@akagilnc/pi-workflow-roles 0.1.3414 → 0.1.3439

package/dist/grok/production-host.js

@@ -348,6 +348,26 @@ var init_activation_ledger_topology = __esm({
   }
 });
 
+// src/archivist-record-topology.ts
+import { createHash as createHash4 } from "node:crypto";
+import { join as join5 } from "node:path";
+function subjectKeyedRecordDirectory(input) {
+  const ledgerHome = input.parentSessionFile !== void 0 && input.parentSessionFile.length > 0 ? resolveActivationLedgerHomeForPath(input.parentSessionFile) : resolveActivationLedgerHome(input.home);
+  const digest = createHash4("sha256").update(input.subject).digest("hex").slice(0, 32);
+  return join5(
+    activationBookDirectory(ledgerHome, resolveBookKeyFromGit(input.cwd)),
+    input.kind,
+    digest
+  );
+}
+var init_archivist_record_topology = __esm({
+  "src/archivist-record-topology.ts"() {
+    "use strict";
+    init_activation_ledger_git();
+    init_activation_ledger_topology();
+  }
+});
+
 // src/upstream-error-testimony.ts
 function isNonSuccessHttpStatus(status) {
   return typeof status === "number" && (status < 200 || status >= 300);
@@ -373,14 +393,15 @@ var init_upstream_error_testimony = __esm({
 var archivist_record_entry_exports = {};
 __export(archivist_record_entry_exports, {
   WORKER_SUBMISSION_GATE_KIND: () => WORKER_SUBMISSION_GATE_KIND,
-  createRecordSession: () => createRecordSession
+  createRecordSession: () => createRecordSession,
+  createRecordSessionOpen: () => createRecordSessionOpen,
+  subjectKeyedRecordDirectory: () => subjectKeyedRecordDirectory
 });
-import { createHash as createHash4 } from "node:crypto";
 import { existsSync as existsSync5, readFileSync as readFileSync2, realpathSync as realpathSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname8, resolve as resolve6, join as join10 } from "node:path";
+import { dirname as dirname8, resolve as resolve6, join as join12 } from "node:path";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
 function readCurrentSession(sessionDir) {
-  const ledger = join10(sessionDir, CURRENT_SESSION_LEDGER);
+  const ledger = join12(sessionDir, CURRENT_SESSION_LEDGER);
   try {
     const value = JSON.parse(readFileSync2(ledger, "utf8"));
     if (typeof value !== "object" || value === null || typeof value.sessionFile !== "string" || value.sessionFile.length === 0) {
@@ -395,7 +416,7 @@ function readCurrentSession(sessionDir) {
   }
 }
 function writeCurrentSession(sessionDir, sessionFile) {
-  const ledger = join10(sessionDir, CURRENT_SESSION_LEDGER);
+  const ledger = join12(sessionDir, CURRENT_SESSION_LEDGER);
   try {
     writeFileSync3(ledger, `${JSON.stringify({ sessionFile })}
 `, { flag: "wx" });
@@ -438,25 +459,25 @@ function assertRecentFinalFileUnderSessionDir(sessionDir, recentFile) {
     );
   }
 }
-function createRecordSession(options) {
+function createRecordSessionOpen(options) {
   const cwd = options.cwd;
   const parentFile = options.parent?.getSessionFile();
   const ledgerHome = resolveActivationLedgerHomeForPath(parentFile);
   let sessionDir;
   let parentSession;
   if (options.subject !== void 0) {
-    const digest = createHash4("sha256").update(options.subject).digest("hex").slice(0, 32);
-    sessionDir = join10(
-      activationBookDirectory(ledgerHome, resolveBookKeyFromGit(cwd)),
-      options.kind,
-      digest
-    );
+    sessionDir = subjectKeyedRecordDirectory({
+      cwd,
+      kind: options.kind,
+      subject: options.subject,
+      ...parentFile === void 0 || parentFile.length === 0 ? {} : { parentSessionFile: parentFile }
+    });
     parentSession = parentFile && parentFile.length > 0 ? parentFile : void 0;
   } else if (parentFile === void 0 || parentFile.length === 0) {
-    return SessionManager.inMemory(cwd);
+    return { session: SessionManager.inMemory(cwd), resumed: false };
   } else {
     const parentResolved = resolve6(parentFile);
-    sessionDir = physicallyContainedIn(ledgerHome, parentResolved) ? join10(dirname8(parentResolved), options.kind) : join10(activationBookDirectory(ledgerHome, resolveBookKeyFromGit(cwd)), options.kind);
+    sessionDir = physicallyContainedIn(ledgerHome, parentResolved) ? join12(dirname8(parentResolved), options.kind) : join12(activationBookDirectory(ledgerHome, resolveBookKeyFromGit(cwd)), options.kind);
     parentSession = parentFile;
   }
   const nestAlreadyExists = existsSync5(sessionDir);
@@ -465,7 +486,10 @@ function createRecordSession(options) {
   if (mayResumeSameNest && nestAlreadyExists) {
     const recentFile = readCurrentSession(sessionDir);
     assertRecentFinalFileUnderSessionDir(sessionDir, recentFile);
-    return SessionManager.open(recentFile, sessionDir, cwd);
+    return {
+      session: SessionManager.open(recentFile, sessionDir, cwd),
+      resumed: true
+    };
   }
   const session = SessionManager.create(
     cwd,
@@ -486,7 +510,10 @@ function createRecordSession(options) {
       writeCurrentSession(sessionDir, file);
     }
   }
-  return session;
+  return { session, resumed: false };
+}
+function createRecordSession(options) {
+  return createRecordSessionOpen(options).session;
 }
 var CURRENT_SESSION_LEDGER, WORKER_SUBMISSION_GATE_KIND;
 var init_archivist_record_entry = __esm({
@@ -494,6 +521,8 @@ var init_archivist_record_entry = __esm({
     "use strict";
     init_activation_ledger_git();
     init_activation_ledger_topology();
+    init_archivist_record_topology();
+    init_archivist_record_topology();
     CURRENT_SESSION_LEDGER = "current-session.json";
     WORKER_SUBMISSION_GATE_KIND = "worker-submission-gate";
   }
@@ -575,7 +604,7 @@ __export(in_process_session_exports, {
 });
 import { mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join13 } from "node:path";
 import {
   createAgentSession,
   DefaultResourceLoader,
@@ -698,7 +727,7 @@ async function openPiInstitutionalSession(options) {
   let scratchDir;
   let resolvedAgentDir = options.agentDir;
   if (resolvedAgentDir === void 0) {
-    scratchDir = await mkdtemp2(join11(options.credentialScratchParent ?? tmpdir2(), "ak-institutional-"));
+    scratchDir = await mkdtemp2(join13(options.credentialScratchParent ?? tmpdir2(), "ak-institutional-"));
     resolvedAgentDir = scratchDir;
   }
   try {
@@ -1216,8 +1245,8 @@ var init_in_process_session = __esm({
 });
 
