@akagilnc/pi-workflow-roles 0.1.3397 → 0.1.3403

package/dist/public-cli/main.js

@@ -24944,8 +24944,15 @@ function sealedLedgerHome(admitted) {
 async function sealedLedgerOutcome(admitted) {
   return readSealedSubmission(admitted.projectRoot, admitted.runId, sealedLedgerHome(admitted));
 }
-async function hasSealedAcceptedProjection(admitted) {
-  return await sealedLedgerOutcome(admitted) !== void 0;
+async function sealedAcceptanceRedispatchDisposition(admitted) {
+  try {
+    if (await sealedLedgerOutcome(admitted) !== void 0) {
+      return { kind: "block", reason: "sealed-accepted" };
+    }
+    return { kind: "allow" };
+  } catch (cause) {
+    return { kind: "block", reason: "authority-failed", cause };
+  }
 }
 async function auditEscalationLedgerOutcome(admitted, role) {
   const projection = await readAuditEscalationSubmission(
@@ -27937,36 +27944,21 @@ async function runWithAutoResumeLoop(options) {
         return result2;
       }
     }
-    if (options.shouldStopAutoResume !== void 0) {
-      let failClosed;
-      let sealedStop = false;
-      try {
-        sealedStop = await options.shouldStopAutoResume();
-      } catch (authorityError) {
-        failClosed = {
-          cause: authorityError,
-          endReason: "sealed-acceptance authority failed closed"
-        };
-      }
-      if (failClosed === void 0 && sealedStop) {
-        if (result2 !== void 0) {
-          const terminal = result2.terminal;
-          if (terminal !== void 0) presentTerminal(terminal, options.io);
+    if (options.sealedAcceptanceDisposition !== void 0) {
+      const disposition = await options.sealedAcceptanceDisposition();
+      if (disposition.kind === "block") {
+        if (disposition.reason === "sealed-accepted" && result2 !== void 0) {
+          const terminal2 = result2.terminal;
+          if (terminal2 !== void 0) presentTerminal(terminal2, options.io);
           return result2;
         }
-        failClosed = {
-          cause: lastThrownError,
-          endReason: "sealed accepted projection already present"
-        };
-      }
-      if (failClosed !== void 0) {
         const terminal = dispatchExceptionFailureTerminal({
           role: options.admitted.role,
           runId: options.admitted.runId,
-          causeError: failClosed.cause,
+          causeError: disposition.reason === "authority-failed" ? disposition.cause : lastThrownError,
           errorFiles: retainedErrorFiles,
           autoResumeAttempts,
-          endReason: failClosed.endReason,
+          endReason: disposition.reason === "authority-failed" ? "sealed-acceptance authority failed closed" : "sealed accepted projection already present",
           everyAttemptThrew
         });
         await finalizeExceptionRunBestEffort(options.admitted.runDirectory, options.io);
@@ -28320,7 +28312,7 @@ async function runPostAdmissionResumable(input) {
     autoResumeLimit: env.autoResumeLimit,
     buildInitialPayload: buildInitialRequest,
     buildResumePayload: buildResumeRequest,
-    shouldStopAutoResume: async () => hasSealedAcceptedProjection(admitted),
+    sealedAcceptanceDisposition: () => sealedAcceptanceRedispatchDisposition(admitted),
     dispatch: (request, lease, _isFirst, attemptIo) => dispatchPostAdmissionTurn({
       admitted,
       env: {
@@ -28352,22 +28344,15 @@ async function runPostAdmissionManualResume(input) {
       };
     }
   } catch (error) {
-    let failClosed;
-    try {
-      if (await hasSealedAcceptedProjection(admitted)) {
-        failClosed = { cause: error };
-      }
-    } catch (authorityError) {
-      failClosed = { cause: authorityError };
-    }
-    if (failClosed !== void 0) {
+    const disposition = await sealedAcceptanceRedispatchDisposition(admitted);
+    if (disposition.kind === "block") {
       return await presentControlledFailure2(
         admitted,
         {
           timedOut: false,
           code: null,
           stderr: "",
-          thrown: failClosed.cause
+          thrown: disposition.reason === "authority-failed" ? disposition.cause : error
         },
         adapters,
         env.principalAuthority,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.3397",
+  "version": "0.1.3403",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/public-cli/auto-resume.ts

