ import {
12
+ buildResumeContinuationPrompt,
13
+ type PublicResumeRequest,
14
+ } from "./run-lifecycle.ts";
15
+ import { CliUsageError } from "./cli-errors.ts";
16
+ import type { RoleTurnRequestProjectionOptions } from "./turn-request.ts";
17
+
11
18
  import type {
12
19
  ControlledFailureCause,
13
20
  DurablePrincipal,
@@ -404,6 +411,75 @@ export async function dispatchPostAdmissionTurn<
404
411
  }
405
412
  }
406
413
 
414
+ /**
415
+ * Shared resume continuation projection (#471 / #600 / #633): seat-table
416
+ * model/engine/timeout axes, restored correlation, and the package resume
417
+ * envelope (message optional). Seats add only their activation projection.
418
+ */
419
+ export function resumeTurnRequestProjectionOptions(
420
+ admitted: AdmittedRoleInvocation,
421
+ request: PublicResumeRequest,
422
+ env: PostAdmissionEnv,
423
+ ): RoleTurnRequestProjectionOptions {
424
+ return {
425
+ packageRoot: env.packageRoot,
426
+ home: env.home,
427
+ agentDir: env.agentDir,
428
+ ...(env.model === undefined ? {} : { model: env.model }),
429
+ ...(env.engine === undefined ? {} : { engine: env.engine }),
430
+ ...(env.timeoutMs === undefined ? {} : { timeoutMs: env.timeoutMs }),
431
+ ...(admitted.correlationId === undefined && env.correlationId === undefined
432
+ ? {}
433
+ : { correlationId: admitted.correlationId ?? env.correlationId }),
434
+ continuation: {
435
+ kind: "resume",
436
+ prompt: buildResumeContinuationPrompt({
437
+ packageRoot: env.packageRoot,
438
+ ...(env.engine === undefined ? {} : { engine: env.engine }),
439
+ ...(request.message === undefined ? {} : { message: request.message }),
440
+ }),
441
+ },
442
+ };
443
+ }
444
+
445
+ /**
446
+ * Shared manual-resume orchestration for seats whose continuation is the
447
+ * package resume envelope (#599 / #633): load → structural rejection → seat
448
+ * turn projection → runPostAdmissionManualResume. Seat-owned loader validation,
449
+ * turn builder, and adapters stay on the seat.
450
+ */
451
+ export async function runPostAdmissionSeatResume<
452
+ A extends AdmittedRoleInvocation,
453
+ T extends TerminalResult = TerminalResult,
454
+ >(input: {
455
+ request: PublicResumeRequest;
456
+ env: PostAdmissionEnv;
457
+ io: CliIo;
458
+ load: () => Promise<{ admitted: A }>;
459
+ buildTurnRequest: (admitted: A) => RoleTurnRequest;
460
+ adapters: PostAdmissionAdapters<A, T>;
461
+ effectiveEngine?: string;
462
+ }): Promise<{ exitCode: number; admitted?: A; terminal?: T }> {
463
+ let loaded;
464
+ try {
465
+ loaded = await input.load();
466
+ } catch (error) {
467
+ if (error instanceof CliUsageError) {
468
+ presentStructuralRejection(error, input.io);
469
+ return { exitCode: 2 };
470
+ }
471
+ throw error;
472
+ }
473
+ return await runPostAdmissionManualResume({
474
+ admitted: loaded.admitted,
475
+ env: input.env,
476
+ io: input.io,
477
+ request: input.buildTurnRequest(loaded.admitted),
478
+ adapters: input.adapters,
479
+ ...(input.effectiveEngine === undefined ? {} : { effectiveEngine: input.effectiveEngine }),
480
+ });
481
+ }
482
+
407
483
  /**
408
484
  * Shared post-admission one-shot path: writer lease, then turn dispatch.
409
485
  * Initial facades own the durable admitted mark (markRunAdmitted) before
@@ -48,6 +48,7 @@ import {
48
48
  runPostAdmissionResumable,
49
49
  type PostAdmissionAdapters,
50
50
  type PostAdmissionEnv,
51
+ resumeTurnRequestProjectionOptions,
51
52
  } from "./post-admission.ts";
52
53
 
53
54
  export type ReviewerRunEnv = PostAdmissionEnv & {
@@ -271,25 +272,10 @@ export async function runPublicReviewerResume(
271
272
  )) as { exitCode: number; admitted: AdmittedReviewerInvocation; terminal: TerminalResult };
272
273
  }
273
274
 
274
- const turnRequest = buildReviewerTurnRequest(admitted, {
275
- packageRoot: env.packageRoot,
276
- home: env.home,
277
- agentDir: env.agentDir,
278
- ...(env.model === undefined ? {} : { model: env.model }),
279
- ...(env.engine === undefined ? {} : { engine: env.engine }),
280
- ...(env.timeoutMs === undefined ? {} : { timeoutMs: env.timeoutMs }),
281
- ...(admitted.correlationId === undefined && env.correlationId === undefined
282
- ? {}
283
- : { correlationId: admitted.correlationId ?? env.correlationId }),
284
- continuation: {
285
- kind: "resume",
286
- prompt: buildResumeContinuationPrompt({
287
- packageRoot: env.packageRoot,
288
- ...(env.engine === undefined ? {} : { engine: env.engine }),
289
- ...(request.message === undefined ? {} : { message: request.message }),
290
- }),
291
- },
292
- });
275
+ const turnRequest = buildReviewerTurnRequest(
276
+ admitted,
277
+ resumeTurnRequestProjectionOptions(admitted, request, env),
278
+ );
293
279
 
294
280
  return await runPostAdmissionManualResume({
295
281
  admitted,