@akagilnc/pi-workflow-roles 0.1.3414 → 0.1.3439

package/src/public-cli/post-admission.ts

@@ -26,6 +26,11 @@ import type {
   SessionCustomEntryAppender,
 } from "../host-contracts.ts";
 import { projectHostTransitionPriorNative } from "../host-transition-prior-native.ts";
+import {
+  isTicketSeatMemoryBound,
+  readTicketSeatMemoryLastHost,
+  writeTicketSeatMemoryLastHost,
+} from "../ticket-seat-memory.ts";
 import type { CredentialProviders, SeatModelConfig } from "./config.ts";
 import {
   missingCredentialPreDispatchFailure,
@@ -54,10 +59,12 @@ import {
   isLawfulTypedTerminalOutcome,
   presentFailureTerminal,
   presentStructuralRejection,
+  projectThrownFailureLeaf,
   resolveAuditedRunnerFailureResolution,
   resolveControlledFailureResumeObservation,
   settleFailureTerminalResult,
   sealedAcceptanceRedispatchDisposition,
+  type ControlledFailure,
 } from "./settlement.ts";
 import type { CliIo } from "./cli-io.ts";
 import type { AdmittedRoleInvocation } from "./invocation.ts";
@@ -109,7 +116,6 @@ export type PostAdmissionAdapters<
   trySettle: (admitted: A, authority: DurablePrincipalAuthority) => Promise<T | undefined>;
   /** Default: isLawfulTypedTerminalOutcome(terminal.roleOutcome). */
   shouldPresentSettled?: (terminal: T) => boolean;
-  trySettleSecondary?: (admitted: A, authority: DurablePrincipalAuthority) => Promise<TerminalResult | undefined>;
   resolveRunnerKnownFailure?: (input: {
     result: RoleTurnResult;
     sessionFile: string;
@@ -129,6 +135,8 @@ export type ControlledFailureInput = {
     readonly code?: string | number;
   };
   knownDiagnostic?: string;
+  /** Secondary evidence already owned by the typed production failure channel. */
+  knownDetails?: Readonly<Record<string, unknown>>;
   typedHttpObservationSettled?: true;
   typedHttpObservation?: TypedProviderHttpObservation;
 };
@@ -169,12 +177,19 @@ export async function presentControlledFailure<
     admitted.principal !== undefined
       ? await inspectJudgeSession(authority.decode(admitted.principal).sessionFile)
       : undefined;
+  // knownFailure channel owns details when present; otherwise caller knownDetails
+  // (e.g. last-host write concurrent leaf on timeout/activation dual failure).
+  const fromKnownFailure =
+    explicitInternalKnownFailureClassificationInput(knownFailure);
   const failure = classifyPostAdmissionFailure({
     timedOut: failureInput.timedOut,
     code: failureInput.code,
     stderr: failureInput.stderr,
     ...(hasThrown ? { thrown: failureInput.thrown } : {}),
-    ...explicitInternalKnownFailureClassificationInput(knownFailure),
+    ...(failureInput.knownDetails === undefined
+      ? {}
+      : { knownDetails: failureInput.knownDetails }),
+    ...fromKnownFailure,
     ...(failureInput.knownCause === undefined
       ? {}
       : { knownCause: failureInput.knownCause }),
@@ -218,12 +233,125 @@ export async function presentControlledFailure<
   };
 }
 
-function presentSecondaryTerminal(terminal: TerminalResult, io: CliIo): void {
-  if (terminal.roleOutcome.kind === "failure" || terminal.roleOutcome.kind === "no_receipt") {
-    presentFailureTerminal(terminal, io);
-  } else {
-    io.stdout(formatTerminalResult(terminal));
+/** Serialize one failure leaf for details.concurrentFailures (sole leaf owner = settlement). */
+function concurrentFailureLeafRecord(leaf: ControlledFailure): {
+  readonly cause: ControlledFailureCause;
+  readonly diagnostic: string;
+  readonly identity?: { readonly name?: string; readonly code?: string | number };
+  readonly details?: Readonly<Record<string, unknown>>;
+} {
+  return {
+    cause: leaf.cause,
+    diagnostic: leaf.diagnostic,
+    ...(leaf.identity === undefined ? {} : { identity: leaf.identity }),
+    ...(leaf.details === undefined ? {} : { details: leaf.details }),
+  };
+}
+
+function existingConcurrentFailureLeaves(
+  details: Readonly<Record<string, unknown>> | undefined,
+): unknown[] {
+  const value = details?.concurrentFailures;
+  return Array.isArray(value) ? [...value] : [];
+}
+
+/**
+ * Attach last-host write failure as concurrent secondary evidence on an existing
+ * returned-path ControlledFailureInput — append, never replace prior leaves.
