@akagilnc/pi-workflow-roles 0.1.3565 → 0.1.3572

package/src/public-cli/post-admission.ts

@@ -324,8 +324,8 @@ export async function dispatchPostAdmissionTurn<
 
     await markRunRunning(admitted.runDirectory, env.model, effectiveEngine, env.host);
     await clearTypedProviderHttpObservation(admitted.runDirectory);
-    // beforeDispatch (e.g. countersign diarist station) runs after running is
-    // marked — its failures must settle the run, not leave it permanently running.
+    // beforeDispatch (seat-owned pre-turn work) runs after running is marked —
+    // its failures must settle the run, not leave it permanently running.
     if (adapters.beforeDispatch !== undefined) {
       try {
         await adapters.beforeDispatch(admitted);

package/src/public-cli/registry.ts

@@ -106,6 +106,9 @@ const STARTUP_CANDIDATES: Record<PublicConfigurableSeat, readonly ModelRef[]> =
     { provider: "openai-codex", model: "gpt-5.6-luna", thinking: "medium" },
     { provider: "xai", model: "grok-4.5", thinking: "high" },
   ],
+  // #708 `diarist-seat-default`: owner-set initial value; changed in the seat
+  // table like any other seat. No engine axis, package-default host.
+  diarist: [{ provider: "xai", model: "grok-4.5", thinking: "medium" }],
 };
 
 export function publicStartupCandidates(

package/src/public-cli/run-lifecycle.ts

@@ -44,6 +44,7 @@ import {
   type AdmittedCoderInvocation,
   type AdmittedCountersignInvocation,
   type AdmittedCollectorInvocation,
+  type AdmittedDiaristInvocation,
   type AdmittedDoctorInvocation,
   type AdmittedInspectorInvocation,
   type AdmittedNotaryInvocation,
@@ -95,7 +96,8 @@ export type RoleRunRecord = {
     | "gleaner-left"
     | "inspector"
     | "gatekeeper"
-    | "navigator";
+    | "navigator"
+    | "diarist";
   readonly state: RoleRunState;
   readonly bookKey: string;
   readonly projectRoot: string;
@@ -348,7 +350,8 @@ async function readRoleRunStateDisk(
     record.role !== "gleaner-left" &&
     record.role !== "inspector" &&
     record.role !== "gatekeeper" &&
-    record.role !== "navigator"
+    record.role !== "navigator" &&
+    record.role !== "diarist"
   ) {
     return undefined;
   }
@@ -1444,6 +1447,12 @@ export type LoadedResumableGleanerLeftRun = {
   readonly observation?: TypedHttp429Observation;
 };
 
+export type LoadedResumableDiaristRun = {
+  readonly admitted: AdmittedDiaristInvocation;
+  readonly run: RoleRunRecord;
+  readonly observation?: TypedHttp429Observation;
+};
+
 export type LoadedResumableInstructionSeatRun = {
   readonly admitted: AdmittedGatekeeperInvocation | AdmittedNavigatorInvocation;
   readonly run: RoleRunRecord;
@@ -1637,7 +1646,7 @@ export async function loadResumableReviewerRun(
 
 /**
  * Load a resumable Countersign run for resume (#599). Ticket binding and
- * attachments restore from the admitted request; diarist does not re-run.
+ * attachments restore from the admitted request.
  */
 export async function loadResumableCountersignRun(
   home: string,
@@ -1704,6 +1713,24 @@ export async function loadResumableGleanerLeftRun(
   return seatLoadedResult(loaded, admitted);
 }
 
