@akagilnc/pi-workflow-roles 0.1.3541 → 0.1.3549

package/dist/public-cli/main.js

@@ -16863,7 +16863,6 @@ async function discoverCaseFiles(root) {
     for (const item of await readdir(dir, { withFileTypes: true })) {
       const path = resolve5(dir, item.name);
       if (item.isDirectory()) {
-        if (item.name === GROK_HOME_DIR_NAME) continue;
         await walk(path, depth + 1);
       } else if (item.isFile() && (item.name.endsWith(".jsonl") || item.name === "stderr.log" && depth === 1)) found.push(path);
     }
@@ -16992,13 +16991,11 @@ async function loadDoctorCase(runsPath) {
   const cost2 = { invocations: sourceList(runDirs.length, runDirs), legs: sourceList(legs.length, legs), modelApiTurns: sourceList(turns.count, turns.sources), outputTokens: sourceList(tokens.count, tokens.sources), toolCalls: sourceList(calls.count, calls.sources), retries: { ...sourceList(retryDirs.length, retryDirs), evidence: "literal run-dir naming" }, statuses, commits, sessions, outputBytes: { ...sourceList(rawBytes, legs), payload: "raw JSONL bytes", providerWireBytes: "unavailable" } };
   return { version: 1, identity: { issueNumber: Number(match[1]), runsPath: await stableRunsIdentity(root) }, evidence, cost: cost2 };
 }
-var GROK_HOME_DIR_NAME;
 var init_doctor_evidence = __esm({
   "src/doctor-evidence.ts"() {
     "use strict";
     init_sha256();
     init_terminating_tools();
-    GROK_HOME_DIR_NAME = "grok-home";
   }
 });
 
@@ -27905,7 +27902,7 @@ var init_turn_request = __esm({
 
 // src/host-transition-prior-native.ts
 import { access as access2, readdir as readdir6 } from "node:fs/promises";
-import { join as join26 } from "node:path";
+import { dirname as dirname11, join as join26 } from "node:path";
 function isKnownRoleTurnHost(value) {
   return KNOWN_ROLE_TURN_HOSTS.includes(value);
 }
@@ -27921,41 +27918,28 @@ async function listPiNativeRecordPaths(sessionFile) {
     throw error;
   }
 }
-async function listGrokNativeRecordPaths(runDirectory) {
-  const grokSessionsDir = join26(runDirectory, "grok-home", "sessions");
-  let encodedCwds;
+async function listSitianRecordPaths(sessionParent) {
+  const sessionRoot = dirname11(sessionParent);
+  let entries;
   try {
-    encodedCwds = await readdir6(grokSessionsDir, { withFileTypes: true });
+    entries = await readdir6(sessionRoot, { withFileTypes: true });
   } catch (error) {
     if (isEnoent2(error)) return [];
     throw error;
   }
-  const updatesPaths = [];
-  for (const cwdEntry of encodedCwds) {
-    if (!cwdEntry.isDirectory()) continue;
-    let sessionDirs;
-    try {
-      sessionDirs = await readdir6(join26(grokSessionsDir, cwdEntry.name), { withFileTypes: true });
-    } catch (error) {
-      if (isEnoent2(error)) continue;
-      throw error;
-    }
-    for (const sessEntry of sessionDirs) {
-      if (!sessEntry.isDirectory()) continue;
-      updatesPaths.push(join26(grokSessionsDir, cwdEntry.name, sessEntry.name, "updates.jsonl"));
-    }
-  }
-  updatesPaths.sort();
-  const present = [];
-  for (const updatesFile of updatesPaths) {
+  const recordPaths = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const recordFile = join26(sessionRoot, entry.name, "records.jsonl");
     try {
-      await access2(updatesFile);
-      present.push(updatesFile);
+      await access2(recordFile);
+      recordPaths.push(recordFile);
     } catch (error) {
       if (!isEnoent2(error)) throw error;
     }
   }
-  return present;
+  recordPaths.sort();
+  return recordPaths;
 }
 async function projectHostTransitionPriorNative(input) {
   if (input.previousHost === input.liveHost) return void 0;
@@ -27969,7 +27953,7 @@ async function projectHostTransitionPriorNative(input) {
       priorNativePaths: paths2
     };
   }
-  const paths = await listGrokNativeRecordPaths(input.runDirectory);
+  const paths = await listSitianRecordPaths(input.piSessionFile);
   return {
     previousHost: "grok-build",
     priorNativePaths: paths
@@ -28458,7 +28442,6 @@ async function dispatchPostAdmissionTurn(input) {
       const hostTransition = previousHost !== void 0 && liveHost !== void 0 && principalCoordinates !== void 0 ? await projectHostTransitionPriorNative({
         previousHost,
         liveHost,
-        runDirectory: admitted.runDirectory,
         piSessionFile: principalCoordinates.sessionFile
       }) : void 0;
       turnRequest = request;
@@ -30884,9 +30867,9 @@ var init_analyst_book_key = __esm({
 // src/atomic-write.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { rename, rm as rm2, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname as dirname11, join as join30 } from "node:path";
+import { dirname as dirname12, join as join30 } from "node:path";
 async function writeFileAtomically(destination, contents) {
-  const parent = dirname11(destination);
+  const parent = dirname12(destination);
   const temporary = join30(parent, `.atomic-write-${randomUUID6()}.tmp`);
   try {
     await writeFile10(temporary, contents);
@@ -30904,7 +30887,7 @@ var init_atomic_write = __esm({
 
