@akagilnc/pi-workflow-roles 0.1.3565 → 0.1.3621

package/dist/package-contracts/terminating-tools.js

@@ -10,13 +10,16 @@ import { CorrectableSubmissionError } from "../submission-correctable-error.js";
 import { DOCTOR_ACCEPTED_TEXT, DOCTOR_OUTPUT_TOOL_NAME, validateDoctorSubmissionShape, validateRecordedDoctorOutput } from "../doctor-contracts.js";
 import { GATEKEEPER_ACCEPTED_TEXT, GATEKEEPER_OUTPUT_TOOL_NAME, validateRecordedGatekeeperOutput } from "./gatekeeper-output.js";
 import { NAVIGATOR_ACCEPTED_TEXT, NAVIGATOR_OUTPUT_TOOL_NAME, validateRecordedNavigatorOutput } from "./navigator-output.js";
+import { AUDITOR_ACCEPTED_TEXT, AUDITOR_OUTPUT_TOOL_NAME, validateRecordedAuditorOutput } from "./auditor-output.js";
+import { EVIDENCE_CHILD_ACCEPTED_TEXT, EVIDENCE_CHILD_OUTPUT_TOOL_NAME, validateRecordedEvidenceChildOutput } from "./evidence-child-output.js";
 import { MERGER_ACCEPTED_TEXT, MERGER_OUTPUT_TOOL_NAME, validateMergerOutput } from "../merger-contracts.js";
 import { NOTARY_ACCEPTED_TEXT, NOTARY_OUTPUT_TOOL_NAME, validateRecordedNotaryOutput } from "../notary-contracts.js";
 import { COUNTERSIGN_ACCEPTED_TEXT, COUNTERSIGN_OUTPUT_TOOL_NAME, validateRecordedCountersignOutput } from "../countersign-contracts.js";
 import { GLEANER_LEFT_ACCEPTED_TEXT, GLEANER_LEFT_OUTPUT_TOOL_NAME, validateRecordedGleanerLeftOutput } from "../gleaner-left-contracts.js";
 import { INSPECTOR_ACCEPTED_TEXT, INSPECTOR_OUTPUT_TOOL_NAME, validateRecordedInspectorOutput } from "../inspector-contracts.js";
+import { DIARIST_ACCEPTED_TEXT, DIARIST_OUTPUT_TOOL_NAME, validateRecordedDiaristOutput } from "../diarist-contracts.js";
 import { CODER_ACCEPTED_TEXT, CODER_OUTPUT_TOOL_NAME, FIXER_ACCEPTED_TEXT, FIXER_OUTPUT_TOOL_NAME, validateAcceptedWorkerDetails, } from "./worker-output.js";
-export { CODER_ACCEPTED_TEXT, CODER_OUTPUT_TOOL_NAME, COLLECTOR_ACCEPTED_TEXT, COLLECTOR_OUTPUT_TOOL, FIXER_ACCEPTED_TEXT, FIXER_OUTPUT_TOOL_NAME, JUDGE_ACCEPTED_TEXT, JUDGE_OUTPUT_TOOL_NAME, REVIEWER_ACCEPTED_TEXT, REVIEWER_OUTPUT_TOOL_NAME, MERGER_ACCEPTED_TEXT, MERGER_OUTPUT_TOOL_NAME, validateAcceptedCollectorReceipt, validateAcceptedJudgeDetails, projectReviewerIntentToReceipt, validateReviewerIntent, validateRuntimeReviewerReceipt, validateAcceptedWorkerDetails, validateDoctorSubmissionShape, validateRecordedDoctorOutput, validateMergerOutput, validateRecordedNotaryOutput, validateRecordedCountersignOutput, validateRecordedGleanerLeftOutput, validateRecordedInspectorOutput, validateRecordedGatekeeperOutput, validateRecordedNavigatorOutput, };
