@akagilnc/pi-workflow-roles 0.1.3414 → 0.1.3445

package/src/archivist-record-topology.ts

@@ -0,0 +1,39 @@
+/**
+ * Pure archivist record placement topology (ADR 0048 / 0065).
+ * No SessionManager / pi-coding-agent — cold public-bin and ledger discovery
+ * may import this without pulling open-session runtime into the graph.
+ */
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+
+import { resolveBookKeyFromGit } from "./activation-ledger-git.ts";
+import {
+  activationBookDirectory,
+  resolveActivationLedgerHome,
+  resolveActivationLedgerHomeForPath,
+} from "./activation-ledger-topology.ts";
+
+/**
+ * Sole subject-keyed nest path under the ledger book (ADR 0048 / 0065).
+ * Callers must not re-hash subject or re-join book/kind/digest themselves.
+ */
+export function subjectKeyedRecordDirectory(input: {
+  readonly cwd: string;
+  readonly kind: string;
+  readonly subject: string;
+  /** Parent session file — home path-derives from it when present. */
+  readonly parentSessionFile?: string;
+  /** Explicit process home when no parent file is available (discovery-only). */
+  readonly home?: string;
+}): string {
+  const ledgerHome =
+    input.parentSessionFile !== undefined && input.parentSessionFile.length > 0
+      ? resolveActivationLedgerHomeForPath(input.parentSessionFile)
+      : resolveActivationLedgerHome(input.home);
+  const digest = createHash("sha256").update(input.subject).digest("hex").slice(0, 32);
+  return join(
+    activationBookDirectory(ledgerHome, resolveBookKeyFromGit(input.cwd)),
+    input.kind,
+    digest,
+  );
+}

package/src/evidence-child-executor.ts

@@ -26,6 +26,12 @@ import {
 } from "./compliance-transport.ts";
 import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
 import { sitianReport } from "./sitian-facade.ts";
+import {
+  isTicketSeatMemorySeat,
+  readRunTicketNumber,
+  ticketSeatMemorySubject,
+  TICKET_SEAT_MEMORY_KIND,
+} from "./ticket-seat-memory.ts";
 import { createEngineDetourToolDefinition } from "./engine-detour-tool.ts";
 import { engineNameFromEnv } from "./engine-detour.ts";
 import {
@@ -564,9 +570,16 @@ export async function executeAuditorChild(
     const parentHeader = parentSessionManager?.getHeader?.();
     const parentSessionFile = parentSessionManager?.getSessionFile?.();
     const parentAttemptEntryId = parentSessionManager?.getLeafId?.();
+    // #636: ticket+seat subject resumes the same nest (navigator subject path); no ticket → fresh nest.
+    const ticketNumber = await readRunTicketNumber(runDirectory);
+    const memorySubject =
+      ticketNumber !== undefined && isTicketSeatMemorySeat(seat)
+        ? ticketSeatMemorySubject(ticketNumber, seat)
+        : undefined;
     const auditorSessionManager: SessionManager = createRecordSession({
       cwd,
-      kind: "auditor-roles",
+      kind: TICKET_SEAT_MEMORY_KIND,
+      ...(memorySubject === undefined ? {} : { subject: memorySubject }),
       ...(parentSessionManager === undefined ? {} : { parent: parentSessionManager }),
     });
 
@@ -962,7 +975,7 @@ export function createNativeNavigatorSessionFactory(
   return async ({ context, subject, modelSettingPath, tool }) => {
     const resolved = await resolveNavigatorSeatSelection(context, modelSettingPath, defaultModelSettingPath);
     let selection = resolved.selection;
-    let thinkingLevel = resolved.thinkingLevel;
+    let thinkingLevel: string | undefined = resolved.thinkingLevel;
     let configuredLabel = resolved.configuredLabel;
 