+export async function loadResumableDiaristRun(
+  home: string,
+  runId: string,
+  authority: DurablePrincipalAuthority,
+): Promise<LoadedResumableDiaristRun> {
+  const loaded = await loadResumableRunRecord(home, runId, authority);
+  if (loaded.run.role !== "diarist") {
+    throw new CliUsageError(
+      `role run ${runId} belongs to ${loaded.run.role}, not diarist`,
+    );
+  }
+  const admitted: AdmittedDiaristInvocation = {
+    role: "diarist",
+    ...resumedBaseAdmitted(loaded),
+  };
+  return seatLoadedResult(loaded, admitted);
+}
+
 export type LoadedResumableMergerRun = {
   readonly admitted: AdmittedMergerInvocation;
   readonly run: RoleRunRecord;
@@ -1929,6 +1956,7 @@ export async function peekRoleRunRole(
   | "inspector"
   | "gatekeeper"
   | "navigator"
+  | "diarist"
   | undefined
 > {
   const runDirectory = await findRunDirectoryById(home, runId);

package/src/public-cli/settlement.ts

@@ -98,6 +98,11 @@ import {
   gleanerLeftDecisiveFacts,
   validateRecordedGleanerLeftOutput,
 } from "../gleaner-left-contracts.ts";
+import {
+  DIARIST_OUTPUT_TOOL_NAME,
+  diaristDecisiveFacts,
+  validateRecordedDiaristOutput,
+} from "../diarist-contracts.ts";
 import {
   INSPECTOR_OUTPUT_TOOL_NAME,
   inspectorDecisiveFacts,
@@ -145,6 +150,7 @@ import {
   type AdmittedJudgeInvocation,
   type AdmittedMergerInvocation,
   type AdmittedCountersignInvocation,
+  type AdmittedDiaristInvocation,
   type AdmittedGleanerLeftInvocation,
   type AdmittedInspectorInvocation,
   type AdmittedGatekeeperInvocation,
@@ -3360,7 +3366,8 @@ type SeatAcceptedSettlementSpec = {
     | "gleaner-left"
     | "inspector"
     | "gatekeeper"
-    | "navigator";
+    | "navigator"
+    | "diarist";
   readonly toolName: string;
   readonly nonUsableDiagnostic: string;
   readonly projectAccepted: (
@@ -3387,7 +3394,8 @@ async function settleLawfulSeatAcceptedTerminalResult(
     | AdmittedGleanerLeftInvocation
     | AdmittedInspectorInvocation
     | AdmittedGatekeeperInvocation
-    | AdmittedNavigatorInvocation,
+    | AdmittedNavigatorInvocation
+    | AdmittedDiaristInvocation,
   authority: DurablePrincipalAuthority,
   spec: SeatAcceptedSettlementSpec,
   scope?: SettlementCourtScope,
@@ -3651,6 +3659,46 @@ export async function trySettleGleanerLeftTerminalResult(
   return settleLawfulGleanerLeftTerminalResult(admitted, authority, scope);
 }
 
+/** Lawful Diarist accepted outcome (completed 入录选择, #708). */
+export type LawfulDiaristRoleOutcome = {
+  kind: "accepted";
+  role: "diarist";
+  status: string;
+  decisiveFacts: Readonly<Record<string, unknown>>;
+};
+
+async function settleLawfulDiaristTerminalResult(
+  admitted: AdmittedDiaristInvocation,
+  authority: DurablePrincipalAuthority,
+  scope?: SettlementCourtScope,
+): Promise<TerminalResult | undefined> {
+  return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+    role: "diarist",
+    toolName: DIARIST_OUTPUT_TOOL_NAME,
+    nonUsableDiagnostic: "起居郎回执无显式 completed",
+    tryAcceptDetails: tryAcceptWithValidator(validateRecordedDiaristOutput),
+    projectAccepted: (sealed) => {
+      const output = validateRecordedDiaristOutput(sealed.decisiveFacts);
+      const accepted: LawfulDiaristRoleOutcome = {
+        kind: "accepted",
+        role: "diarist",
+        status: sealed.status,
+        decisiveFacts: diaristDecisiveFacts(output),
+      };
+      return accepted;
+    },
+  }, scope);
+}
+
+/** Try to settle a lawful Diarist Terminal; undefined only for genuine absence. */
+export async function trySettleDiaristTerminalResult(
+  admitted: AdmittedDiaristInvocation,
+  authority: DurablePrincipalAuthority,
+  scope?: SettlementCourtScope,
+): Promise<TerminalResult | undefined> {
+  return settleLawfulDiaristTerminalResult(admitted, authority, scope);
+}
+
 /** Lawful Inspector accepted outcome (pass/bounce/escalate). */
 export type LawfulInspectorRoleOutcome = {
   kind: "accepted";