+export { CODER_ACCEPTED_TEXT, CODER_OUTPUT_TOOL_NAME, COLLECTOR_ACCEPTED_TEXT, COLLECTOR_OUTPUT_TOOL, FIXER_ACCEPTED_TEXT, FIXER_OUTPUT_TOOL_NAME, JUDGE_ACCEPTED_TEXT, JUDGE_OUTPUT_TOOL_NAME, REVIEWER_ACCEPTED_TEXT, REVIEWER_OUTPUT_TOOL_NAME, MERGER_ACCEPTED_TEXT, MERGER_OUTPUT_TOOL_NAME, validateAcceptedCollectorReceipt, validateAcceptedJudgeDetails, projectReviewerIntentToReceipt, validateReviewerIntent, validateRuntimeReviewerReceipt, validateAcceptedWorkerDetails, validateDoctorSubmissionShape, validateRecordedDoctorOutput, validateMergerOutput, validateRecordedNotaryOutput, validateRecordedCountersignOutput, validateRecordedGleanerLeftOutput, validateRecordedInspectorOutput, validateRecordedGatekeeperOutput, validateRecordedNavigatorOutput, validateRecordedAuditorOutput, validateRecordedEvidenceChildOutput, validateRecordedDiaristOutput, };
 export const TERMINATING_TOOL_NAMES = [
     CODER_OUTPUT_TOOL_NAME,
     FIXER_OUTPUT_TOOL_NAME,
@@ -31,6 +34,9 @@ export const TERMINATING_TOOL_NAMES = [
     INSPECTOR_OUTPUT_TOOL_NAME,
     GATEKEEPER_OUTPUT_TOOL_NAME,
     NAVIGATOR_OUTPUT_TOOL_NAME,
+    AUDITOR_OUTPUT_TOOL_NAME,
+    EVIDENCE_CHILD_OUTPUT_TOOL_NAME,
+    DIARIST_OUTPUT_TOOL_NAME,
 ];
 export function isTerminatingToolName(name) {
     return TERMINATING_TOOL_NAMES.includes(name);
@@ -63,6 +69,12 @@ export function acceptedTextFor(toolName) {
             return GATEKEEPER_ACCEPTED_TEXT;
         case NAVIGATOR_OUTPUT_TOOL_NAME:
             return NAVIGATOR_ACCEPTED_TEXT;
+        case AUDITOR_OUTPUT_TOOL_NAME:
+            return AUDITOR_ACCEPTED_TEXT;
+        case EVIDENCE_CHILD_OUTPUT_TOOL_NAME:
+            return EVIDENCE_CHILD_ACCEPTED_TEXT;
+        case DIARIST_OUTPUT_TOOL_NAME:
+            return DIARIST_ACCEPTED_TEXT;
     }
 }
 export class AcceptedDetailsContractError extends CorrectableSubmissionError {
@@ -114,13 +126,21 @@ export function validateAcceptedDetails(toolName, details) {
         [INSPECTOR_OUTPUT_TOOL_NAME]: ["pass", "bounce"],
         [GATEKEEPER_OUTPUT_TOOL_NAME]: ["dispatch", "pass"],
         [NAVIGATOR_OUTPUT_TOOL_NAME]: ["advice"],
+        [AUDITOR_OUTPUT_TOOL_NAME]: ["pass", "revise", "escalate"],
+        [EVIDENCE_CHILD_OUTPUT_TOOL_NAME]: [],
+        [DIARIST_OUTPUT_TOOL_NAME]: ["completed"],
     };
     const collectorDiscriminator = toolName === COLLECTOR_OUTPUT_TOOL && Array.isArray(candidate?.groups);
+    // Evidence-child: any object is a candidate body — no report-field presence gate (#675 / ADR 0055).