     const { createRecordSession } = await import("./archivist-record-entry.ts");
@@ -1104,7 +1117,7 @@ export function createNativeNavigatorSessionFactory(
         }
       },
       entries: () => sessionManager.getEntries(),
-      setModel: async (next, nextThinking) => {
+      setModel: async (next) => {
         let nextParsed: ReturnType<typeof parseNavigatorModelSetting>;
         try {
           nextParsed = parseNavigatorModelSetting(next);
@@ -1120,16 +1133,11 @@ export function createNativeNavigatorSessionFactory(
             `Navigator model switch requires a new session: ${configuredLabel} → ${next}`,
           );
         }
-        if (nextParsed.thinkingLevel !== nextThinking || thinkingLevel !== nextThinking) {
-          throw new NavigatorUnavailableError(
-            "thinking",
-            `Navigator thinking level ${nextThinking} is unavailable for ${next}`,
-          );
-        }
+        // Thinking is opaque pass-through; no stick/availability re-check.
         selection = {
           provider: nextParsed.provider,
           model: nextParsed.model,
-          thinking: nextParsed.thinkingLevel,
+          ...(nextParsed.thinkingLevel === undefined ? {} : { thinking: nextParsed.thinkingLevel }),
         };
         thinkingLevel = nextParsed.thinkingLevel;
         configuredLabel = next;

package/src/grok/production-host.ts

@@ -167,18 +167,25 @@ export async function bindProductionGrokIsolation(
  * while preserving the session dossier under runDirectory/grok-home. Success,
  * typed-result, and throw paths all clean up; cleanup failure and primary+cleanup
  * both surface.
+ *
+ * `noteOpened` fires only after bind succeeds — the actual open event, distinct
+ * from turn return/throw — so last-host ownership can retain the opened run
+ * even when the body or cleanup later throws (#636).
  */
 export async function withProductionGrokIsolation<T>(
   runDirectory: string,
   operatorHome: string,
   packageRoot: string,
   run: (binding: ProductionGrokIsolationBinding) => Promise<T>,
+  noteOpened?: (runDirectory: string) => void,
 ): Promise<T> {
   let binding: ProductionGrokIsolationBinding | undefined;
   let primaryFailure: ProductionGrokPrimaryFailure = NO_PRODUCTION_GROK_PRIMARY_FAILURE;
   let value!: T;
   try {
     binding = await bindProductionGrokIsolation(runDirectory, operatorHome, packageRoot);
+    // Open fact: bind succeeded under runDirectory. Not deferred to turn outcome.
+    noteOpened?.(runDirectory);
     value = await run(binding);
   } catch (error) {
     primaryFailure = { present: true, value: error };
@@ -278,6 +285,24 @@ async function recordGrokCapabilities(
   );
 }
 
+/**
+ * Which run directory owns GROK_HOME for this turn (#636 / ADR 0077).
+ * Same-host ticket-seat resume reopens the prior native home; otherwise the live run.
+ * Private to the production host — not a test seam.
+ */
+function resolveProductionGrokIsolationRunDirectory(
+  request: Pick<RoleTurnRequest, "runDirectory" | "continuation" | "nativeHomeRunDirectory">,
+): string {
+  if (
+    request.continuation.kind === "resume" &&
+    typeof request.nativeHomeRunDirectory === "string" &&
+    request.nativeHomeRunDirectory.length > 0
+  ) {
+    return request.nativeHomeRunDirectory;
+  }
+  return request.runDirectory;
+}
+
 /**
  * Assemble the production grok-build RoleTurnHost from the S6 true adapter.
  */
@@ -317,16 +342,26 @@ export function createProductionGrokRoleTurnHost(options: ProductionGrokHostOpti
 
   return {
     executeTurn(request) {
+      // #636 same-host ticket-seat resume: reopen the prior run's grok-home so
+      // session/load hits the ACP storage that bound the shared principal.
+      // Fresh runs and cross-host arrivals keep isolating under request.runDirectory.
+      const isolationRunDirectory = resolveProductionGrokIsolationRunDirectory(request);
       const execution = serial.then(() =>
-        withProductionGrokIsolation(request.runDirectory, request.home, packageRoot, async (binding) => {
-          turn = binding;
-          try {
-            // S6 seatbelt hangs on request.home — same isolated root as GROK_HOME.
-            return await inner.executeTurn({ ...request, home: binding.controlledHome });
-          } finally {
-            turn = undefined;
-          }
-        }),
+        withProductionGrokIsolation(
+          isolationRunDirectory,
+          request.home,
+          packageRoot,
+          async (binding) => {
+            turn = binding;
+            try {
+              // S6 seatbelt hangs on request.home — same isolated root as GROK_HOME.
+              return await inner.executeTurn({ ...request, home: binding.controlledHome });
+            } finally {
+              turn = undefined;
+            }
+          },
+          request.noteNativeHomeOpened,
+        ),
       );
       serial = execution.then(
         () => undefined,