 // src/grok/production-host.ts
-import { readFile as readFile15, rm as rm6, writeFile as writeFile10 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { readFile as readFile16, rm as rm6, writeFile as writeFile11 } from "node:fs/promises";
+import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/canonical-skill-binding.ts
@@ -3105,7 +3134,7 @@ import { Type as Type13 } from "typebox";
 // src/evidence-child-executor.ts
 import { mkdtemp as mkdtemp3, rm as rm3 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join14 } from "node:path";
 import "@earendil-works/pi-ai";
 
 // src/sitian-appender.ts
@@ -3388,14 +3417,79 @@ function sitianReport(input) {
   return appendSitianRecord(input);
 }
 
+// src/ticket-seat-memory.ts
+import { readFile as readFile4, writeFile } from "node:fs/promises";
+import { join as join6 } from "node:path";
+init_activation_ledger_topology();
+init_archivist_record_topology();
+var TICKET_SEAT_MEMORY_KIND = "auditor-roles";
+var TICKET_SEAT_MEMORY_SEATS = ["inspector", "notary", "auditor"];
+function isTicketSeatMemorySeat(value) {
+  return TICKET_SEAT_MEMORY_SEATS.includes(value);
+}
+function isEnoent(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function ticketSeatMemorySubject(ticketNumber, seat) {
+  if (!Number.isSafeInteger(ticketNumber) || ticketNumber < 1) {
+    throw new Error(
+      `ticket-seat memory subject requires a positive ticket number, got ${String(ticketNumber)}`
+    );
+  }
+  return `${ticketNumber}:${seat}`;
+}
+async function readRunAdmittedPageFacts(runDirectory) {
+  try {
+    const raw = JSON.parse(
+      await readFile4(join6(runDirectory, "admitted-request.json"), "utf8")
+    );
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      return {};
+    }
+    const record4 = raw;
+    const ticketNumber = record4.ticketNumber;
+    const projectRoot = record4.projectRoot;
+    return {
+      ...typeof ticketNumber === "number" && Number.isSafeInteger(ticketNumber) && ticketNumber >= 1 ? { ticketNumber } : {},
+      ...typeof projectRoot === "string" ? { projectRoot } : {}
+    };
+  } catch (error) {
+    if (isEnoent(error)) return {};
+    throw error;
+  }
+}
+async function readInvocationTicketNumber(runDirectory) {
+  try {
+    const raw = JSON.parse(
+      await readFile4(join6(runDirectory, "invocation.json"), "utf8")
+    );
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      return void 0;
+    }
+    const ticketNumber = raw.ticketNumber;
+    if (typeof ticketNumber === "number" && Number.isSafeInteger(ticketNumber) && ticketNumber >= 1) {
+      return ticketNumber;
+    }
+  } catch (error) {
+    if (isEnoent(error)) return void 0;
+    throw error;
+  }
+  return void 0;
+}
+async function readRunTicketNumber(runDirectory) {
+  const admitted = await readRunAdmittedPageFacts(runDirectory);
+  if (admitted.ticketNumber !== void 0) return admitted.ticketNumber;
+  return readInvocationTicketNumber(runDirectory);
+}
+
 // src/engine-detour-tool.ts
 import { Type as Type11 } from "typebox";
 
 // src/engine-detour.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, rm, writeFile as writeFile2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
 var ENGINE_DETOUR_TOOL_NAME = "ak_engine_detour";
 var AK_ROLE_ENGINE_ENV = "AK_ROLE_ENGINE";
 var ENGINE_DETOUR_STAGED_PROMPT_TOKEN = "<<ak-engine-staged-prompt>>";
@@ -3486,12 +3580,12 @@ async function runEngineDetourOnce(input) {
   if (input.stagedPrompt === void 0) {
     return spawnEngineDetourOnce(input);
   }
-  const stagingDir = await mkdtemp(join5(tmpdir(), "ak-engine-detour-"));
-  const stagedPath = join5(stagingDir, "prompt.txt");
+  const stagingDir = await mkdtemp(join7(tmpdir(), "ak-engine-detour-"));
+  const stagedPath = join7(stagingDir, "prompt.txt");
   let result2;
   let runError;
   try {
-    await writeFile(stagedPath, input.stagedPrompt, "utf8");
+    await writeFile2(stagedPath, input.stagedPrompt, "utf8");
     const argv = resolveArgvWithStagedPrompt(input.argv, stagedPath);
     result2 = await spawnEngineDetourOnce({
       argv,
@@ -3623,7 +3717,7 @@ function registerEngineDetourTool(roleHost, hostActions) {
 