@@ -31,7 +31,11 @@ import {
 } from "./run-lifecycle.ts";
 import { parseAutoResumeLimit } from "./config.ts";
 import { isLawfulTypedTerminalOutcome, formatTerminalResult, type TerminalArtifactRef, type TerminalResult, type TerminalRoleName } from "./terminal.ts";
-import { presentFailureTerminal, presentStructuralRejection } from "./settlement.ts";
+import {
+  presentFailureTerminal,
+  presentStructuralRejection,
+  type SealedAcceptanceRedispatchDisposition,
+} from "./settlement.ts";
 import type { CliIo } from "./cli-io.ts";
 
 const dummyIo: CliIo = { stdout: () => {}, stderr: () => {} };
@@ -343,11 +347,12 @@ export async function runWithAutoResumeLoop<
   buildResumePayload: () => TPayload;
   dispatch: (payload: TPayload, lease: RunWriterLease, isFirst: boolean, attemptIo: CliIo) => Promise<T>;
   /**
-   * After a non-lawful terminal or dispatch throw, stop further auto-resume when a unique sealed
-   * accepted projection is already readable (publication miss must not redispatch
-   * and destroy the sealed read — #648 / #599 alignment).
+   * After a non-lawful terminal or dispatch throw, consult settlement-owned
+   * sealed-acceptance redispatch disposition (#672 / ADR 0080). Publication
+   * miss must not redispatch and destroy the sealed read (#648 / #599).
+   * Loop presents entry-specific terminals; it must not rebuild the gate.
    */
-  shouldStopAutoResume?: () => Promise<boolean>;
+  sealedAcceptanceDisposition?: () => Promise<SealedAcceptanceRedispatchDisposition>;
 }): Promise<T> {
   // #422 single-point resolution + domain validation. NaN would bypass every
   // `attempts >= limit` comparison (always false) — reject here, before any dispatch.
@@ -431,42 +436,30 @@ export async function runWithAutoResumeLoop<
       }
     }
 
-    // One sealed ledger authority before any redispatch (#648): shared for
-    // non-lawful return and direct throw. Authority throw fail-closes with
-    // preserved cause — never wash into unsealed redispatch. Only the sealed=true
-    // projection differs (present returned terminal vs throw-path synthetic).
-    // Fail-closed decision is independent of cause value: `throw undefined` is
-    // legal JS and must not fail open. One cause + endReason → one presentation.
-    if (options.shouldStopAutoResume !== undefined) {
-      let failClosed: { cause: unknown; endReason: string } | undefined;
-      let sealedStop = false;
-      try {
-        sealedStop = await options.shouldStopAutoResume();
-      } catch (authorityError) {
-        failClosed = {
-          cause: authorityError,
-          endReason: "sealed-acceptance authority failed closed",
-        };
-      }
-      if (failClosed === undefined && sealedStop) {
-        if (result !== undefined) {
+    // Settlement-owned sealed disposition before any redispatch (#648 / #672):
+    // shared for non-lawful return and direct throw. Only entry presentation
+    // differs (present returned terminal vs throw-path synthetic).
+    if (options.sealedAcceptanceDisposition !== undefined) {
+      const disposition = await options.sealedAcceptanceDisposition();
+      if (disposition.kind === "block") {
+        if (disposition.reason === "sealed-accepted" && result !== undefined) {
           const terminal = (result as { terminal?: TerminalResult }).terminal;
           if (terminal !== undefined) presentTerminal(terminal, options.io);
           return result;
         }
-        failClosed = {
-          cause: lastThrownError,
-          endReason: "sealed accepted projection already present",
-        };
-      }
-      if (failClosed !== undefined) {
         const terminal = dispatchExceptionFailureTerminal({
           role: options.admitted.role,
           runId: options.admitted.runId,
-          causeError: failClosed.cause,
+          causeError:
+            disposition.reason === "authority-failed"
+              ? disposition.cause
+              : lastThrownError,
           errorFiles: retainedErrorFiles,
           autoResumeAttempts,
-          endReason: failClosed.endReason,
+          endReason:
+            disposition.reason === "authority-failed"
+              ? "sealed-acceptance authority failed closed"
+              : "sealed accepted projection already present",
           everyAttemptThrew,
         });
         await finalizeExceptionRunBestEffort(options.admitted.runDirectory, options.io);