package/src/host-contracts.ts

@@ -165,6 +165,19 @@ export type RoleTurnRequest = {
   readonly timeoutMs?: number;
   /** Set by post-admission only on a real host switch; never on same-host resume. */
   readonly hostTransition?: RoleTurnHostTransition;
+  /**
+   * Grok native isolation run for ticket-seat resume (#636 / ADR 0079):
+   * reopen grok-home under this prior run (ACP storage). Covers same-host,
+   * same-run retry after a new run, and return-to-Grok after another host.
+   * Absent → isolate under runDirectory. Never a cross-host byte handoff.
+   */
+  readonly nativeHomeRunDirectory?: string;
+  /**
+   * Production Grok isolation notes the actual open event here after bind succeeds
+   * (#636). Open is not the same event as turn return/throw — post-admission uses
+   * this fact for last-host ownership instead of inferring open from the turn outcome.
+   */
+  readonly noteNativeHomeOpened?: (runDirectory: string) => void;
 };
 
 /** Turn result — only fields upper layers currently consume. */
@@ -203,6 +216,11 @@ export type NewDurablePrincipalRequest = {
 /** Host authority for issuing, checking, and temporarily decoding durable principals. */
 export interface DurablePrincipalAuthority {
   issue(request: NewDurablePrincipalRequest): DurablePrincipal;
+  /**
+   * Host-owned seal of already-placed coordinates into a durable principal wire
+   * object. Public layers must not forge opaque principal shapes (#636).
+   */
+  seal(coordinates: DurablePrincipalCoordinates): DurablePrincipal;
   isAvailable(principal: DurablePrincipal): Promise<boolean>;
   decode(principal: unknown): DurablePrincipalCoordinates;
 }

package/src/host-transition-prior-native.ts

@@ -71,12 +71,18 @@ export async function listGrokNativeRecordPaths(runDirectory: string): Promise<s
  * Project one hostTransition only for a real switch between known hosts.
  * Unknown host names → undefined (no inject). Empty native volume still
  * yields a typed switch (empty path list).
+ *
+ * Grok native home lives under the run that wrote it. Ticket-seat memory
+ * cross-run switches pass `previousRunDirectory` from last-host metadata so
+ * the scan does not look at an empty fresh run (#636 / #617 DK-4).
  */
 export async function projectHostTransitionPriorNative(input: {
   readonly previousHost: string;
   readonly liveHost: string;
   readonly runDirectory: string;
   readonly piSessionFile: string;
+  /** Prior run that held Grok native records when principal continued across runs. */
+  readonly previousRunDirectory?: string;
 }): Promise<RoleTurnHostTransition | undefined> {
   if (input.previousHost === input.liveHost) return undefined;
   if (!isKnownRoleTurnHost(input.previousHost) || !isKnownRoleTurnHost(input.liveHost)) {
@@ -90,7 +96,8 @@ export async function projectHostTransitionPriorNative(input: {
     };
   }
   // previousHost === "grok-build": DK-7 path handoff only — do not read bytes.
-  const paths = await listGrokNativeRecordPaths(input.runDirectory);
+  const grokRoot = input.previousRunDirectory ?? input.runDirectory;
+  const paths = await listGrokNativeRecordPaths(grokRoot);
   return {
     previousHost: "grok-build",
     priorNativePaths: paths,