+ */
+function withLastHostWriteConcurrentFailure(
+  input: ControlledFailureInput,
+  writeError: unknown,
+): ControlledFailureInput {
+  const writeLeaf = concurrentFailureLeafRecord(projectThrownFailureLeaf(writeError));
+  if (input.knownFailure !== undefined) {
+    const failure = input.knownFailure;
+    return {
+      ...input,
+      knownFailure: {
+        cause: failure.cause,
+        ...(failure.identity === undefined ? {} : { identity: failure.identity }),
+        ...(failure.diagnostic === undefined
+          ? {}
+          : { diagnostic: failure.diagnostic }),
+        details: {
+          ...(failure.details ?? {}),
+          concurrentFailures: [
+            ...existingConcurrentFailureLeaves(failure.details),
+            writeLeaf,
+          ],
+        },
+      },
+    };
+  }
+  return {
+    ...input,
+    knownDetails: {
+      ...(input.knownDetails ?? {}),
+      concurrentFailures: [
+        ...existingConcurrentFailureLeaves(input.knownDetails),
+        writeLeaf,
+      ],
+    },
+  };
+}
+
+/** Settled failure roleOutcome already narrowed by kind at the sole call site. */
+type SettledFailureOutcome = Extract<
+  TerminalResult["roleOutcome"],
+  { kind: "failure" }
+>;
+
+/**
+ * Rebuild the settled failure as knownFailure so concurrent last-host write can
+ * append without replacing cause/identity/diagnostic/details.
+ * Caller narrows by kind; no second runtime re-check.
+ */
+function knownFailureFromSettledFailureOutcome(
+  outcome: SettledFailureOutcome,
+): RoleTurnKnownFailure {
+  const facts = outcome.decisiveFacts;
+  const secondary = facts.secondaryEvidence;
+  const details =
+    secondary !== undefined &&
+    typeof secondary === "object" &&
+    secondary !== null &&
+    !Array.isArray(secondary)
+      ? (secondary as Readonly<Record<string, unknown>>)
+      : undefined;
+  const identity: { name?: string; code?: string | number } = {};
+  if (typeof facts.errorName === "string") identity.name = facts.errorName;
+  if (
+    typeof facts.errorCode === "string" ||
+    typeof facts.errorCode === "number"
+  ) {
+    identity.code = facts.errorCode;
   }
+  return {
+    cause: outcome.cause,
+    diagnostic: outcome.diagnostic,
+    ...(Object.keys(identity).length > 0 ? { identity } : {}),
+    ...(details === undefined ? {} : { details }),
+  };
+}
+
+/**
+ * Presence envelope for a caught last-host write failure.
+ * Own-key presence is distinct from the caught value: `throw undefined` must stay a
+ * real failure fact (same rule as settlement thrown own-key), never a missing-write sentinel.