 // src/analyst-index.ts
 import { open as open3, readFile as readFile17, unlink as unlink4 } from "node:fs/promises";
-import { dirname as dirname12, join as join31 } from "node:path";
+import { dirname as dirname13, join as join31 } from "node:path";
 function sleep(ms) {
   return new Promise((resolve12) => {
     setTimeout(resolve12, ms);
@@ -30912,8 +30895,8 @@ function sleep(ms) {
 }
 async function withAnalystLibraryIndexLock(ledgerHome, fn) {
   const indexPath = analystLibraryIndexPath(ledgerHome);
-  ensureRealDirectoryTree(ledgerHome, dirname12(indexPath));
-  const lockPath = join31(dirname12(indexPath), LIBRARY_INDEX_LOCK_NAME);
+  ensureRealDirectoryTree(ledgerHome, dirname13(indexPath));
+  const lockPath = join31(dirname13(indexPath), LIBRARY_INDEX_LOCK_NAME);
   assertLedgerFileInsideHome(lockPath, ledgerHome);
   const startedAt = Date.now();
   while (true) {
@@ -31049,7 +31032,7 @@ async function readAnalystLibraryIndexPage(ledgerHome) {
 }
 async function writeAnalystLibraryIndexPage(ledgerHome, page) {
   const path = analystLibraryIndexPath(ledgerHome);
-  ensureRealDirectoryTree(ledgerHome, dirname12(path));
+  ensureRealDirectoryTree(ledgerHome, dirname13(path));
   assertLedgerFileInsideHome(path, ledgerHome);
   await writeFileAtomically(path, `${JSON.stringify(page, null, 2)}
 `);
@@ -32426,7 +32409,7 @@ var init_analyst_metric_family = __esm({
 
 // src/analyst-page.ts
 import { createHash as createHash7 } from "node:crypto";
-import { dirname as dirname13, join as join33 } from "node:path";
+import { dirname as dirname14, join as join33 } from "node:path";
 function analystIssuePageKey(address) {
   const parts = ["book", address.bookKey];
   if (address.issueNumber !== void 0) {
@@ -32556,7 +32539,7 @@ async function buildAnalystIssueMetricsPage(input) {
 }
 async function writeAnalystIssueMetricsPage(ledgerHome, page) {
   const path = analystIssuePagePath(ledgerHome, analystIssuePageAddressFromPage(page));
-  ensureRealDirectoryTree(ledgerHome, dirname13(path));
+  ensureRealDirectoryTree(ledgerHome, dirname14(path));
   assertLedgerFileInsideHome(path, ledgerHome);
   await writeFileAtomically(path, `${JSON.stringify(page, null, 2)}
 `);
@@ -34014,7 +33997,7 @@ var init_cli = __esm({
 
 // src/public-cli/main.ts
 import { existsSync as existsSync11 } from "node:fs";
-import { dirname as dirname14, join as join35 } from "node:path";
+import { dirname as dirname15, join as join35 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/public-cli/host-pi-runtime.ts
@@ -34101,7 +34084,7 @@ function linkPackage(packageRoot2, name, targetDir) {
 }
 
 // src/public-cli/main.ts
-var here = dirname14(fileURLToPath4(import.meta.url));
+var here = dirname15(fileURLToPath4(import.meta.url));
 function resolvePackageRoot(binDir) {
   const canonical = join35(binDir, "..", "..");
   if (existsSync11(join35(canonical, "package.json"))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.3541",
+  "version": "0.1.3549",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/doctor-evidence.ts