package/src/ledger-session-read.ts

@@ -258,3 +258,59 @@ export function extractSessionToolIntervals(
       : { ...base, endedAt: interval.endedAt };
   });
 }
+
+/**
+ * One binding-owned interval inside a continuous volume (#636):
+ * from the nearest preceding binding at-or-before `anchorIndex` through the
+ * row before the next binding (or EOF). Gate/settlement/analyst share this
+ * slice — do not fork a second interval scan.
+ *
+ * `closed` is true iff a later binding ended the interval before EOF of the
+ * provided rows. On a damaged prefix parse, closed intervals are fully owned
+ * by their run; open intervals (through prefix EOF) may have lost rows to the
+ * bad line and stay honest-missing for full span/tools.
+ */
+export type BindingInterval = {
+  readonly rows: readonly LedgerSessionRow[];
+  readonly closed: boolean;
+};
+
+export function intervalRowsAroundAnchor(
+  rows: readonly LedgerSessionRow[],
+  anchorIndex: number,
+  isBindingRow: (row: LedgerSessionRow) => boolean,
+): BindingInterval {
+  let start = 0;
+  for (let i = anchorIndex; i >= 0; i -= 1) {
+    if (isBindingRow(rows[i]!)) {
+      start = i;
+      break;
+    }
+  }
+  let end = rows.length;
+  for (let i = Math.max(anchorIndex, start) + 1; i < rows.length; i += 1) {
+    if (isBindingRow(rows[i]!)) {
+      end = i;
+      break;
+    }
+  }
+  return { rows: rows.slice(start, end), closed: end < rows.length };
+}
+
+/**
+ * Interval owned by the first binding row that satisfies `matches`.
+ * `undefined` when the volume carries no matching binding — callers must not
+ * silently treat the whole continuous volume as that owner.
+ */
+export function intervalRowsForMatchingBinding(
+  rows: readonly LedgerSessionRow[],
+  isBindingRow: (row: LedgerSessionRow) => boolean,
+  matches: (row: LedgerSessionRow) => boolean,
+): BindingInterval | undefined {
+  for (let i = 0; i < rows.length; i += 1) {
+    const row = rows[i]!;
+    if (!isBindingRow(row) || !matches(row)) continue;
+    return intervalRowsAroundAnchor(rows, i, isBindingRow);
+  }
+  return undefined;
+}

package/src/navigator-attendance.ts

@@ -648,9 +648,6 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
           try {
             await created.setModel?.(modelSetting, model.thinkingLevel);
             if (disposed) throw navigatorUnavailableError("session", new Error("Navigator attendance was disposed"));
-            if (created.getThinkingLevel?.() !== undefined && created.getThinkingLevel() !== model.thinkingLevel) {
-              throw new NavigatorUnavailableError("thinking", `Navigator thinking level ${model.thinkingLevel} is unavailable for ${modelSetting}`);
-            }
             created.appendEntry(INVOCATION_ENTRY, { invocationId, role: options.role, phase: options.phase, subjectKey });
             if (disposed) throw navigatorUnavailableError("session", new Error("Navigator attendance was disposed"));
             session = created;
@@ -665,9 +662,6 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
       } else {
         try {
           await session.setModel?.(modelSetting, model.thinkingLevel);
-          if (session.getThinkingLevel?.() !== undefined && session.getThinkingLevel() !== model.thinkingLevel) {
-            throw new NavigatorUnavailableError("thinking", `Navigator thinking level ${model.thinkingLevel} is unavailable for ${modelSetting}`);
-          }
         } catch (error) {
           // Contract: README.md#Navigator-attendance — resumed-session configuration failures remain typed unavailable and retain the original cause.
           throw error instanceof NavigatorUnavailableError ? error : navigatorUnavailableError("session", error);