+    const evidenceChildDiscriminator = toolName === EVIDENCE_CHILD_OUTPUT_TOOL_NAME
+        && candidate !== null
+        && typeof candidate === "object"
+        && !Array.isArray(candidate);
     const baseDiscriminator = discriminator;
     const runtimeBindingMissing = (toolName === DOCTOR_OUTPUT_TOOL_NAME && baseDiscriminator === "completed" && !(candidate?.cost !== null && typeof candidate?.cost === "object")) ||
         (toolName === REVIEWER_OUTPUT_TOOL_NAME && candidate?.version !== 2);
     if (runtimeBindingMissing ||
-        (!collectorDiscriminator && (typeof discriminator !== "string" || !lawfulStatuses[toolName].includes(baseDiscriminator)))) {
+        (!collectorDiscriminator && !evidenceChildDiscriminator && (typeof discriminator !== "string" || !lawfulStatuses[toolName].includes(baseDiscriminator)))) {
         throw new AcceptedDetailsContractError("terminating receipt has no recognized execution discriminator");
     }
     try {
@@ -151,6 +171,12 @@ export function validateAcceptedDetails(toolName, details) {
                 return validateRecordedGatekeeperOutput(details);
             case NAVIGATOR_OUTPUT_TOOL_NAME:
                 return validateRecordedNavigatorOutput(details);
+            case AUDITOR_OUTPUT_TOOL_NAME:
+                return validateRecordedAuditorOutput(details);
+            case EVIDENCE_CHILD_OUTPUT_TOOL_NAME:
+                return validateRecordedEvidenceChildOutput(details);
+            case DIARIST_OUTPUT_TOOL_NAME:
+                return validateRecordedDiaristOutput(details);
         }
     }
     catch (error) {
@@ -177,6 +203,16 @@ export function validateAcceptedLifecycle(toolName, argumentsValue, detailsValue
             throw new Error("accepted tool lifecycle details mismatch");
         return details;
     }
+    if (toolName === DIARIST_OUTPUT_TOOL_NAME) {
+        // Envelope-owned mechanical sitian facts are runtime-bound on details only
+        // (same shape as the Doctor runtime cost); the submitted arguments carry the
+        // role's own selections. Machine facts never come from model self-report.
+        const { sitian: _mechanical, ...submitted } = details;
+        const testimony = validateAcceptedDetails(toolName, argumentsValue);
+        if (!deepEqual(testimony, submitted))
+            throw new Error("accepted tool lifecycle details mismatch");
+        return details;
+    }
     const argumentsDetails = validateAcceptedDetails(toolName, argumentsValue);
     if (!deepEqual(argumentsDetails, details))
         throw new Error("accepted tool lifecycle details mismatch");
@@ -192,7 +228,12 @@ export function acceptedFacts(toolName, details) {
         case GLEANER_LEFT_OUTPUT_TOOL_NAME:
         case INSPECTOR_OUTPUT_TOOL_NAME:
         case GATEKEEPER_OUTPUT_TOOL_NAME:
-        case NAVIGATOR_OUTPUT_TOOL_NAME: return { status: details.status };
+        case NAVIGATOR_OUTPUT_TOOL_NAME:
+        case AUDITOR_OUTPUT_TOOL_NAME:
+            return { status: details.status };
+        case EVIDENCE_CHILD_OUTPUT_TOOL_NAME:
+            return { status: "report" };
+        case DIARIST_OUTPUT_TOOL_NAME: return { status: details.status };
         case JUDGE_OUTPUT_TOOL_NAME: return { status: details.judgeStatus };
         case COUNTERSIGN_OUTPUT_TOOL_NAME: return { status: details.countersignStatus };
         case MERGER_OUTPUT_TOOL_NAME: {

package/dist/package-resources/method-skill.js

@@ -0,0 +1,254 @@
+/**
+ * Package-owned role method Skill seam (ADR 0052 / #109).
+ * Forced methods load from the installed package copy — never ambient home discovery.
+ *
+ * This module is intentionally free of @earendil-works/pi-coding-agent so the
+ * public ak-role bin can load provenance/path without bundling peer runtime.