+ */
+type LastHostWriteFailure = { readonly error: unknown };
+
+/** Keep primary throw identity; attach last-host write as a real AggregateError leaf. */
+function withOptionalLastHostWriteThrow(
+  primary: unknown,
+  writeFailure: LastHostWriteFailure | undefined,
+  message: string,
+): unknown {
+  if (writeFailure === undefined) return primary;
+  return new AggregateError([primary, writeFailure.error], message, {
+    cause: primary,
+  });
 }
 
 export async function dispatchPostAdmissionTurn<
@@ -261,19 +389,95 @@ export async function dispatchPostAdmissionTurn<
     }
     // #617 DK-4: capture previous invocation host before markRunRunning overwrites it.
     // Single authority projectHostTransitionPriorNative owns known-host prior native paths.
-    const previousHost = await readInvocationHost(admitted.runDirectory);
+    // #636 ticket-seat memory: one last-host page owns both last host and Grok native-home run.
+    // Open is not turn return/throw: production Grok notes the open fact at bind success;
+    // last-host records when the host returned a result OR when native home actually opened.
+    // Pre-open throws claim nothing; post-open throws retain the opened run.
+    // Side effects are gated by explicit ticket+seat binding — never by directory-outside-run guessing.
+    let previousHost: string | undefined;
+    let previousRunDirectory: string | undefined;
+    let nativeHomeRunDirectory: string | undefined;
+    let openedNativeHomeRunDirectory: string | undefined;
     const liveHost = env.host;
-    const hostTransition =
-      previousHost !== undefined && liveHost !== undefined && admitted.principal !== undefined
-        ? await projectHostTransitionPriorNative({
-            previousHost,
-            liveHost,
-            runDirectory: admitted.runDirectory,
-            piSessionFile: env.principalAuthority.decode(admitted.principal).sessionFile,
-          })
-        : undefined;
-    const turnRequest: RoleTurnRequest =
-      hostTransition === undefined ? request : { ...request, hostTransition };
+    const principalCoordinates =
+      admitted.principal === undefined
+        ? undefined
+        : env.principalAuthority.decode(admitted.principal);
+    const ticketSeatMemoryBound = isTicketSeatMemoryBound({
+      role: admitted.role,
+      ...(admitted.ticketNumber === undefined ? {} : { ticketNumber: admitted.ticketNumber }),
+    });
+    let turnRequest: RoleTurnRequest;
+    try {
+      // Ticket-seat host authority lives on the nest last-host page only.
+      // Per-run invocation.host must not override: old-run retry after a cross-host
+      // intermediate would otherwise keep the stale run host and drop the transition.
+      // Non-ticket-seat paths still read the per-run invocation mark (#617).
+      if (ticketSeatMemoryBound && principalCoordinates !== undefined) {
+        const lastHost = await readTicketSeatMemoryLastHost(
+          principalCoordinates.sessionDirectory,
+        );
+        if (lastHost !== undefined) {
+          previousHost = lastHost.host;
+          // runDirectory on last-host is the established Grok native isolation run when present
+          // (preserved across non-Grok hosts so return-to-Grok can reopen it).
+          if (
+            typeof lastHost.runDirectory === "string" &&
+            lastHost.runDirectory.length > 0
+          ) {
+            previousRunDirectory = lastHost.runDirectory;
+            if (
+              liveHost === "grok-build" &&
+              request.continuation.kind === "resume"
+            ) {
+              nativeHomeRunDirectory = lastHost.runDirectory;
+            }
+          }
+        }
+      } else {
+        previousHost = await readInvocationHost(admitted.runDirectory);
+      }
+      const hostTransition =
+        previousHost !== undefined && liveHost !== undefined && principalCoordinates !== undefined
+          ? await projectHostTransitionPriorNative({
+              previousHost,
+              liveHost,
+              runDirectory: admitted.runDirectory,
+              piSessionFile: principalCoordinates.sessionFile,
+              ...(previousRunDirectory === undefined ? {} : { previousRunDirectory }),
+            })
+          : undefined;
+      turnRequest = request;
+      if (hostTransition !== undefined) {
+        turnRequest = { ...turnRequest, hostTransition };
+      }
+      if (nativeHomeRunDirectory !== undefined) {
+        turnRequest = { ...turnRequest, nativeHomeRunDirectory };
+      }
+      // Capture the actual Grok open event from production isolation (bind success).