 // src/package-resources/engine-material.ts
 import { existsSync as existsSync4, readdirSync } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join8 } from "node:path";
 var ENGINE_MATERIAL_RELATIVE_ROOT = "resources/engines";
 function isEngineNameSyntax(name) {
   if (typeof name !== "string") return false;
@@ -3633,11 +3727,11 @@ function isEngineNameSyntax(name) {
   return true;
 }
 function resolveEngineMaterialDirectory(packageRoot) {
-  return join6(packageRoot, ENGINE_MATERIAL_RELATIVE_ROOT);
+  return join8(packageRoot, ENGINE_MATERIAL_RELATIVE_ROOT);
 }
 function resolveEngineMaterialPath(packageRoot, name) {
   const legal = assertLegalEngineName(name);
-  return join6(resolveEngineMaterialDirectory(packageRoot), `${legal}.md`);
+  return join8(resolveEngineMaterialDirectory(packageRoot), `${legal}.md`);
 }
 function assertLegalEngineName(name) {
   if (!isEngineNameSyntax(name)) {
@@ -3674,8 +3768,8 @@ function appendEngineSessionMaterial(lines, engineMaterial) {
 }
 
 // src/institutional-resolution.ts
-import { readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join9 } from "node:path";
 
 // src/public-cli/registry.ts
 var PUBLIC_CALLABLE_ROLES = PACKAGED_ROLE_REGISTRY.map(
@@ -3705,10 +3799,10 @@ function cleanSelection(model) {
   };
 }
 async function readInstitutionalSeatSelection(runDirectory, seat) {
-  const filePath = join7(runDirectory, INSTITUTIONAL_RESOLUTION_FILE);
+  const filePath = join9(runDirectory, INSTITUTIONAL_RESOLUTION_FILE);
   let raw;
   try {
-    raw = await readFile4(filePath, "utf8");
+    raw = await readFile5(filePath, "utf8");
   } catch (error) {
     throw new InstitutionalResolutionError(
       `institutional resolution page is missing at ${filePath}`,
@@ -3750,9 +3844,9 @@ async function readInstitutionalSeatSelection(runDirectory, seat) {
 }
 
 // src/navigator-session-contracts.ts
-import { mkdir, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
+import { mkdir, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname7, join as join8 } from "node:path";
+import { dirname as dirname7, join as join10 } from "node:path";
 import { Type as Type12 } from "typebox";
 import { Value as Value2 } from "typebox/value";
 var NAVIGATOR_PREPARE_TOOL_NAME = "ak_navigator_prepare";
@@ -3867,11 +3961,11 @@ var navigatorProviderFailureSchema = Type12.Object({
   ])
 }, { additionalProperties: false });
 function navigatorModelSettingPath() {
-  return join8(process.env.PI_CODING_AGENT_DIR ?? join8(homedir2(), ".pi", "agent"), "navigator-model.json");
+  return join10(process.env.PI_CODING_AGENT_DIR ?? join10(homedir2(), ".pi", "agent"), "navigator-model.json");
 }
 async function readNavigatorModelSetting(path = navigatorModelSettingPath()) {
   try {
-    const raw = JSON.parse(await readFile5(path, "utf8"));
+    const raw = JSON.parse(await readFile6(path, "utf8"));
     if (!exactRecord(raw) || typeof raw.model !== "string" || raw.model.trim() === "") {
       throw new Error("Navigator model setting is malformed");
     }
@@ -3998,11 +4092,11 @@ function createReceiptDeliveryPolicy() {
 }
 
 // src/typed-provider-http.ts
-import { readFile as readFile6, unlink, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile7, unlink, writeFile as writeFile5 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 var TYPED_HTTP_FILE = "typed-provider-http.json";
 function typedProviderHttpPath(runDirectory) {
-  return join9(runDirectory, TYPED_HTTP_FILE);
+  return join11(runDirectory, TYPED_HTTP_FILE);
 }
 async function clearTypedProviderHttpObservation(runDirectory) {
   try {
@@ -4023,7 +4117,7 @@ async function recordTypedProviderHttpStatus(runDirectory, observation) {
     httpStatus: observation.httpStatus,
     provider: observation.provider
   };
-  await writeFile4(
+  await writeFile5(
     typedProviderHttpPath(runDirectory),
     `${JSON.stringify(body)}
 `,
@@ -4044,7 +4138,7 @@ async function buildEvidenceChildSystemPrompt(engineMaterial) {
   return appendEngineSessionMaterial(materials, engineMaterial).join("\n");
 }
 async function withInProcessScratch(options, run) {
-  const scratch = await mkdtemp3(join12(options.parentDirectory ?? tmpdir3(), options.prefix));
+  const scratch = await mkdtemp3(join14(options.parentDirectory ?? tmpdir3(), options.prefix));
   let failure2;
   try {
     return await run(scratch);
@@ -4324,9 +4418,12 @@ async function executeAuditorChild(options) {
     const parentHeader = parentSessionManager?.getHeader?.();
     const parentSessionFile = parentSessionManager?.getSessionFile?.();
     const parentAttemptEntryId = parentSessionManager?.getLeafId?.();
+    const ticketNumber = await readRunTicketNumber(runDirectory);
+    const memorySubject = ticketNumber !== void 0 && isTicketSeatMemorySeat(seat) ? ticketSeatMemorySubject(ticketNumber, seat) : void 0;
     const auditorSessionManager = createRecordSession2({
       cwd,
-      kind: "auditor-roles",
+      kind: TICKET_SEAT_MEMORY_KIND,
+      ...memorySubject === void 0 ? {} : { subject: memorySubject },
       ...parentSessionManager === void 0 ? {} : { parent: parentSessionManager }
     });
     const { openPiInstitutionalSession: openPiInstitutionalSession2 } = await Promise.resolve().then(() => (init_in_process_session(), in_process_session_exports));
@@ -4985,7 +5082,7 @@ function createPiDoctorAuditor() {
 }
 