+ */
+import { createHash } from "node:crypto";
+import { readFile, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { sha256Hex } from "../sha256.js";
+/** Package-side unavailable method Skill (mirrors CanonicalSkillUnavailableError identity). */
+export class PackagedMethodSkillUnavailableError extends Error {
+    skillName;
+    code = "canonical-skill-unavailable";
+    constructor(skillName, path, cause) {
+        super(`Canonical ${skillName} Skill is unavailable at ${path}`, { cause });
+        this.skillName = skillName;
+        this.name = "CanonicalSkillUnavailableError";
+    }
+}
+const METHOD_SKILL_RELATIVE_ROOT = "resources/methods";
+const GIT_COMMIT_RE = /^[0-9a-f]{40}$/;
+const GIT_BLOB_RE = /^[0-9a-f]{40}$/;
+const SHA256_RE = /^[0-9a-f]{64}$/;
+const REQUIRED_COMPANIONS = {
+    tdd: ["tests.md", "mocking.md", "agents/openai.yaml"],
+    "diagnosing-bugs": ["agents/openai.yaml", "scripts/hitl-loop.template.sh"],
+    "code-review": ["agents/openai.yaml"],
+    "resolving-merge-conflicts": ["agents/openai.yaml"],
+};
+/** Git blob OID for raw file bytes (sha1 of `blob <size>\\0` + content). */
+export function gitBlobOid(bytes) {
+    const body = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : Buffer.from(bytes);
+    const header = Buffer.from(`blob ${body.byteLength}\0`, "utf8");
+    return createHash("sha1").update(header).update(body).digest("hex");
+}
+/** Minimal frontmatter strip — body after closing `---` fence (or full text). */
+export function stripSkillFrontmatter(content) {
+    if (!content.startsWith("---"))
+        return content;
+    const end = content.indexOf("\n---", 3);
+    if (end === -1)
+        return content;
+    const after = content.slice(end + "\n---".length);
+    return after.replace(/^\r?\n/, "");
+}
+export function packagedMethodSkillRelativeDirectory(name) {
+    return `${METHOD_SKILL_RELATIVE_ROOT}/${name}`;
+}
+export function resolvePackagedMethodSkillRoot(packageRoot, name) {
+    return join(packageRoot, packagedMethodSkillRelativeDirectory(name));
+}
+export function resolvePackagedMethodSkillPath(packageRoot, name) {
+    return join(resolvePackagedMethodSkillRoot(packageRoot, name), "SKILL.md");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseProvenance(raw, expectedName) {
+    if (!isRecord(raw)) {
+        throw new Error(`Packaged method provenance must be an object for ${expectedName}`);
+    }
+    if (raw.name !== expectedName) {
+        throw new Error(`Packaged method provenance name mismatch: expected ${expectedName}, got ${String(raw.name)}`);
+    }
+    if (raw.kind !== "role-method-skill") {
+        throw new Error(`Packaged method provenance kind must be role-method-skill`);
+    }
+    if (typeof raw.packageAdaptation !== "string" || raw.packageAdaptation.trim() === "") {
+        throw new Error(`Packaged method provenance packageAdaptation must be nonblank`);
+    }
+    if (!isRecord(raw.upstream)) {
+        throw new Error(`Packaged method provenance upstream must be an object`);
+    }
+    const upstream = raw.upstream;
+    for (const key of [
+        "repository",
+        "path",
+        "license",
+        "copyright",
+        "attribution",
+    ]) {
+        if (typeof upstream[key] !== "string" || upstream[key].trim() === "") {
+            throw new Error(`Packaged method provenance upstream.${key} must be nonblank`);
+        }
+    }
+    if (typeof upstream.commit !== "string" || !GIT_COMMIT_RE.test(upstream.commit)) {
+        throw new Error(`Packaged method provenance upstream.commit must be a 40-char lowercase git object id`);
+    }
+    const tag = typeof upstream.tag === "string" && upstream.tag.trim() !== ""
+        ? upstream.tag.trim()
+        : undefined;
+    const version = typeof upstream.version === "string" && upstream.version.trim() !== ""
+        ? upstream.version.trim()
+        : undefined;
+    if (tag === undefined && version === undefined) {
+        throw new Error(`Packaged method provenance upstream must include nonblank tag or version`);
+    }
+    if (!isRecord(raw.files)) {
+        throw new Error(`Packaged method provenance files must be an object`);
+    }
+    const files = {};
+    for (const [rel, entry] of Object.entries(raw.files)) {
+        if (!isRecord(entry)) {
+            throw new Error(`Packaged method provenance file entry must be an object: ${rel}`);
+        }
+        if (typeof entry.sha256 !== "string" || !SHA256_RE.test(entry.sha256)) {
+            throw new Error(`Packaged method provenance file sha256 invalid: ${rel}`);
+        }
+        if (typeof entry.byteLength !== "number" ||
+            !Number.isInteger(entry.byteLength) ||
+            entry.byteLength < 0) {
+            throw new Error(`Packaged method provenance file byteLength invalid: ${rel}`);
+        }
+        if (typeof entry.gitBlob !== "string" || !GIT_BLOB_RE.test(entry.gitBlob)) {
+            throw new Error(`Packaged method provenance file gitBlob must be a 40-char lowercase git object id: ${rel}`);
+        }
+        files[rel] = {
+            sha256: entry.sha256,
+            byteLength: entry.byteLength,
+            gitBlob: entry.gitBlob,
+        };
+    }
+    if (files["SKILL.md"] === undefined) {
+        throw new Error(`Packaged method provenance must include SKILL.md`);
+    }
+    return Object.freeze({
+        name: expectedName,
+        kind: "role-method-skill",
+        packageAdaptation: raw.packageAdaptation,
+        upstream: Object.freeze({
+            repository: upstream.repository,
+            path: upstream.path,
+            commit: upstream.commit,
+            ...(tag === undefined ? {} : { tag }),
+            ...(version === undefined ? {} : { version }),
+            license: upstream.license,
+            copyright: upstream.copyright,
+            attribution: upstream.attribution,
+        }),
+        files: Object.freeze(files),
+    });
+}
+/**
+ * Load a package-owned method Skill and verify per-file provenance digests.