package/src/navigator-session-contracts.ts

@@ -162,8 +162,8 @@ export type NavigatorPreparationSession = {
   appendEntry(customType: string, data: unknown): void;
   entries(): readonly unknown[];
   providerFailure?(): NavigatorProviderFailureFact | undefined;
-  setModel?(model: string, thinkingLevel: "off" | "max"): Promise<void>;
-  getThinkingLevel?(): string;
+  setModel?(model: string, thinkingLevel?: string): Promise<void>;
+  getThinkingLevel?(): string | undefined;
   recordPointer(): string;
   dispose(): void | Promise<void>;
 };
@@ -204,22 +204,22 @@ export async function writeNavigatorModelSetting(model: string, path = navigator
 export function parseNavigatorModelSetting(value: string): {
   provider: string;
   model: string;
-  thinkingLevel: "off" | "max";
+  thinkingLevel?: string;
 } {
   const slash = value.indexOf("/");
   if (slash <= 0 || slash === value.length - 1) {
-    throw new Error("Navigator model setting must be provider/model[:max]");
+    throw new Error("Navigator model setting must be provider/model[:thinking]");
   }
   const provider = value.slice(0, slash);
   const modelWithThinking = value.slice(slash + 1);
   const colon = modelWithThinking.lastIndexOf(":");
   const suffix = colon < 0 ? undefined : modelWithThinking.slice(colon + 1);
-  if (suffix !== undefined && suffix !== "max") {
-    throw new Error("Navigator model setting must use :max or omit the thinking suffix");
-  }
   const model = colon < 0 ? modelWithThinking : modelWithThinking.slice(0, colon);
   if (model === "") throw new Error("Navigator model setting must include a model");
-  return { provider, model, thinkingLevel: suffix === "max" ? "max" : "off" };
+  // Suffix is opaque pass-through; bare provider/model omits thinkingLevel (Pi default).
+  return suffix === undefined
+    ? { provider, model }
+    : { provider, model, thinkingLevel: suffix };
 }
 
 /**
@@ -230,20 +230,21 @@ export async function resolveNavigatorSeatSelection(
   context: HostContext,
   modelSettingPath: string | undefined,
   defaultModelSettingPath: string,
-): Promise<{ selection: HostInstitutionalModelSelection; configuredLabel: string; thinkingLevel: "off" | "max" }> {
+): Promise<{ selection: HostInstitutionalModelSelection; configuredLabel: string; thinkingLevel?: string }> {
   const runDirectory = auditorRunDirectory(context);
   if (runDirectory !== undefined) {
     try {
       const selection = await readInstitutionalSeatSelection(runDirectory, "navigator");
-      const thinkingLevel = selection.thinking === "max" ? "max" : "off";
       return {
         selection: {
           provider: selection.provider,
           model: selection.model,
           ...(selection.thinking === undefined ? {} : { thinking: selection.thinking }),
         },
-        configuredLabel: `${selection.provider}/${selection.model}${thinkingLevel === "max" ? ":max" : ""}`,
-        thinkingLevel,
+        configuredLabel: selection.thinking === undefined
+          ? `${selection.provider}/${selection.model}`
+          : `${selection.provider}/${selection.model}:${selection.thinking}`,
+        ...(selection.thinking === undefined ? {} : { thinkingLevel: selection.thinking }),
       };
     } catch (error) {
       if (
@@ -274,9 +275,9 @@ export async function resolveNavigatorSeatSelection(
     selection: {
       provider: parsed.provider,
       model: parsed.model,
-      thinking: parsed.thinkingLevel,
+      ...(parsed.thinkingLevel === undefined ? {} : { thinking: parsed.thinkingLevel }),
     },
     configuredLabel: configured,
-    thinkingLevel: parsed.thinkingLevel,
+    ...(parsed.thinkingLevel === undefined ? {} : { thinkingLevel: parsed.thinkingLevel }),
   };
 }

package/src/pi/durable-principal.ts

@@ -55,6 +55,12 @@ export const piDurablePrincipalAuthority: DurablePrincipalAuthority = {
       sessionFile: coordinates.sessionFile,
     });
   },
+  seal(coordinates: DurablePrincipalCoordinates): DurablePrincipal {
+    return encode({
+      sessionDirectory: coordinates.sessionDirectory,
+      sessionFile: coordinates.sessionFile,
+    });
+  },
   decode(value: unknown): DurablePrincipalCoordinates {
     const record = value as Partial<DurablePrincipalCoordinates> | null;
     if (record === null || typeof record !== "object") {

package/src/pi/in-process-session.ts

@@ -237,7 +237,7 @@ export async function openPiInstitutionalSession(
       ? childRegistry.find(selection.provider, selection.model)
       : undefined;
 
-    const withTypedReason = (error: Error, reason: "auth" | "model" | "thinking"): Error =>
+    const withTypedReason = (error: Error, reason: "auth" | "model"): Error =>
       Object.assign(error, { reason });
 