 // src/doctor-evidence.ts
-import { readdir, readFile as readFile7, realpath as realpath2, stat } from "node:fs/promises";
+import { readdir, readFile as readFile8, realpath as realpath2, stat } from "node:fs/promises";
 import { dirname as dirname9, relative as relative2, resolve as resolve8, sep as sep2 } from "node:path";
 
 // src/audit-escalation.ts
@@ -5387,7 +5484,7 @@ async function loadDoctorCase(runsPath) {
   const turns = { count: 0, sources: [] }, calls = { count: 0, sources: [] }, tokens = { count: 0, sources: [] };
   for (const path of await discoverCaseFiles(root)) {
     const id = relative2(root, path).split(sep2).join("/");
-    const bytes = await readFile7(path);
+    const bytes = await readFile8(path);
     const content = bytes.toString("utf8");
     const kind = id.endsWith(".jsonl") ? "session" : "stderr";
     evidence.push({ id, kind, byteLength: bytes.byteLength, contentLength: content.length, sha256: sha256Hex(bytes), content });
@@ -6398,23 +6495,23 @@ ${helpContext}
 }
 
 // src/navigator-work-context.ts
-import { readFile as readFile11 } from "node:fs/promises";
+import { readFile as readFile12 } from "node:fs/promises";
 import { resolve as resolve13 } from "node:path";
 
 // src/notary-source-run.ts
 init_activation_ledger_git();
 init_activation_ledger_topology();
-import { dirname as dirname11, isAbsolute as isAbsolute4, join as join16, resolve as resolve12, basename as basename5 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute4, join as join18, resolve as resolve12, basename as basename5 } from "node:path";
 import { lstat as lstat2, realpath as realpath4 } from "node:fs/promises";
 
 // src/public-cli/run-lifecycle.ts
 init_activation_ledger_topology();
-import { chmod, open, readdir as readdir2, readFile as readFile10, unlink as unlink2, writeFile as writeFile6 } from "node:fs/promises";
-import { join as join15 } from "node:path";
+import { chmod, open, readdir as readdir2, readFile as readFile11, unlink as unlink2, writeFile as writeFile7 } from "node:fs/promises";
+import { join as join17 } from "node:path";
 
 // src/collector-config.ts
 import { createHash as createHash6 } from "node:crypto";
-import { readFile as readFile8 } from "node:fs/promises";
+import { readFile as readFile9 } from "node:fs/promises";
 var COLLECTOR_HOST = "github.com";
 var COLLECTOR_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
 var COLLECTOR_REPO_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,98}[A-Za-z0-9])?$/;
@@ -6461,7 +6558,7 @@ function emptyCollectorManifest() {
 async function loadCollectorManifest(path) {
   let bytes;
   try {
-    bytes = await readFile8(path);
+    bytes = await readFile9(path);
   } catch (error) {
     fail3(`Collector request manifest is unreadable at ${path}`, error);
   }
@@ -6492,11 +6589,11 @@ init_activation_ledger_git();
 import {
   lstat,
   mkdir as mkdir2,
-  readFile as readFile9,
+  readFile as readFile10,
   realpath as realpath3,
-  writeFile as writeFile5
+  writeFile as writeFile6
 } from "node:fs/promises";
-import { basename as basename4, isAbsolute as isAbsolute3, join as join14, resolve as resolve11, sep as sep3 } from "node:path";
+import { basename as basename4, isAbsolute as isAbsolute3, join as join16, resolve as resolve11, sep as sep3 } from "node:path";
 
 // src/public-cli/option-definitions.ts
 var SHARED_PROJECT_SEMANTICS = {
@@ -6959,7 +7056,7 @@ var PUBLIC_COMMAND_HELP = {
 async function loadAdmittedJudgeRequest(runDirectory) {
   try {
     const raw = JSON.parse(
-      await readFile9(join14(runDirectory, "admitted-request.json"), "utf8")
+      await readFile10(join16(runDirectory, "admitted-request.json"), "utf8")
     );
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
     const record4 = raw;
@@ -6986,7 +7083,7 @@ function isV1ResumableProvider(provider) {
 async function readRoleRunStateDisk(runDirectory) {
   let raw;
   try {
-    raw = JSON.parse(await readFile10(join15(runDirectory, RUN_STATE_FILE), "utf8"));
+    raw = JSON.parse(await readFile11(join17(runDirectory, RUN_STATE_FILE), "utf8"));
   } catch {
     return void 0;
   }
@@ -7127,7 +7224,7 @@ function navigatorInputReference(getFlag, role) {
 }
 async function loadNavigatorWorkContext(options) {
   const reference = navigatorInputReference(options.getFlag, options.role);
-  const input = reference === void 0 || options.role === "doctor" || options.role === "notary" ? void 0 : await readFile11(reference, "utf8");
+  const input = reference === void 0 || options.role === "doctor" || options.role === "notary" ? void 0 : await readFile12(reference, "utf8");
   const subjectRoot = subjectPath(reference ?? options.context.sessionManager.getSessionDir(), options.context.cwd);
   let subjectKey = reference === void 0 ? subjectRoot : navigatorSubjectKeyForInput(subjectRoot, reference, options.context.cwd);
   let subject = input ?? `work subject: ${subjectKey}`;
@@ -7184,7 +7281,7 @@ async function loadNavigatorWorkContext(options) {
   let authorityMaterial;
   for (const path of authorityFiles) {
     try {
-      const content = await readFile11(path, "utf8");
+      const content = await readFile12(path, "utf8");
       if (content.trim() !== "") {
         authorityMaterial = content;
         break;
@@ -7210,8 +7307,8 @@ import { dirname as dirname12 } from "node:path";
 