package/src/public-cli/post-admission.ts

@@ -57,7 +57,7 @@ import {
   resolveAuditedRunnerFailureResolution,
   resolveControlledFailureResumeObservation,
   settleFailureTerminalResult,
-  hasSealedAcceptedProjection,
+  sealedAcceptanceRedispatchDisposition,
 } from "./settlement.ts";
 import type { CliIo } from "./cli-io.ts";
 import type { AdmittedRoleInvocation } from "./invocation.ts";
@@ -547,8 +547,8 @@ export async function runPostAdmissionResumable<
     autoResumeLimit: env.autoResumeLimit,
     buildInitialPayload: buildInitialRequest,
     buildResumePayload: buildResumeRequest,
-    shouldStopAutoResume: async () =>
-      hasSealedAcceptedProjection(admitted),
+    sealedAcceptanceDisposition: () =>
+      sealedAcceptanceRedispatchDisposition(admitted),
     dispatch: (request, lease, _isFirst, attemptIo) =>
       dispatchPostAdmissionTurn({
         admitted,
@@ -614,27 +614,21 @@ export async function runPostAdmissionManualResume<
       };
     }
   } catch (error) {
-    // Sealed accepted + publication/settle throw must fail closed without redispatch
-    // (#648 / #599): do not treat "sealed + publish threw" as "not sealed".
-    // Ledger authority failure also fail-closes with preserved cause (never wash to unsealed).
-    // Fail-closed decision is independent of cause value: `throw undefined` is legal JS
-    // and must not fail open. One cause → one presentation (settle vs authority).
-    let failClosed: { cause: unknown } | undefined;
-    try {
-      if (await hasSealedAcceptedProjection(admitted)) {
-        failClosed = { cause: error };
-      }
-    } catch (authorityError) {
-      failClosed = { cause: authorityError };
-    }
-    if (failClosed !== undefined) {
+    // Settlement-owned sealed disposition (#648 / #599 / #672): sealed accepted +
+    // publication/settle throw fail closed without redispatch; authority failure
+    // preserves true cause. Manual resume only presents — does not rebuild the gate.
+    const disposition = await sealedAcceptanceRedispatchDisposition(admitted);
+    if (disposition.kind === "block") {
       return (await presentControlledFailure(
         admitted,
         {
           timedOut: false,
           code: null,
           stderr: "",
-          thrown: failClosed.cause,
+          thrown:
+            disposition.reason === "authority-failed"
+              ? disposition.cause
+              : error,
         },
         adapters,
         env.principalAuthority,

package/src/public-cli/settlement.ts

@@ -163,15 +163,31 @@ async function sealedLedgerOutcome(admitted: AdmittedRoleInvocation): Promise<Ex
 }
 
 /**
- * Shared sealed-accepted detection for all resumable adapters (#648).
- * Ledger projection is the sole authority — not optional per-role adapter wiring.
+ * Shared sealed-acceptance redispatch disposition for resume entrypoints
+ * (#648 sealed authority; #672 / ADR 0080 single-settlement-disposition).
+ * Owns the fail-closed gate auto and manual resume previously rebuilt beside
+ * the shared sealed query: sealed → block; authority throw → block with
+ * preserved cause; otherwise allow. Callers present entry-specific terminals;
+ * they must not re-derive this judgment. Ledger projection remains the sole
+ * seal truth — this is disposition over that read, not a second state.
  */
-export async function hasSealedAcceptedProjection(
+export type SealedAcceptanceRedispatchDisposition =
+  | { readonly kind: "allow" }
+  | { readonly kind: "block"; readonly reason: "sealed-accepted" }
+  | { readonly kind: "block"; readonly reason: "authority-failed"; readonly cause: unknown };
+
+export async function sealedAcceptanceRedispatchDisposition(
   admitted: AdmittedRoleInvocation,
-): Promise<boolean> {
-  // Ledger authority must not wash read failure into "unsealed" (#648).
-  // Callers treat throw as fail-closed: preserve true cause, never redispatch.
-  return (await sealedLedgerOutcome(admitted)) !== undefined;
+): Promise<SealedAcceptanceRedispatchDisposition> {
+  try {
+    if ((await sealedLedgerOutcome(admitted)) !== undefined) {
+      return { kind: "block", reason: "sealed-accepted" };
+    }
+    return { kind: "allow" };
+  } catch (cause) {
+    // Ledger authority must not wash read failure into "unsealed" (#648).
+    return { kind: "block", reason: "authority-failed", cause };
+  }
 }
 
 async function auditEscalationLedgerOutcome(