     // Existing Navigator/model contract (pre-#590): unknown provider or model is
@@ -254,13 +254,15 @@ export async function openPiInstitutionalSession(
     const fallbackApi = providerDefaultModel?.api
       ?? (childProvider as any)?.api
       ?? (selection.provider === "openai-codex" ? "openai-codex-responses" : "openai-completions");
+    // Fallback model facts come from the provider surface only — never derive
+    // reasoning (or any capability) from the thinking string (#683 pass-through).
     const modelToUse = foundModel ?? {
       id: selection.model,
       name: selection.model,
       api: fallbackApi as any,
       provider: selection.provider,
       baseUrl: providerDefaultModel?.baseUrl ?? "",
-      reasoning: selection.thinking !== undefined && selection.thinking !== "off",
+      reasoning: providerDefaultModel?.reasoning ?? false,
       input: ["text"],
       cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
       contextWindow: 128000,
@@ -631,15 +633,15 @@ export async function openPiInstitutionalSession(
       }
     }
 
-    // 7. Create AgentSession
-    // Existing Navigator contract: requested thinking must stick after open. Pi
-    // clamps unsupported levels; if max was requested and not applied, fail as
-    // typed unavailable/thinking (pre-#590 attendance setModel check).
-    const requestedThinking = options.selection.thinking === "max" ? "max" : "off";
+    // 7. Create AgentSession — thinking is opaque pass-through. Absent selection
+    // omits thinkingLevel (Pi default). Pi clamps unsupported levels itself;
+    // we do not re-check or invent defaults.
     const { session } = await createAgentSession({
       cwd: options.cwd,
       model: effectiveModel,
-      thinkingLevel: requestedThinking as any,
+      ...(options.selection.thinking === undefined
+        ? {}
+        : { thinkingLevel: options.selection.thinking as any }),
       modelRuntime: runtime,
       sessionManager,
       settingsManager: settings,
@@ -649,15 +651,6 @@ export async function openPiInstitutionalSession(
       ...(options.toolsAllowlist === undefined ? {} : { tools: options.toolsAllowlist as string[] }),
       ...(customTools.length === 0 ? {} : { customTools }),
     });
-    if (requestedThinking === "max" && session.thinkingLevel !== "max") {
-      session.dispose();
-      throw withTypedReason(
-        new Error(
-          `${label} thinking level max is unavailable for ${selection.provider}/${selection.model}`,
-        ),
-        "thinking",
-      );
-    }
 
     // 8. Event subscriptions
     const listeners = new Set<(event: HostInstitutionalSessionEvent) => void>();

package/src/public-cli/cli.ts

@@ -461,16 +461,6 @@ function cliResultFromRoleRun(result: {
   };
 }
 
-const THINKING_LEVELS = new Set([
-  "off",
-  "minimal",
-  "low",
-  "medium",
-  "high",
-  "xhigh",
-  "max",
-]);
-
 function defaultIo(): CliIo {
   return {
     stdout: (text) => {
@@ -505,10 +495,8 @@ type ParsedGlobal = {
 };
 
 function parseThinking(value: string): PublicThinkingLevel {
-  if (!THINKING_LEVELS.has(value)) {
-    throw new CliUsageError(`unknown thinking level: ${value}`);
-  }
-  return value as PublicThinkingLevel;
+  // #683: opaque pass-through — no local whitelist.
+  return value;
 }
 
 function parseArgv(argv: readonly string[]): ParsedGlobal {

package/src/public-cli/config.ts

@@ -102,16 +102,6 @@ export type InvocationModelOverride = {
   host?: string;
 };
 