 // src/package-resources/method-skill.ts
 import { createHash as createHash7 } from "node:crypto";
-import { readFile as readFile12, realpath as realpath5 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { readFile as readFile13, realpath as realpath5 } from "node:fs/promises";
+import { join as join19 } from "node:path";
 var PackagedMethodSkillUnavailableError = class extends Error {
   constructor(skillName, path, cause) {
     super(`Canonical ${skillName} Skill is unavailable at ${path}`, { cause });
@@ -7247,10 +7344,10 @@ function packagedMethodSkillRelativeDirectory(name) {
   return `${METHOD_SKILL_RELATIVE_ROOT}/${name}`;
 }
 function resolvePackagedMethodSkillRoot(packageRoot, name) {
-  return join17(packageRoot, packagedMethodSkillRelativeDirectory(name));
+  return join19(packageRoot, packagedMethodSkillRelativeDirectory(name));
 }
 function resolvePackagedMethodSkillPath(packageRoot, name) {
-  return join17(resolvePackagedMethodSkillRoot(packageRoot, name), "SKILL.md");
+  return join19(resolvePackagedMethodSkillRoot(packageRoot, name), "SKILL.md");
 }
 function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -7344,11 +7441,11 @@ function parseProvenance(raw, expectedName) {
 }
 async function loadPackagedMethodSkillMaterial(packageRoot, name) {
   const rootDirectory = resolvePackagedMethodSkillRoot(packageRoot, name);
-  const skillPathConfigured = join17(rootDirectory, "SKILL.md");
-  const provenancePath = join17(rootDirectory, "provenance.json");
+  const skillPathConfigured = join19(rootDirectory, "SKILL.md");
+  const provenancePath = join19(rootDirectory, "provenance.json");
   let provenanceRaw;
   try {
-    provenanceRaw = await readFile12(provenancePath, "utf8");
+    provenanceRaw = await readFile13(provenancePath, "utf8");
   } catch (error) {
     throw new PackagedMethodSkillUnavailableError(name, provenancePath, error);
   }
@@ -7362,10 +7459,10 @@ async function loadPackagedMethodSkillMaterial(packageRoot, name) {
   }
   const provenance = parseProvenance(provenanceJson, name);
   for (const [rel, expected] of Object.entries(provenance.files)) {
-    const absolute = join17(rootDirectory, rel);
+    const absolute = join19(rootDirectory, rel);
     let bytes;
     try {
-      bytes = await readFile12(absolute);
+      bytes = await readFile13(absolute);
     } catch (error) {
       throw new PackagedMethodSkillUnavailableError(name, absolute, error);
     }
@@ -7381,7 +7478,7 @@ async function loadPackagedMethodSkillMaterial(packageRoot, name) {
   let raw;
   try {
     skillPath = await realpath5(skillPathConfigured);
-    raw = await readFile12(skillPath, "utf8");
+    raw = await readFile13(skillPath, "utf8");
   } catch (error) {
     throw new PackagedMethodSkillUnavailableError(name, skillPathConfigured, error);
   }
@@ -7475,7 +7572,7 @@ async function executeReviewerChild(workspace, leg, context, options = {}) {
 import { spawn as spawn3 } from "node:child_process";
 import { mkdtemp as mkdtemp4, rm as rm4 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join20 } from "node:path";
 
 // src/reviewer-git-snapshot.ts
 var REVIEW_REF_PREFIXES = ["refs/heads", "refs/tags", "refs/remotes"];
@@ -7576,8 +7673,8 @@ async function prepareSnapshot(accepted, signal, dependencies) {
     if (!sameReviewerPinnedTarget({ repositoryRoot: accepted.repositoryRoot, objectFormat, targetHead }, accepted)) throw new Error("Accepted Reviewer target identity no longer matches the repository");
     await git2(accepted.repositoryRoot, ["cat-file", "-e", `${targetHead}^{commit}`], signal);
     dependencies.fault?.("mirror.before-create");
-    mirrorRoot = await mkdtemp4(join18(tmpdir4(), "ak-reviewer-snapshot-"));
-    const mirrorPath = join18(mirrorRoot, "repository.git");
+    mirrorRoot = await mkdtemp4(join20(tmpdir4(), "ak-reviewer-snapshot-"));
+    const mirrorPath = join20(mirrorRoot, "repository.git");
     dependencies.fault?.("mirror.create");
     await runCommand("git", ["init", "--bare", `--object-format=${accepted.objectFormat}`, mirrorPath], signal === void 0 ? {} : { signal });
     await git2(mirrorPath, ["fetch", "--no-tags", accepted.repositoryRoot, targetHead], signal);
@@ -7594,7 +7691,7 @@ async function prepareClone(snapshot, signal, dependencies) {
   const target = { repositoryRoot: snapshot.repositoryRoot, objectFormat: snapshot.objectFormat, targetHead: snapshot.targetHead, refs: { ...snapshot.refs } };
   try {
     dependencies.fault?.("workspace.before-create");
-    workspace = await mkdtemp4(join18(tmpdir4(), "ak-reviewer-leg-"));
+    workspace = await mkdtemp4(join20(tmpdir4(), "ak-reviewer-leg-"));
     dependencies.fault?.("workspace.init");
     await git2(workspace, ["init", `--object-format=${snapshot.objectFormat}`, "--initial-branch=ak-reviewer-unborn"], signal);
     dependencies.fault?.("workspace.fetch");
@@ -7776,7 +7873,7 @@ function stringEnum(values, options = {}) {
 