+      if (ticketSeatMemoryBound) {
+        turnRequest = {
+          ...turnRequest,
+          noteNativeHomeOpened: (runDirectory) => {
+            openedNativeHomeRunDirectory = runDirectory;
+          },
+        };
+      }
+    } catch (error) {
+      // last-host / prior-native IO is on the public one-shot path — controlled failure, not bare throw.
+      return (await presentControlledFailure(
+        admitted,
+        {
+          timedOut: false,
+          code: null,
+          stderr: "",
+          thrown: error,
+        },
+        adapters,
+        env.principalAuthority,
+        io,
+      )) as { exitCode: number; admitted: A; terminal: T };
+    }
 
     await markRunRunning(admitted.runDirectory, env.model, effectiveEngine, env.host);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
@@ -298,17 +502,66 @@ export async function dispatchPostAdmissionTurn<
       }
     }
 
-    let result: RoleTurnResult;
+    // Turn outcome and open fact are separate events. Discriminate throw value undefined.
+    let turnOutcome:
+      | { readonly kind: "returned"; readonly result: RoleTurnResult }
+      | { readonly kind: "thrown"; readonly error: unknown };
     try {
-      result = await env.roleTurnHost.executeTurn(turnRequest);
+      turnOutcome = {
+        kind: "returned",
+        result: await env.roleTurnHost.executeTurn(turnRequest),
+      };
     } catch (error) {
+      turnOutcome = { kind: "thrown", error };
+    }
+
+    // last-host authority: host returned a turn result OR native home actually opened.
+    // Grok open fact comes from production bind (noteNativeHomeOpened), not from return/throw.
+    // Mock hosts that return without opening still record via the returned path.
+    // Pre-open throws: neither → no claim. Post-open throws: open fact → retain.
+    // Spans returned failure / same-run retry / return-to-Grok / post-open body+cleanup throws.
+    // last-host write failure is pending secondary evidence only — never forks settlement.
+    // Thrown dual: AggregateError leaves. Returned dual: same shared settle/resolve chain,
+    // write leaf attached at the single present boundary (ADR 0080 single-settlement-disposition).
+    // Presence is the envelope, not the caught value — `throw undefined` stays a failure fact.
+    let lastHostWriteFailure: LastHostWriteFailure | undefined;
+    const hostEngaged =
+      turnOutcome.kind === "returned" || openedNativeHomeRunDirectory !== undefined;
+    if (
+      hostEngaged &&
+      liveHost !== undefined &&
+      principalCoordinates !== undefined &&
+      ticketSeatMemoryBound
+    ) {
+      try {
+        await writeTicketSeatMemoryLastHost(
+          principalCoordinates.sessionDirectory,
+          liveHost,
+          liveHost === "grok-build"
+            ? (openedNativeHomeRunDirectory ??
+                nativeHomeRunDirectory ??
+                admitted.runDirectory)
+            : previousRunDirectory,
+        );
+      } catch (error) {
+        lastHostWriteFailure = { error };
+      }
+    }
+
+    if (turnOutcome.kind === "thrown") {
+      // Preserve original throw/cause (pre-open or post-open). last-host already
+      // retained open fact above when bind had succeeded; write fail stays concurrent.
       return (await presentControlledFailure(
         admitted,
         {
           timedOut: false,
           code: null,
           stderr: "",
-          thrown: error,
+          thrown: withOptionalLastHostWriteThrow(
+            turnOutcome.error,
+            lastHostWriteFailure,
+            "host turn and ticket-seat last-host write failed",
+          ),
         },
         adapters,
         env.principalAuthority,
@@ -316,6 +569,8 @@ export async function dispatchPostAdmissionTurn<
       )) as { exitCode: number; admitted: A; terminal: T };
     }
 
+    const result = turnOutcome.result;
+
     try {
       await writeFile(
         join(admitted.runDirectory, "stderr.log"),
@@ -330,13 +585,18 @@ export async function dispatchPostAdmissionTurn<
     try {
       settled = await adapters.trySettle(admitted, env.principalAuthority);
     } catch (error) {
+      // Settle throw is a real failure fact — never swallow into undefined.