package/src/public-cli/terminal.ts

@@ -40,7 +40,8 @@ export type TerminalRoleName =
   | "gleaner-left"
   | "inspector"
   | "gatekeeper"
-  | "navigator";
+  | "navigator"
+  | "diarist";
 
 /** Merger/Collector residual only — Notary/audit residual abolished (#475). */
 export type ResidualIncompleteTerminalOutcome = {

package/src/role-runtime.ts

@@ -70,6 +70,20 @@ import {
   type InspectorRuntimeDependencies,
 } from "./inspector-role.ts";
 import { INSPECTOR_ACCEPTED_TEXT } from "./inspector-contracts.ts";
+import {
+  DIARIST_TOOL_SPEC,
+  type DiaristRuntimeDependencies,
+} from "./diarist-role.ts";
+import {
+  DIARIST_ACCEPTED_TEXT,
+  DIARIST_SOURCES_FLAG,
+  projectDiaristSelections,
+} from "./diarist-contracts.ts";
+import {
+  commitDiaristSelections,
+  loadDiaristSourceCatalog,
+  type DiaristSourceCatalog,
+} from "./diarist.ts";
 import {
   GATEKEEPER_TOOL_SPEC,
   type GatekeeperRuntimeDependencies,
@@ -159,6 +173,14 @@ const GLEANER_LEFT_TRANSPORT_FLAGS = Object.freeze([
   }),
 ] as const);
 
+/** Diarist private transport: frozen source catalog path (ADR 0018 / #708). */
+const DIARIST_TRANSPORT_FLAGS = Object.freeze([
+  Object.freeze({
+    name: DIARIST_SOURCES_FLAG.name,
+    definition: DIARIST_SOURCES_FLAG.definition,
+  }),
+] as const);
+
 /**
  * Decode private transport flags into frozen admitted inputs.
  * Envelope-owned; necessary JSON decode only (public --authority-ref owns grammar).
@@ -439,6 +461,7 @@ type ActivationRuntime = {
   inspector: { activate(): Promise<void> };
   gatekeeper: { activate(): Promise<void> };
   navigator: { activate(): Promise<void> };
+  diarist: { activate(): Promise<void> };
   merger(): Promise<void>;
 };
 
@@ -487,6 +510,7 @@ function activationStage(role: PackagedRole, runtime: ActivationRuntime): { id:
     case "inspector": return { id: "load-and-install", run: async () => runtime.inspector.activate() };
     case "gatekeeper": return { id: "load-and-install", run: async () => runtime.gatekeeper.activate() };
     case "navigator": return { id: "load-and-install", run: async () => runtime.navigator.activate() };
+    case "diarist": return { id: "load-and-install", run: async () => runtime.diarist.activate() };
     case "merger": return { id: "prepare-git-and-install", run: async () => runtime.merger() };
   }
 }
@@ -594,6 +618,7 @@ export type RoleRuntimeDependencies = {
   loadInspectorSoul?(): Promise<string>;
   loadGatekeeperSoul?(): Promise<string>;
   loadNavigatorSoul?(): Promise<string>;
+  loadDiaristSoul?(): Promise<string>;
   loadDoctorCase?(path: string): Promise<import("./doctor-contracts.ts").DoctorCase>;
   loadMergerSoul?(): Promise<string>;
   loadMergerInput?(path: string): Promise<unknown>;
@@ -707,13 +732,17 @@ export async function projectClosedSubmissionLifecycle(
   await settle(publicNavigatorSettlement(projection.role, phase, closure));
 }
 