 // src/public-cli/reviewer-dispatch-rejection.ts
 import { writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/adr-path-refs.ts
 var ADR_PATH_IN_BODY = /docs\/adr\/(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.md/g;
@@ -8375,7 +8472,7 @@ function createReviewerDispatcher(d) {
 // src/public-cli/reviewer-dispatch-rejection.ts
 var REVIEWER_DISPATCH_REJECTION_FILE = "typed-known-failure.json";
 function reviewerDispatchRejectionPath(runDirectory) {
-  return join19(runDirectory, REVIEWER_DISPATCH_REJECTION_FILE);
+  return join21(runDirectory, REVIEWER_DISPATCH_REJECTION_FILE);
 }
 function recordReviewerDispatchRejectionSync(runDirectory, rejection) {
   writeFileSync4(
@@ -8543,7 +8640,7 @@ async function requireGatekeeperPass(options) {
 }
 
 // src/run-terminal-artifacts.ts
-import { basename as basename6, dirname as dirname13, join as join20 } from "node:path";
+import { basename as basename6, dirname as dirname13, join as join22 } from "node:path";
 function runIdFromRunDirectory(runDirectory) {
   const name = basename6(runDirectory);
   const at = name.lastIndexOf("@");
@@ -13493,15 +13590,15 @@ function createRoleRuntimeExtension(dependencies) {
 
 // src/grok/role-envelope.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdir as mkdir5, readFile as readFile13, writeFile as writeFile8 } from "node:fs/promises";
+import { mkdir as mkdir5, readFile as readFile14, writeFile as writeFile9 } from "node:fs/promises";
 import { createServer } from "node:net";
-import { basename as basename8, dirname as dirname16, join as join23 } from "node:path";
+import { basename as basename8, dirname as dirname16, join as join25 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/grok/role-turn-host.ts
 import { execFile as execFile3, spawn as spawn4 } from "node:child_process";
 import { copyFile, lstat as lstat3, mkdir as mkdir4, open as open2, realpath as realpath7, rm as rm5 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname15, isAbsolute as isAbsolute7, join as join22, relative as pathRelative } from "node:path";
+import { basename as basename7, dirname as dirname15, isAbsolute as isAbsolute7, join as join24, relative as pathRelative } from "node:path";
 import { createInterface } from "node:readline";
 import { promisify as promisify3 } from "node:util";
 