+ * Does not consult HOME or ambient Skill discovery paths.
+ */
+export async function loadPackagedMethodSkillMaterial(packageRoot, name) {
+    const rootDirectory = resolvePackagedMethodSkillRoot(packageRoot, name);
+    const skillPathConfigured = join(rootDirectory, "SKILL.md");
+    const provenancePath = join(rootDirectory, "provenance.json");
+    let provenanceRaw;
+    try {
+        provenanceRaw = await readFile(provenancePath, "utf8");
+    }
+    catch (error) {
+        throw new PackagedMethodSkillUnavailableError(name, provenancePath, error);
+    }
+    let provenanceJson;
+    try {
+        provenanceJson = JSON.parse(provenanceRaw);
+    }
+    catch (error) {
+        throw new Error(`Packaged method provenance is not valid JSON at ${provenancePath}`, {
+            cause: error,
+        });
+    }
+    const provenance = parseProvenance(provenanceJson, name);
+    // Verify every declared file digest + independent git blob against package bytes (no network).
+    for (const [rel, expected] of Object.entries(provenance.files)) {
+        const absolute = join(rootDirectory, rel);
+        let bytes;
+        try {
+            bytes = await readFile(absolute);
+        }
+        catch (error) {
+            throw new PackagedMethodSkillUnavailableError(name, absolute, error);
+        }
+        const actualSha = sha256Hex(bytes);
+        const actualBlob = gitBlobOid(bytes);
+        if (actualSha !== expected.sha256 ||
+            bytes.byteLength !== expected.byteLength ||
+            actualBlob !== expected.gitBlob) {
+            throw new Error(`Packaged method file digest mismatch for ${name}/${rel}: expected sha256=${expected.sha256} byteLength=${expected.byteLength} gitBlob=${expected.gitBlob}, got sha256=${actualSha} byteLength=${bytes.byteLength} gitBlob=${actualBlob}`);
+        }
+    }
+    let skillPath;
+    let raw;
+    try {
+        skillPath = await realpath(skillPathConfigured);
+        raw = await readFile(skillPath, "utf8");
+    }
+    catch (error) {
+        throw new PackagedMethodSkillUnavailableError(name, skillPathConfigured, error);
+    }
+    const body = stripSkillFrontmatter(raw).trim();
+    if (body.length === 0) {
+        throw new Error(`Canonical ${name} Skill is empty at ${skillPath}`);
+    }
+    const companionRelativePaths = REQUIRED_COMPANIONS[name].filter((rel) => provenance.files[rel] !== undefined);
+    for (const rel of REQUIRED_COMPANIONS[name]) {
+        if (provenance.files[rel] === undefined) {
+            throw new Error(`Packaged method ${name} missing required companion in provenance: ${rel}`);
+        }
+    }
+    return Object.freeze({
+        name,
+        rootDirectory,
+        skillPath,
+        raw,
+        body,
+        provenance,
+        companionRelativePaths: Object.freeze([...companionRelativePaths]),
+    });
+}
+/**
+ * Observe one Pi-native packaged method Skill expansion from a user-turn text.
+ * Matches the structured `<skill name location>` block format only; rejects ambient
+ * home locations that are not in the allowed package path set.
+ */
+export function observePackagedMethodSkillInvocation(text, expected) {
+    // Structured skill-block grammar (same shape Pi expands); not free-text classification.