@@ -5,14 +5,7 @@ import type { DoctorCase, DoctorCaseCost, DoctorCount, DoctorEvidenceEntry } fro
 import { AcceptedDetailsContractError, acceptedFacts, isTerminatingToolName, validateAcceptedDetails } from "./package-contracts/terminating-tools.ts";
 
 function record(value: unknown): value is Record<string, unknown> { return typeof value === "object" && value !== null && !Array.isArray(value); }
-/**
- * Grok controlled-home ledger directory under a run (ADR 0077 / #594).
- * Native journals (e.g. updates.jsonl) are retained for dossier parity but are
- * not Pi session records — walking them into deriveSession yields false incomplete
- * legs. Explicit skip is the leave-trace exclusion until a grok parser exists.
- */
-const GROK_HOME_DIR_NAME = "grok-home";
-async function discoverCaseFiles(root: string): Promise<string[]> { const found: string[] = []; async function walk(dir: string, depth: number) { for (const item of await readdir(dir, { withFileTypes: true })) { const path = resolve(dir, item.name); if (item.isDirectory()) { if (item.name === GROK_HOME_DIR_NAME) continue; await walk(path, depth + 1); } else if (item.isFile() && (item.name.endsWith(".jsonl") || (item.name === "stderr.log" && depth === 1))) found.push(path); } } await walk(root, 0); return found.sort(); }
+async function discoverCaseFiles(root: string): Promise<string[]> { const found: string[] = []; async function walk(dir: string, depth: number) { for (const item of await readdir(dir, { withFileTypes: true })) { const path = resolve(dir, item.name); if (item.isDirectory()) { await walk(path, depth + 1); } else if (item.isFile() && (item.name.endsWith(".jsonl") || (item.name === "stderr.log" && depth === 1))) found.push(path); } } await walk(root, 0); return found.sort(); }
 function sourceList(count: number, sources: string[]) { return { count, sources: [...new Set(sources)].sort() }; }
 function accumulate(metric: DoctorCount, value: number, source: string) { metric.count += value; if (value) metric.sources.push(source); }
 function timestamp(row: Record<string, unknown>) { return typeof row.timestamp === "string" && Number.isFinite(Date.parse(row.timestamp)) ? row.timestamp : undefined; }

package/src/grok/production-host.ts

@@ -1,20 +1,12 @@
 /**
- * Production composition for the grok-build RoleTurnHost adapter (#580 / #522 / #594).
+ * Production composition for the grok-build RoleTurnHost adapter (#580 / #522 / #717).
  * Owns injectables around the S6 true adapter; does not alter S6 adapter behavior.
  *
- * Isolation contract: subprocess GROK_HOME, Fixer seatbelt hang root, and auth
- * copy share one directory under the runDirectory ledger (grok-home). The grok
- * binary still resolves from the operator home. Callers pass that isolated home
- * into S6 as request.home (bash-seatbelt.ts: "callers must pass the isolated home").
- * Auth is copied from the operator home into grok-home for the turn and scrubbed
- * on settle together with AK seatbelt hook residue; the session dossier directly
- * written under grok-home survives settlement (ADR 0048 / ADR 0077 / #594).
- *
- * Known residual risk: a hard process crash between auth copy and settle can leave
- * auth.json in the retained run ledger for one crash window. The next open scrubs
- * residual auth before recopying; single-crash-window residue is accepted.
+ * Grok CLI uses the operator home (`~/.grok`) and credentials in place. The
+ * factory does not create a run-scoped grok home, does not rewrite HOME, and
+ * does not copy or scrub auth.json. Sititian records on the run are the dossier.
  */
-import { readFile, rm, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -22,7 +14,7 @@ import { loadCanonicalSkillBinding as loadHomeCanonicalSkillBinding } from "../c
 import { createGhCollectorGitHubTransport, createGhIssueSoftFetcher } from "../collector-github.ts";
 import { createPiDoctorAuditor } from "../doctor-auditor.ts";
 import { loadDoctorCase } from "../doctor-evidence.ts";
-import type { DurablePrincipalAuthority, RoleTurnHost, RoleTurnRequest } from "../host-contracts.ts";
+import type { DurablePrincipalAuthority, RoleTurnHost } from "../host-contracts.ts";
 import { createPiJudgeAuditor } from "../judge-auditor.ts";
 import { createProductionMergerGitState } from "../merger-git-state.ts";
 import { createNativeNavigatorSessionFactory, createNavigatorAttendance } from "../navigator-attendance.ts";
@@ -35,28 +27,11 @@ import { createReviewerPinnedGitReader } from "../reviewer-pinned-git.ts";
 import { loadGatekeeperSessionMaterials, loadMainRoleSessionMaterials } from "../session-opening-materials.ts";
 import { createComposedGrokRoleTurnHost } from "./role-envelope.ts";
 import {
-  assertControlledGrokAuthIsNotSymlink,
-  assertControlledGrokHomeIsRealDirectory,
   connectGrokAcpStdio,
   controlledGrokChildEnv,
-  inspectControlledGrok,
-  prepareControlledGrokHome,
-  scrubAkBashSeatbeltHooks,
-  type GrokCapabilityDeclaration,
 } from "./role-turn-host.ts";
 import { createGrokSessionIdentityAuthority } from "./session-identity.ts";
 