@@ -13512,8 +13609,8 @@ function renderAgentStartMaterials(body, materials) {
 }
 
 // src/grok/bash-seatbelt.ts
-import { mkdir as mkdir3, writeFile as writeFile7 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { mkdir as mkdir3, writeFile as writeFile8 } from "node:fs/promises";
+import { join as join23 } from "node:path";
 function renderGrokBashSeatbeltHookScript() {
   const reasons = Object.fromEntries(
     FIXER_BASH_FORBIDDEN_LITERALS.map((literal) => [literal, fixerBashSeatbeltDenyReason(literal)])
@@ -13541,12 +13638,12 @@ process.stdin.on("end", () => {
 `;
 }
 async function installGrokPreToolUseDeny(controlledHome) {
-  const hooksDir = join21(controlledHome, "hooks");
+  const hooksDir = join23(controlledHome, "hooks");
   await mkdir3(hooksDir, { recursive: true });
   const scriptName = "ak-bash-seatbelt.mjs";
-  const scriptPath = join21(hooksDir, scriptName);
-  await writeFile7(scriptPath, renderGrokBashSeatbeltHookScript(), { mode: 493 });
-  await writeFile7(join21(hooksDir, "ak-bash-seatbelt.json"), `${JSON.stringify({
+  const scriptPath = join23(hooksDir, scriptName);
+  await writeFile8(scriptPath, renderGrokBashSeatbeltHookScript(), { mode: 493 });
+  await writeFile8(join23(hooksDir, "ak-bash-seatbelt.json"), `${JSON.stringify({
     hooks: {
       PreToolUse: [
         {
@@ -13919,7 +14016,7 @@ async function resolveHeadTreePath(topLevel, relativePath) {
     encoding: "utf8"
   });
   const needle = leaf.toLowerCase();
-  const hits = listing.split("\n").map((name) => name.trim()).filter((name) => name !== "" && basename7(name).toLowerCase() === needle).map((name) => parent === "." ? basename7(name) : join22(parent, basename7(name)));
+  const hits = listing.split("\n").map((name) => name.trim()).filter((name) => name !== "" && basename7(name).toLowerCase() === needle).map((name) => parent === "." ? basename7(name) : join24(parent, basename7(name)));
   return hits.length === 1 ? hits[0] : void 0;
 }
 async function isHeadMatchedProjectInstruction(repositoryCwd, absolutePath) {
@@ -13937,14 +14034,14 @@ async function isHeadMatchedProjectInstruction(repositoryCwd, absolutePath) {
   if (parent === void 0) return false;
   const leaf = basename7(absolutePath);
   if (leaf === "" || leaf === "." || leaf === "..") return false;
-  const candidate = join22(parent, leaf);
+  const candidate = join24(parent, leaf);
   const relative3 = pathRelative(topLevel, candidate);
   if (relative3 === "" || relative3.startsWith("..") || isAbsolute7(relative3) || relative3.includes("\0")) {
     return false;
   }
   const headRel = await resolveHeadTreePath(topLevel, relative3);
   if (headRel === void 0) return false;
-  const headFile = join22(topLevel, headRel);
+  const headFile = join24(topLevel, headRel);
   const { stdout: headBlobOut } = await execFileAsync3(
     "git",
     ["rev-parse", "--verify", `HEAD:${headRel}`],
@@ -14043,20 +14140,20 @@ async function assertControlledGrokAuthIsNotSymlink(authPath) {
   }
 }
 async function scrubAkBashSeatbeltHooks(controlledHome) {
-  const hooksDir = join22(controlledHome, "hooks");
+  const hooksDir = join24(controlledHome, "hooks");
   for (const name of AK_BASH_SEATBELT_HOOK_FILES) {
-    await rm5(join22(hooksDir, name), { force: true });
+    await rm5(join24(hooksDir, name), { force: true });
   }
 }
 async function prepareControlledGrokHome(sourceHome, controlledHome) {
   await assertControlledGrokHomeIsRealDirectory(controlledHome);
   await mkdir4(controlledHome, { recursive: true, mode: 448 });
   await assertControlledGrokHomeIsRealDirectory(controlledHome);
-  const authPath = join22(controlledHome, "auth.json");
+  const authPath = join24(controlledHome, "auth.json");
   await assertControlledGrokAuthIsNotSymlink(authPath);
   await rm5(authPath, { force: true });
   await scrubAkBashSeatbeltHooks(controlledHome);
-  await copyFile(join22(sourceHome, ".grok", "auth.json"), authPath);
+  await copyFile(join24(sourceHome, ".grok", "auth.json"), authPath);
 }
 async function inspectControlledGrok(options) {
   const { stdout } = await execFileAsync3(options.binary, ["inspect", "--json"], {
@@ -14177,14 +14274,14 @@ async function prepareGrokRoleEnvelope(options) {
   for (const method of request.methods) {
     if (method.kind !== "skill") continue;
     const name = basename8(dirname16(method.path));
-    const raw = await readFile13(method.path, "utf8");
+    const raw = await readFile14(method.path, "utf8");
     methodSkills.set(name, { path: method.path, body: stripSkillFrontmatter(raw).trim() });
   }
-  let sessionFile = options.sessionFile ?? join23(request.runDirectory, "session", "session.jsonl");
+  let sessionFile = options.sessionFile ?? join25(request.runDirectory, "session", "session.jsonl");
   await mkdir5(dirname16(sessionFile), { recursive: true });
   if (request.continuation.kind !== "resume") {
     try {
-      await writeFile8(
+      await writeFile9(
         sessionFile,
         `${JSON.stringify({
           type: "session",
@@ -14592,7 +14689,7 @@ async function prepareGrokRoleEnvelope(options) {
         message: { role: "user", content: prompt }
       });
     }
-    const methodPrompt = (await Promise.all(request.methods.map(({ path }) => readFile13(path, "utf8")))).join("\n\n");
+    const methodPrompt = (await Promise.all(request.methods.map(({ path }) => readFile14(path, "utf8")))).join("\n\n");
     const promptResults = await emit("before_agent_start", {
       prompt,
       systemPrompt: methodPrompt,
@@ -14640,18 +14737,18 @@ async function prepareGrokRoleEnvelope(options) {
 }
 
 // src/grok/session-identity.ts
-import { mkdir as mkdir6, readFile as readFile14, rename, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname17, join as join24 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile15, rename, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname as dirname17, join as join26 } from "node:path";
 var GROK_ACP_SESSION_BINDING = "grok-acp-session.json";
 function createGrokSessionIdentityAuthority(authority) {
-  const bindingPath = (principal) => join24(authority.decode(principal).sessionDirectory, GROK_ACP_SESSION_BINDING);
+  const bindingPath = (principal) => join26(authority.decode(principal).sessionDirectory, GROK_ACP_SESSION_BINDING);
   return {
     resolveSessionFile(principal) {
       return authority.decode(principal).sessionFile;
     },
     async load(principal) {
       try {
-        const value = JSON.parse(await readFile14(bindingPath(principal), "utf8"));
+        const value = JSON.parse(await readFile15(bindingPath(principal), "utf8"));
         if (typeof value !== "object" || value === null || typeof value.sessionId !== "string") {
           throw new Error("durable Grok ACP session binding is invalid");
         }
@@ -14665,7 +14762,7 @@ function createGrokSessionIdentityAuthority(authority) {
       const target = bindingPath(principal);
       await mkdir6(dirname17(target), { recursive: true });
       const temporary = `${target}.${process.pid}.tmp`;
-      await writeFile9(temporary, `${JSON.stringify({ sessionId })}
+      await writeFile10(temporary, `${JSON.stringify({ sessionId })}
 `, { encoding: "utf8", mode: 384 });
       await rename(temporary, target);
     }
@@ -14674,7 +14771,7 @@ function createGrokSessionIdentityAuthority(authority) {
 