+    if (!text.startsWith("<skill name=\""))
+        return undefined;
+    const nameStart = "<skill name=\"".length;
+    const nameEnd = text.indexOf("\"", nameStart);
+    if (nameEnd <= nameStart)
+        return undefined;
+    const name = text.slice(nameStart, nameEnd);
+    if (name !== expected.name)
+        return undefined;
+    const locationMarker = "\" location=\"";
+    if (!text.startsWith(locationMarker, nameEnd))
+        return undefined;
+    const locationStart = nameEnd + locationMarker.length;
+    const locationEnd = text.indexOf("\"", locationStart);
+    if (locationEnd <= locationStart)
+        return undefined;
+    const location = text.slice(locationStart, locationEnd);
+    const openTail = ">\n";
+    if (!text.startsWith(openTail, locationEnd + 1))
+        return undefined;
+    const closeTag = "\n</skill>";
+    const closeAt = text.indexOf(closeTag, locationEnd + 1 + openTail.length);
+    if (closeAt === -1)
+        return undefined;
+    const afterClose = text.slice(closeAt + closeTag.length);
+    if (afterClose.length > 0 && !afterClose.startsWith("\n"))
+        return undefined;
+    if (!expected.allowedLocations.includes(location))
+        return undefined;
+    return Object.freeze({ name: expected.name, location });
+}

package/dist/packaged-role-registry.js

@@ -10,6 +10,12 @@ import { NOTARY_OUTPUT_TOOL_NAME } from "./notary-contracts.js";
 import { COUNTERSIGN_OUTPUT_TOOL_NAME } from "./countersign-contracts.js";
 import { GLEANER_LEFT_OUTPUT_TOOL_NAME } from "./gleaner-left-contracts.js";
 import { INSPECTOR_OUTPUT_TOOL_NAME } from "./inspector-contracts.js";
+import { AUDITOR_OUTPUT_TOOL_NAME } from "./package-contracts/auditor-output.js";
+import { EVIDENCE_CHILD_OUTPUT_TOOL_NAME } from "./package-contracts/evidence-child-output.js";
+import {
+  DIARIST_OUTPUT_TOOL_NAME,
+  DIARIST_SOURCES_FLAG
+} from "./diarist-contracts.js";
 const NOTARY_SESSION_MATERIALS = [
   "CLAUDE.md",
   "souls/notary.md",
@@ -23,6 +29,19 @@ const INSPECTOR_SESSION_MATERIALS = [
   "souls/quality-law.md",
   "souls/gate-output-guide.md"
 ];
+const AUDITOR_PUBLIC_SESSION_MATERIALS = [
+  "CLAUDE.md",
+  "souls/judge-auditor.md",
+  "souls/doctor-auditor.md",
+  "souls/audit-law.md",
+  "souls/quality-law.md"
+];
+const EVIDENCE_CHILD_SESSION_MATERIALS = [
+  "CLAUDE.md",
+  "souls/evidence-child.md",
+  "souls/audit-law.md",
+  "souls/quality-law.md"
+];
 const PUBLIC_ROLE_RECORDS = [
   {
     role: "judge",
@@ -175,6 +194,41 @@ const PUBLIC_ROLE_RECORDS = [
     phaseFlag: void 0,
     activationStage: "load-and-install",
     sessionMaterials: ["CLAUDE.md", "souls/navigator.md"]
+  },
+  // #675: 审刑院 / evidence-child are roles like any other — public ak-role entries.
+  {
+    role: "auditor",
+    phases: [null],
+    outputTool: AUDITOR_OUTPUT_TOOL_NAME,
+    inputFlag: void 0,
+    phaseFlag: void 0,
+    activationStage: "load-and-install",
+    sessionMaterials: AUDITOR_PUBLIC_SESSION_MATERIALS
+  },
+  {
+    role: "evidence-child",
+    phases: [null],
+    outputTool: EVIDENCE_CHILD_OUTPUT_TOOL_NAME,
+    inputFlag: void 0,
+    phaseFlag: void 0,
+    activationStage: "load-and-install",
+    sessionMaterials: EVIDENCE_CHILD_SESSION_MATERIALS
+  },
+  // #708 / ADR 0075 `diarist-is-role`: 起居郎 is a seat like any other. The
+  // frozen source catalog rides the shared input-flag seam; it is absent for a
+  // true-unbound summons (no ticket → no diary).