-/** Optional pre-accept hook on the shared filed-officer envelope (ADR 0075). */
+/**
+ * Optional pre-accept hook on the shared filed-officer envelope (ADR 0075).
+ * May return a details projection (envelope-owned machine facts recorded next to
+ * the submitted parameters); undefined keeps the parameters as submitted.
+ */
 type FiledOfficerBeforeAccept = (input: {
   readonly toolCallId: string;
   readonly parameters: unknown;
   readonly signal: AbortSignal | undefined;
   readonly ctx: HostContext;
-}) => Promise<void>;
+}) => Promise<unknown>;
 
 /**
  * Shared registration envelope for filed officers (ADR 0018 / #572):
@@ -749,14 +778,15 @@ function createFiledOfficerRuntime(
           parameters: spec.tool.parameters as never,
           async execute(toolCallId, parameters, signal, _onUpdate, ctx): Promise<HostToolResult<unknown>> {
             if (soul === undefined) throw new Error(`${spec.role} 职分未装载`);
-            if (spec.beforeAccept !== undefined) {
-              await spec.beforeAccept({ toolCallId, parameters, signal, ctx });
-            }
+            const projected =
+              spec.beforeAccept === undefined
+                ? undefined
+                : await spec.beforeAccept({ toolCallId, parameters, signal, ctx });
             // Accept-as-is + terminate only. Shape is not an admission gate
             // (第 0 条 / ADR 0055); sole-final barrier is ledger-owned (#575).
             return {
               content: [{ type: "text" as const, text: spec.acceptedText }],
-              details: parameters,
+              details: projected === undefined ? parameters : projected,
               terminate: true as const,
             };
           },
@@ -849,6 +879,73 @@ export function createNavigatorRoleRuntime(
   );
 }
 
+/**
+ * #708: 起居郎 public seat on the shared filed-officer envelope.
+ * Semantic collection happened in this role's own turn; the accept hook runs the
+ * mechanical band (verbatim reverse-verify → idempotent sitian append →
+ * watermark) and records the resulting sitian facts next to the receipt.
+ * Machine facts never come from model self-report (锚定宪法).
+ */
+export function createDiaristRoleRuntime(
+  roleHost: RoleHost,
+  dependencies: DiaristRuntimeDependencies,
+  getSourcesFlag: () => unknown,
+) {
+  // This turn's catalog, snapshotted at activate: the candidateIndexes the role
+  // saw and the rows accept commits are the same bytes. Accept never re-reads
+  // the file, so anything written to it mid-turn cannot become a diary entry.
+  let catalog: DiaristSourceCatalog | undefined;
+  const runtime = createFiledOfficerRuntime(
+    roleHost,
+    {
+      role: "diarist",
+      tool: DIARIST_TOOL_SPEC,
+      acceptedText: DIARIST_ACCEPTED_TEXT,
+      soulTag: "diarist",
+      beforeAccept: async ({ parameters }) => {
+        const submitted =
+          parameters !== null && typeof parameters === "object" && !Array.isArray(parameters)
+            ? (parameters as Record<string, unknown>)
+            : undefined;
+        // True-unbound summons: no ticket, no catalog, no diary committed — so
+        // this turn produced no sitian facts. A self-reported `sitian` is not
+        // one (锚定宪法); drop it rather than let it ride into decisiveFacts.
+        // Carrying the field is not a reason to bounce the receipt (第 0 条).
+        if (catalog === undefined) {
+          if (submitted === undefined || !("sitian" in submitted)) return undefined;
+          const stripped = { ...submitted };
+          delete stripped.sitian;
+          return stripped;
+        }
+        const facts = await commitDiaristSelections({
+          catalog,
+          selections: projectDiaristSelections(parameters),
+        });
+        return { ...(submitted ?? { receipt: parameters }), sitian: facts };
+      },
+    },
+    dependencies,
+  );
+  return {
+    async activate() {
+      catalog = loadFrozenDiaristCatalog(getSourcesFlag);
+      return runtime.activate();
+    },
+  };
+}
+
+/** Envelope-owned decode + one-shot load of the frozen catalog (ADR 0018). */
+function loadFrozenDiaristCatalog(
+  getFlag: () => unknown,
+): DiaristSourceCatalog | undefined {
+  const raw = getFlag();
+  if (raw === undefined) return undefined;
+  if (typeof raw !== "string" || raw.trim() === "") {
+    throw new Error("Diarist source catalog flag must be a nonempty path");
+  }
+  return loadDiaristSourceCatalog(raw);
+}
+
 export function createCountersignRoleRuntime(
   roleHost: RoleHost,
   dependencies: CountersignRuntimeDependencies,
@@ -905,6 +1002,9 @@ export function createRoleRuntimeExtension(
     for (const flag of GLEANER_LEFT_TRANSPORT_FLAGS) {
       roleHost.registerFlag(flag.name, flag.definition);
     }
+    for (const flag of DIARIST_TRANSPORT_FLAGS) {
+      roleHost.registerFlag(flag.name, flag.definition);
+    }
 