 // src/grok/production-host.ts
 function resolveGrokBinary(operatorHome) {
-  return join25(operatorHome, ".grok", "bin", "grok");
+  return join27(operatorHome, ".grok", "bin", "grok");
 }
 var NO_PRODUCTION_GROK_PRIMARY_FAILURE = {
   present: false
@@ -14682,7 +14779,7 @@ var NO_PRODUCTION_GROK_PRIMARY_FAILURE = {
 async function settleProductionGrokHomeCleanup(controlledHome, primaryFailure, concurrentMessage) {
   try {
     await assertControlledGrokHomeIsRealDirectory(controlledHome);
-    const authPath = join25(controlledHome, "auth.json");
+    const authPath = join27(controlledHome, "auth.json");
     await assertControlledGrokAuthIsNotSymlink(authPath);
     await rm6(authPath, { force: true });
     await scrubAkBashSeatbeltHooks(controlledHome);
@@ -14699,7 +14796,7 @@ async function settleProductionGrokHomeCleanup(controlledHome, primaryFailure, c
   }
 }
 async function openProductionGrokHome(runDirectory, operatorHome) {
-  const controlledHome = join25(runDirectory, "grok-home");
+  const controlledHome = join27(runDirectory, "grok-home");
   try {
     await prepareControlledGrokHome(operatorHome, controlledHome);
     return controlledHome;
@@ -14727,12 +14824,13 @@ async function bindProductionGrokIsolation(runDirectory, operatorHome, packageRo
     env: childEnv(controlledHome, packageRoot)
   };
 }
-async function withProductionGrokIsolation(runDirectory, operatorHome, packageRoot, run) {
+async function withProductionGrokIsolation(runDirectory, operatorHome, packageRoot, run, noteOpened) {
   let binding;
   let primaryFailure = NO_PRODUCTION_GROK_PRIMARY_FAILURE;
   let value;
   try {
     binding = await bindProductionGrokIsolation(runDirectory, operatorHome, packageRoot);
+    noteOpened?.(runDirectory);
     value = await run(binding);
   } catch (error) {
     primaryFailure = { present: true, value: error };
@@ -14758,9 +14856,9 @@ function createGrokRoleRuntimeDependencies(packageRoot) {
   return {
     loadJudgeSoul: () => loadMainRoleSessionMaterials("judge"),
     loadFixerSoul: () => loadMainRoleSessionMaterials("fixer"),
-    loadFixPacket: (path) => readFile15(path, "utf8"),
+    loadFixPacket: (path) => readFile16(path, "utf8"),
     loadCoderSoul: () => loadMainRoleSessionMaterials("coder"),
-    loadCoderTask: (path) => readFile15(path, "utf8"),
+    loadCoderTask: (path) => readFile16(path, "utf8"),
     loadReviewerSoul: () => loadMainRoleSessionMaterials("reviewer"),
     createReviewerPinnedGitReader: () => createReviewerPinnedGitReader(),
     createReviewerIssueFetcher: () => createGhIssueSoftFetcher(),
@@ -14776,7 +14874,7 @@ function createGrokRoleRuntimeDependencies(packageRoot) {
     loadGleanerLeftSoul: () => loadMainRoleSessionMaterials("gleaner-left"),
     loadNotarySourceRun: loadNotarySourceRunLocator,
     loadMergerSoul: () => loadMainRoleSessionMaterials("merger"),
-    loadMergerInput: async (path) => JSON.parse(await readFile15(path, "utf8")),
+    loadMergerInput: async (path) => JSON.parse(await readFile16(path, "utf8")),
     createMergerGitState: (repositoryRoot) => createProductionMergerGitState(repositoryRoot),
     async loadCanonicalSkillBinding(name) {
       if (name === "tdd") {
@@ -14806,7 +14904,7 @@ function createGrokRoleRuntimeDependencies(packageRoot) {
       authority: options.authority,
       invocationId: options.invocationId,
       loadSoul: () => loadMainRoleSessionMaterials("navigator"),
-      loadRoutePlaybook: () => readFile15(navigatorRoutePlaybookPath, "utf8"),
+      loadRoutePlaybook: () => readFile16(navigatorRoutePlaybookPath, "utf8"),
       loadRoleHelp: async (role) => formatNavigatorRoleHelp(role),
       createSession: navigatorSessionFactory,
       ...options.contextError === void 0 ? {} : { contextError: options.contextError },
@@ -14815,13 +14913,19 @@ function createGrokRoleRuntimeDependencies(packageRoot) {
   };
 }
 async function recordGrokCapabilities(request, declaration) {
-  await writeFile10(
-    join25(request.runDirectory, "grok-capabilities.json"),
+  await writeFile11(
+    join27(request.runDirectory, "grok-capabilities.json"),
     `${JSON.stringify(declaration)}
 `,
     "utf8"
   );
 }
+function resolveProductionGrokIsolationRunDirectory(request) {
+  if (request.continuation.kind === "resume" && typeof request.nativeHomeRunDirectory === "string" && request.nativeHomeRunDirectory.length > 0) {
+    return request.nativeHomeRunDirectory;
+  }
+  return request.runDirectory;
+}
 function createProductionGrokRoleTurnHost(options) {
   const { packageRoot, principalAuthority } = options;
   let turn;
@@ -14855,15 +14959,22 @@ function createProductionGrokRoleTurnHost(options) {
   });
   return {
     executeTurn(request) {
+      const isolationRunDirectory = resolveProductionGrokIsolationRunDirectory(request);
       const execution = serial.then(
-        () => withProductionGrokIsolation(request.runDirectory, request.home, packageRoot, async (binding) => {
-          turn = binding;
-          try {
-            return await inner.executeTurn({ ...request, home: binding.controlledHome });
-          } finally {
-            turn = void 0;
-          }
-        })
+        () => withProductionGrokIsolation(
+          isolationRunDirectory,
+          request.home,
+          packageRoot,
+          async (binding) => {
+            turn = binding;
+            try {
+              return await inner.executeTurn({ ...request, home: binding.controlledHome });
+            } finally {
+              turn = void 0;
+            }
+          },
+          request.noteNativeHomeOpened
+        )
       );
       serial = execution.then(
         () => void 0,