+  {
+    role: "diarist",
+    phases: [null],
+    outputTool: DIARIST_OUTPUT_TOOL_NAME,
+    inputFlag: DIARIST_SOURCES_FLAG.name,
+    phaseFlag: void 0,
+    activationStage: "load-and-install",
+    sessionMaterials: [
+      "CLAUDE.md",
+      "souls/diarist.md",
+      "resources/diarist-collect.md"
+    ]
   }
 ];
 const PACKAGED_ROLE_REGISTRY = PUBLIC_ROLE_RECORDS.map(({ sessionMaterials: _omit, ...metadata }) => metadata);
@@ -191,6 +245,8 @@ function packagedRoleOutputTool(role) {
   return packagedRoleMetadata(role)?.outputTool;
 }
 export {
+  AUDITOR_PUBLIC_SESSION_MATERIALS,
+  EVIDENCE_CHILD_SESSION_MATERIALS,
   INSPECTOR_SESSION_MATERIALS,
   NOTARY_SESSION_MATERIALS,
   PACKAGED_ROLE_REGISTRY,

package/dist/pi/durable-principal.js

@@ -0,0 +1,61 @@
+import { lstat } from "node:fs/promises";
+import { join } from "node:path";
+import { resolveBookKeyFromGit } from "../activation-ledger-git.js";
+import { activationBookDirectory, resolveActivationLedgerHome, } from "../activation-ledger-topology.js";
+function encode(coordinates) {
+    return coordinates;
+}
+export function issuePiDurablePrincipalCoordinates(request) {
+    const ledgerHome = resolveActivationLedgerHome(request.home);
+    const bookKey = resolveBookKeyFromGit(request.cwd);
+    const runDirectory = join(activationBookDirectory(ledgerHome, bookKey), "runs", `${request.runId}@${request.role}`);
+    const sessionDirectory = join(runDirectory, "session");
+    return {
+        ledgerHome,
+        bookKey,
+        runDirectory,
+        sessionDirectory,
+        sessionFile: join(sessionDirectory, "session.jsonl"),
+    };
+}
+/** Pi's durable-principal codec and availability authority. */
+export const piDurablePrincipalAuthority = {
+    issue(request) {
+        const coordinates = issuePiDurablePrincipalCoordinates(request);
+        return encode({
+            sessionDirectory: coordinates.sessionDirectory,
+            sessionFile: coordinates.sessionFile,
+        });
+    },
+    seal(coordinates) {
+        return encode({
+            sessionDirectory: coordinates.sessionDirectory,
+            sessionFile: coordinates.sessionFile,
+        });
+    },
+    decode(value) {
+        const record = value;
+        if (record === null || typeof record !== "object") {
+            throw new Error("durable principal payload is missing");
+        }
+        if (typeof record.sessionDirectory !== "string" || record.sessionDirectory.trim() === "") {
+            throw new Error("durable principal session directory is missing");
+        }
+        return {
+            sessionDirectory: record.sessionDirectory,
+            sessionFile: typeof record.sessionFile === "string" && record.sessionFile.trim() !== ""
+                ? record.sessionFile
+                : join(record.sessionDirectory, "session.jsonl"),
+        };
+    },
+    async isAvailable(principal) {
+        const { sessionFile } = this.decode(principal);
+        try {
+            const stat = await lstat(sessionFile);
+            return stat.isFile() && !stat.isSymbolicLink();
+        }
+        catch {
+            return false;
+        }
+    },
+};

package/dist/pi/in-process-session.js

@@ -129,7 +129,7 @@ function enrichStreamEvent(event, observedHttpStatus) {
   }
   return event;
 }
-async function openPiInstitutionalSession(options) {
+async function openPiInProcessSession(options) {
   const label = options.label ?? "Institutional sub-session";
   const selection = options.selection;
   let scratchDir;
@@ -457,10 +457,17 @@ async function openPiInstitutionalSession(options) {
         });
       }
     }
+    const requestedThinking = selection.thinking;
+    const priorEntries = typeof sessionManager.getEntries === "function" ? sessionManager.getEntries() : [];
+    const reusedSession = priorEntries.some((entry) => {
+      if (typeof entry !== "object" || entry === null) return false;
+      const type = entry.type;
+      return type === "message" || type === "model_change" || type === "thinking_level_change";