       return (await presentControlledFailure(
         admitted,
         {
           timedOut: false,
           code: result.code,
           stderr: result.stderr,
-          thrown: error,
+          thrown: withOptionalLastHostWriteThrow(
+            error,
+            lastHostWriteFailure,
+            "settlement and ticket-seat last-host write failed",
+          ),
         },
         adapters,
         env.principalAuthority,
@@ -344,6 +604,44 @@ export async function dispatchPostAdmissionTurn<
       )) as { exitCode: number; admitted: A; terminal: T };
     }
     if (settled !== undefined && shouldPresent(settled)) {
+      if (lastHostWriteFailure !== undefined) {
+        if (settled.roleOutcome.kind === "failure") {
+          // Existing failure terminal stays primary; last-host write is concurrent only.
+          // shouldPresentSettled must not be read as "no existing failure".
+          return (await presentControlledFailure(
+            admitted,
+            withLastHostWriteConcurrentFailure(
+              {
+                timedOut: result.timedOut,
+                code: result.code,
+                stderr: result.stderr,
+                knownFailure: knownFailureFromSettledFailureOutcome(
+                  settled.roleOutcome,
+                ),
+              },
+              lastHostWriteFailure.error,
+            ),
+            adapters,
+            env.principalAuthority,
+            io,
+          )) as { exitCode: number; admitted: A; terminal: T };
+        }
+        // No existing failure terminal — last-host write is the sole public failure.
+        // thrown key is always set so `throw undefined` stays own-key present.
+        return (await presentControlledFailure(
+          admitted,
+          {
+            timedOut: result.timedOut,
+            code: result.code,
+            stderr: result.stderr,
+            thrown: lastHostWriteFailure.error,
+          },
+          adapters,
+          env.principalAuthority,
+          io,
+        )) as { exitCode: number; admitted: A; terminal: T };
+      }
+      // last-host recorded after host returned a turn result (shared failure/retry/return fact).
       await markRunTerminal(admitted.runDirectory);
       io.stdout(formatTerminalResult(settled));
       return {
@@ -353,19 +651,6 @@ export async function dispatchPostAdmissionTurn<
       };
     }
 
-    if (adapters.trySettleSecondary !== undefined) {
-      const secondary = await adapters.trySettleSecondary(admitted, env.principalAuthority);
-      if (secondary !== undefined) {
-        await markRunTerminal(admitted.runDirectory);
-        presentSecondaryTerminal(secondary, io);
-        return {
-          exitCode: exitCodeForTerminalOutcome(secondary.roleOutcome),
-          admitted,
-          terminal: secondary as unknown as T,
-        };
-      }
-    }
-
     const sessionFile =
       admitted.principal !== undefined
         ? env.principalAuthority.decode(admitted.principal).sessionFile
@@ -385,14 +670,20 @@ export async function dispatchPostAdmissionTurn<
       credential: credentialFailure,
       runDirectory: admitted.runDirectory,
     });
+    const hostFailureInput: ControlledFailureInput = {
+      timedOut: result.timedOut,
+      code: result.code,
+      stderr: result.stderr,
+      ...controlledFailureInputFromResolution(resolution),
+    };
     return (await presentControlledFailure(
       admitted,
-      {
-        timedOut: result.timedOut,
-        code: result.code,
-        stderr: result.stderr,
-        ...controlledFailureInputFromResolution(resolution),
-      },
+      lastHostWriteFailure === undefined
+        ? hostFailureInput
+        : withLastHostWriteConcurrentFailure(
+            hostFailureInput,
+            lastHostWriteFailure.error,
+          ),
       adapters,
       env.principalAuthority,
       io,