-export const THINKING_LEVELS = new Set<PublicThinkingLevel>([
-  "off",
-  "minimal",
-  "low",
-  "medium",
-  "high",
-  "xhigh",
-  "max",
-]);
-
 export function publicCliConfigPath(home: string): string {
   if (typeof home !== "string" || home.trim() === "") {
     throw new Error("home must be explicitly provided");
@@ -336,17 +326,10 @@ export function parseModelSpec(
   const thinkingSplit = trimmed.lastIndexOf(":");
   let modelPart = trimmed;
   let thinking: PublicThinkingLevel | undefined = fallbackThinking;
-  // #346: no colon → bare provider/model is legal. Colon present (any index,
-  // including 0) → suffix must be a typed PublicThinkingLevel (empty/unknown
-  // stay format rejects; never swallow ":…" into the model name).
+  // #346/#683: no colon → bare provider/model is legal. Colon present → suffix
+  // is opaque thinking pass-through (no local whitelist); never swallow into model.
   if (thinkingSplit !== -1) {
-    const maybeThinking = trimmed.slice(thinkingSplit + 1);
-    if (!THINKING_LEVELS.has(maybeThinking as PublicThinkingLevel)) {
-      throw new Error(
-        `model specification must be provider/model[:thinking], got ${spec}`,
-      );
-    }
-    thinking = maybeThinking as PublicThinkingLevel;
+    thinking = trimmed.slice(thinkingSplit + 1);
     modelPart = trimmed.slice(0, thinkingSplit);
   }
   const slash = modelPart.indexOf("/");
@@ -507,14 +490,9 @@ function parseSeatModelConfig(value: unknown, seat: string): PersistentSeatConfi
   if (typeof raw.model !== "string" || raw.model.trim() === "") {
     throw new Error(`config seat ${seat} requires model`);
   }
-  // #384: thinking is optional on persistent seats; when present it must be typed.
-  if (raw.thinking !== undefined) {
-    if (
-      typeof raw.thinking !== "string" ||
-      !THINKING_LEVELS.has(raw.thinking as PublicThinkingLevel)
-    ) {
-      throw new Error(`config seat ${seat} requires a valid thinking level`);
-    }
+  // #384/#683: thinking is optional opaque pass-through; when present must be a string.
+  if (raw.thinking !== undefined && typeof raw.thinking !== "string") {
+    throw new Error(`config seat ${seat} thinking must be a string`);
   }
   const parsed: PersistentSeatConfig = {
     provider: raw.provider as string,

package/src/public-cli/inspector-run.ts

@@ -6,7 +6,9 @@
  */
 import type { DurablePrincipalAuthority, RoleTurnRequest } from "../host-contracts.ts";
 import { engineSessionMaterialFromOptions } from "../package-resources/engine-material.ts";
+import { rebindAdmittedToTicketSeatMemory } from "../ticket-seat-memory.ts";
 import { CliUsageError } from "./cli-errors.ts";
+import { resolveSeatTicketBinding } from "./seat-ticket-binding.ts";
 import {
   admitInspectorInvocation,
   buildInspectorTransportPrompt,
@@ -89,8 +91,26 @@ export async function runPublicInspector(
     throw error;
   }
 
+  // #635 seat self-ticket then #636 ticket+seat memory principal (before admitted mark).
+  await resolveSeatTicketBinding(admitted, env);
+  const memory = await rebindAdmittedToTicketSeatMemory({
+    admitted,
+    seat: "inspector",
+    principalAuthority: env.principalAuthority,
+  });
   await markRunAdmitted(admitted, env.principalAuthority);
 
+  // Same ticket nest already present → native host resume (not a fresh initial).
+  // Prompt is the same officer transport; only continuation kind flips (#636 / ADR 0079).
+  const engineMaterial = engineSessionMaterialFromOptions({
+    ...(env.engine === undefined ? {} : { engine: env.engine }),
+    packageRoot: env.packageRoot,
+  });
+  const continuation = {
+    kind: memory?.resumed === true ? ("resume" as const) : ("initial" as const),
+    prompt: buildInspectorTransportPrompt(admitted, engineMaterial),
+  };
+
   const turnRequest = buildInspectorTurnRequest(admitted, {
     packageRoot: env.packageRoot,
     home: env.home,
@@ -101,16 +121,7 @@ export async function runPublicInspector(
     ...(env.correlationId === undefined || env.correlationId.trim() === ""
       ? {}
       : { correlationId: env.correlationId }),
-    continuation: {
-      kind: "initial",
-      prompt: buildInspectorTransportPrompt(
-        admitted,
-        engineSessionMaterialFromOptions({
-          ...(env.engine === undefined ? {} : { engine: env.engine }),
-          packageRoot: env.packageRoot,
-        }),
-      ),
-    },
+    continuation,
   });
 
   return await runPostAdmissionOneShot({