+    });
     const { session } = await createAgentSession({
       cwd: options.cwd,
       model: effectiveModel,
-      ...options.selection.thinking === void 0 ? {} : { thinkingLevel: options.selection.thinking },
+      ...requestedThinking === void 0 ? {} : { thinkingLevel: requestedThinking },
       modelRuntime: runtime,
       sessionManager,
       settingsManager: settings,
@@ -470,9 +477,21 @@ async function openPiInstitutionalSession(options) {
       ...options.toolsAllowlist === void 0 ? {} : { tools: options.toolsAllowlist },
       ...customTools.length === 0 ? {} : { customTools }
     });
-    await session.setModel(effectiveModel);
-    if (options.selection.thinking !== void 0) {
-      session.setThinkingLevel(options.selection.thinking);
+    if (reusedSession) {
+      try {
+        await session.setModel(effectiveModel);
+        if (requestedThinking !== void 0) {
+          session.setThinkingLevel(requestedThinking);
+        }
+      } catch (error) {
+        session.dispose();
+        throw withTypedReason(
+          error instanceof Error ? error : new Error(
+            `${label} failed to apply seat model/thinking for ${selection.provider}/${selection.model}`
+          ),
+          requestedThinking !== void 0 ? "thinking" : "model"
+        );
+      }
     }
     const listeners = /* @__PURE__ */ new Set();
     const accumulatedUsage = emptyUsage();
@@ -637,5 +656,5 @@ async function openPiInstitutionalSession(options) {
 }
 export {
   DEFAULT_COMPLIANCE_IDLE_MAX_RETRIES,
-  openPiInstitutionalSession
+  openPiInProcessSession
 };

package/dist/pi/known-failure.js

@@ -0,0 +1,52 @@
+import { hasUpstreamErrorTestimony, projectConfirmedRemotePayload, } from "../upstream-error-testimony.js";
+export { hasUpstreamErrorTestimony } from "../upstream-error-testimony.js";
+function nonEmptyString(value) {
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+function sessionStopDetails(input) {
+    const details = {};
+    const errorMessage = nonEmptyString(input.errorMessage);
+    if (errorMessage !== undefined)
+        details.errorMessage = errorMessage;
+    const api = nonEmptyString(input.api);
+    if (api !== undefined)
+        details.api = api;
+    const rawStopReason = nonEmptyString(input.rawStopReason);
+    if (rawStopReason !== undefined)
+        details.rawStopReason = rawStopReason;
+    const testimony = hasUpstreamErrorTestimony(input);
+    if (testimony) {
+        const provider = nonEmptyString(input.provider);
+        if (provider !== undefined)
+            details.provider = provider;
+        const model = nonEmptyString(input.model);
+        if (model !== undefined)
+            details.model = model;
+    }
+    if (typeof input.httpStatus === "number")
+        details.httpStatus = input.httpStatus;
+    if (input.diagnostics !== undefined)
+        details.diagnostics = input.diagnostics;
+    // SDK structured payload fields: project only when held on a confirmed-remote node.
+    if (testimony)
+        Object.assign(details, projectConfirmedRemotePayload(input));
+    return details;
+}
+/**
+ * Project a native session assistant stop onto the existing knownFailure chain.
+ * Classification follows two-way testimony: typed HTTP status or SDK structure
+ * keeps provider; stopReason, configured provider/model, or errorMessage prose
+ * alone is the existing unrecognized value. Present upstream payload is preserved
+ * in details without rewriting; missing fields are omitted.
+ */
+export function knownFailureFromProviderStop(input) {
+    if (input.stopReason !== "error" && input.stopReason !== "aborted")
+        return undefined;
+    const diagnostic = nonEmptyString(input.errorMessage);
+    const details = sessionStopDetails(input);
+    return {
+        cause: hasUpstreamErrorTestimony(input) ? "provider" : "unrecognized",
+        ...(diagnostic === undefined ? {} : { diagnostic }),
+        ...(Object.keys(details).length === 0 ? {} : { details }),
+    };
+}