-/**
- * Authoritative production isolation binding consumed by inspect/connect and by
- * the S6 request.home rewrite (controlledHome).
- */
-export type ProductionGrokIsolationBinding = Readonly<{
-  operatorHome: string;
-  controlledHome: string;
-  binary: string;
-  env: NodeJS.ProcessEnv;
-}>;
-
 export type ProductionGrokHostOptions = Readonly<{
   packageRoot: string;
   principalAuthority: DurablePrincipalAuthority;
@@ -66,137 +41,13 @@ function resolveGrokBinary(operatorHome: string): string {
   return join(operatorHome, ".grok", "bin", "grok");
 }
 
-/**
- * Primary-failure state for cleanup settlement. `undefined` is a legal primary
- * value (throw/reject undefined), so presence is an explicit discriminant — never
- * inferred from `value !== undefined`.
- */
-export type ProductionGrokPrimaryFailure =
-  | Readonly<{ present: false }>
-  | Readonly<{ present: true; value: unknown }>;
-
-export const NO_PRODUCTION_GROK_PRIMARY_FAILURE = {
-  present: false,
-} as const satisfies ProductionGrokPrimaryFailure;
-
-/**
- * Sole cleanup settlement for production controlled homes: scrub auth secrets
- * (auth.json) and AK seatbelt hook residue while preserving the session dossier
- * under the runDirectory ledger. Refuses symlink home/auth so rm never follows a
- * redirect (#594 F1/F4). Cleanup failure is never silenced. When a primary failure
- * is present and cleanup also fails, both surface as AggregateError (including
- * primary value `undefined`); cleanup success rethrows the primary value as-is.
- */
-export async function settleProductionGrokHomeCleanup(
-  controlledHome: string,
-  primaryFailure: ProductionGrokPrimaryFailure,
-  concurrentMessage: string,
-): Promise<void> {
-  try {
-    await assertControlledGrokHomeIsRealDirectory(controlledHome);
-    const authPath = join(controlledHome, "auth.json");
-    await assertControlledGrokAuthIsNotSymlink(authPath);
-    await rm(authPath, { force: true });
-    await scrubAkBashSeatbeltHooks(controlledHome);
-  } catch (cleanupFailure) {
-    if (primaryFailure.present) {
-      throw new AggregateError([primaryFailure.value, cleanupFailure], concurrentMessage, {
-        cause: primaryFailure.value,
-      });
-    }
-    throw cleanupFailure;
-  }
-  if (primaryFailure.present) {
-    throw primaryFailure.value;
-  }
-}
-
-/**
- * Open the production isolation root under runDirectory: auth copy into grok-home.
- * If auth copy fails after the root is created, auth secrets are scrubbed; open
- * failure and cleanup failure both surface (AggregateError when concurrent).
- */
-export async function openProductionGrokHome(
-  runDirectory: string,
-  operatorHome: string,
-): Promise<string> {
-  const controlledHome = join(runDirectory, "grok-home");
-  try {
-    await prepareControlledGrokHome(operatorHome, controlledHome);
-    return controlledHome;
-  } catch (error) {
-    await settleProductionGrokHomeCleanup(
-      controlledHome,
-      { present: true, value: error },
-      "production grok home open failed and its cleanup also failed",
-    );
-    // settle always throws when primaryFailure is present.
-    throw error;
-  }
-}
-
-function childEnv(controlledHome: string, packageRoot: string): NodeJS.ProcessEnv {
+function childEnv(packageRoot: string): NodeJS.ProcessEnv {
   return {
-    ...controlledGrokChildEnv(process.env, controlledHome),
+    ...controlledGrokChildEnv(process.env),
     AK_PACKAGE_ROOT: packageRoot,
   };
 }
 