     let admitted = false;
     let selectedRole: string | undefined;
@@ -1358,6 +1458,16 @@ export function createRoleRuntimeExtension(
         return dependencies.loadNavigatorSoul();
       },
     });
+    const diarist = createDiaristRoleRuntime(
+      roleHost,
+      {
+        async loadSoul() {
+          if (!dependencies.loadDiaristSoul) throw new Error("Diarist runtime dependencies are not configured");
+          return dependencies.loadDiaristSoul();
+        },
+      },
+      () => envelopeHost.host.getFlag(DIARIST_SOURCES_FLAG.name),
+    );
     let sessionMergerGitState = dependencies.mergerGitState;
     const merger = createMergerRoleRuntime(roleHost, {
       async loadSoul() { if (!dependencies.loadMergerSoul) throw new Error("Merger runtime dependencies are not configured"); return dependencies.loadMergerSoul(); },
@@ -1524,6 +1634,7 @@ export function createRoleRuntimeExtension(
         inspector,
         gatekeeper,
         navigator,
+        diarist,
         merger: async () => {
           if (dependencies.mergerGitState === undefined) {
             sessionMergerGitState = dependencies.createMergerGitState?.(ctx.cwd);

package/src/ticket-provenance-contracts.ts

@@ -66,6 +66,7 @@ export type TicketProvenanceEntry = {
  * Separated by recordClass discriminator — never disguised as a source entry.
  */
 export type TicketProvenanceDiagnosticKind =
+  /** Historical rows only — the diarist turn's own failure settles the run (#708). */
   | "collector-failed"
   | "issue-source-failed"
   | "quote-verify-failed";

package/src/ticket-provenance.ts

@@ -408,29 +408,6 @@ export function appendTicketProvenanceDiagnostic(input: {
   });
 }
 
-/** Collector/engine failure true cause — typed diagnostic, not a diary entry. */
-export function appendCollectorFailureDiagnostic(input: {
-  readonly ticketNumber: number;
-  readonly cwd: string;
-  readonly home?: string;
-  readonly collectorError: string;
-  readonly recordedAt?: string;
-}): RecordPointer {
-  const recordedAt = input.recordedAt ?? new Date().toISOString();
-  return appendTicketProvenanceDiagnostic({
-    ticketNumber: input.ticketNumber,
-    cwd: input.cwd,
-    ...(input.home === undefined ? {} : { home: input.home }),
-    source: "diarist-collector-fail",
-    diagnostic: {
-      recordClass: TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC,
-      diagnosticKind: "collector-failed",
-      cause: input.collectorError,
-      recordedAt,
-    },
-  });
-}
-
 /** Issue-face source acquisition failure — typed diagnostic on the ticket volume. */
 export function appendIssueSourceFailureDiagnostic(input: {
   readonly ticketNumber: number;