-/**
- * Single production isolation binding: auth root, GROK_HOME/HOME, and binary
- * resolution. Production executeTurn passes controlledHome as S6 request.home
- * (seatbelt hang root proven separately by S6 seatbelt tests).
- */
-export async function bindProductionGrokIsolation(
-  runDirectory: string,
-  operatorHome: string,
-  packageRoot: string,
-): Promise<ProductionGrokIsolationBinding> {
-  const controlledHome = await openProductionGrokHome(runDirectory, operatorHome);
-  return {
-    operatorHome,
-    controlledHome,
-    binary: resolveGrokBinary(operatorHome),
-    env: childEnv(controlledHome, packageRoot),
-  };
-}
-
-/**
- * Bind isolation under runDirectory, run the turn body, always scrub auth.json
- * and AK seatbelt hooks via settleProductionGrokHomeCleanup (no silent catch)
- * while preserving the session dossier under runDirectory/grok-home. Success,
- * typed-result, and throw paths all clean up; cleanup failure and primary+cleanup
- * both surface. Same-run Grok isolation only — no cross-run home override (#637).
- */
-export async function withProductionGrokIsolation<T>(
-  runDirectory: string,
-  operatorHome: string,
-  packageRoot: string,
-  run: (binding: ProductionGrokIsolationBinding) => Promise<T>,
-): Promise<T> {
-  let binding: ProductionGrokIsolationBinding | undefined;
-  let primaryFailure: ProductionGrokPrimaryFailure = NO_PRODUCTION_GROK_PRIMARY_FAILURE;
-  let value!: T;
-  try {
-    binding = await bindProductionGrokIsolation(runDirectory, operatorHome, packageRoot);
-    value = await run(binding);
-  } catch (error) {
-    primaryFailure = { present: true, value: error };
-  }
-
-  if (binding !== undefined) {
-    // No catch: settle throws cleanup failure or AggregateError with primary.
-    await settleProductionGrokHomeCleanup(
-      binding.controlledHome,
-      primaryFailure,
-      "production grok isolation turn and cleanup failed",
-    );
-  }
-
-  if (primaryFailure.present) throw primaryFailure.value;
-  return value;
-}
-
 const navigatorRoutePlaybookPath = fileURLToPath(
   new URL("../../resources/navigator-route-playbook.md", import.meta.url),
 );
@@ -267,78 +118,24 @@ export function createGrokRoleRuntimeDependencies(packageRoot: string): RoleRunt
   };
 }
 
-async function recordGrokCapabilities(
-  request: RoleTurnRequest,
-  declaration: GrokCapabilityDeclaration,
-): Promise<void> {
-  await writeFile(
-    join(request.runDirectory, "grok-capabilities.json"),
-    `${JSON.stringify(declaration)}\n`,
-    "utf8",
-  );
-}
-
 /**
  * Assemble the production grok-build RoleTurnHost from the S6 true adapter.
- * Isolation always under the live request.runDirectory (same-run resume keeps it).
+ * Grok subprocesses inherit the operator home; the run directory is sitian-only.
  */
 export function createProductionGrokRoleTurnHost(options: ProductionGrokHostOptions): RoleTurnHost {
   const { packageRoot, principalAuthority } = options;
-  // Single-slot turn isolation; outer serial keeps operator/controlled pairing intact.
-  let turn: ProductionGrokIsolationBinding | undefined;
-  let serial = Promise.resolve();
+  const env = childEnv(packageRoot);
 
-  const inner = createComposedGrokRoleTurnHost({
+  return createComposedGrokRoleTurnHost({
     sessionIdentity: createGrokSessionIdentityAuthority(principalAuthority),
     roleRuntimeDependencies: createGrokRoleRuntimeDependencies(packageRoot),
-    recordCapabilities: recordGrokCapabilities,
-    async inspect(request) {
-      if (turn === undefined) {
-        throw new Error("production grok inspect requires an active isolated turn");
-      }
-      return inspectControlledGrok({
-        binary: turn.binary,
-        cwd: request.cwd,
-        env: turn.env,
-        packageRoot,
-      });
-    },
     async connect(request) {
-      if (turn === undefined) {
-        throw new Error("production grok connect requires an active isolated turn");
-      }
       return connectGrokAcpStdio({
-        binary: turn.binary,
+        binary: resolveGrokBinary(request.home),
         cwd: request.cwd,
-        env: turn.env,
+        env,
         ...(request.model === undefined ? {} : { model: request.model.model }),
       });
     },
   });
-
-  return {
-    executeTurn(request) {
-      const execution = serial.then(() =>
-        withProductionGrokIsolation(
-          request.runDirectory,
-          request.home,
-          packageRoot,
-          async (binding) => {
-            turn = binding;
-            try {
-              // S6 seatbelt hangs on request.home — same isolated root as GROK_HOME.
-              return await inner.executeTurn({ ...request, home: binding.controlledHome });
-            } finally {
-              turn = undefined;
-            }
-          },
-        ),
-      );
-      serial = execution.then(
-        () => undefined,
-        () => undefined,
-      );
-      return execution;
-    },
-  };
 }