@akagilnc/pi-workflow-roles 0.1.3565 → 0.1.3621

package/src/institutional-resolution.ts

@@ -1,6 +1,9 @@
-import { readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import type { RoleTurnModelConfig } from "./host-contracts.ts";
+/**
+ * Province-officer model authority (#453/#620) and shared seatModelOnly projection.
+ * #675 deleted the independent institutional-resolution.json seat page and the
+ * child-session open path that consumed it. Seat resolution for every activation
+ * is the live public seat table (model/host/engine).
+ */
 import type {
   GateOfficerSeat,
   PublicCliConfig,
@@ -8,70 +11,20 @@ import type {
 } from "./public-cli/config.ts";
 import { seatModelOnly } from "./public-cli/registry.ts";
 
-export const INSTITUTIONAL_RESOLUTION_FILE = "institutional-resolution.json" as const;
-
-/** Non-secret per-seat model selection — alias of the single host-neutral RoleTurnModelConfig. */
-export type InstitutionalSeatSelection = RoleTurnModelConfig;
-
 /**
  * Configured province-officer resolution (#453/#620 authority seam):
  * officer persistent > gatekeeper persistent > unconfigured.
- * No startup candidates and no parent-session fallback — parent compose stays
- * in resolveInstitutionalSeatSelections; direct call and config display consume
- * this typed result as-is.
+ * No startup candidates and no parent-session fallback — direct call and config
+ * display consume this typed result as-is.
  */
 export type ConfiguredProvinceOfficerResolution = {
   readonly selection?: SeatModelConfig;
   readonly source: "persistent" | "inherit-gatekeeper" | "unconfigured";
 };
 
-export type InstitutionalResolutionPage = {
-  readonly version: 1;
-  readonly seats: {
-    readonly gatekeeper?: InstitutionalSeatSelection;
-    readonly inspector?: InstitutionalSeatSelection;
-    readonly notary?: InstitutionalSeatSelection;
-    readonly auditor?: InstitutionalSeatSelection;
-    readonly evidenceChild?: InstitutionalSeatSelection;
-    readonly [seat: string]: InstitutionalSeatSelection | undefined;
-  };
-};
-
-/** Why institutional seat read failed — structured, not free-text. */
-export type InstitutionalResolutionFailureReason =
-  | "missing-page"
-  | "missing-seat"
-  | "corrupted"
-  | "invalid-format";
-
-export class InstitutionalResolutionError extends Error {
-  readonly reason: InstitutionalResolutionFailureReason;
-  constructor(
-    message: string,
-    reason: InstitutionalResolutionFailureReason,
-    options?: ErrorOptions,
-  ) {
-    super(message, options);
-    this.name = "InstitutionalResolutionError";
-    this.reason = reason;
-  }
-}
-
-function cleanSelection(model?: { provider?: string; model?: string; thinking?: string }): InstitutionalSeatSelection | undefined {
-  if (model === undefined) return undefined;
-  if (typeof model.provider !== "string" || typeof model.model !== "string") return undefined;
-  return {
-    provider: model.provider,
-    model: model.model,
-    ...(model.thinking === undefined ? {} : { thinking: model.thinking }),
-  };
-}
-
 /**
  * Authority for configured province-officer model+source (#453/#620):
  * own persistent > gatekeeper persistent > unconfigured.
- * Shared by resolveInstitutionalSeatSelections (plus parent fallback),
- * resolveEffectiveSeat subordinate branch, and roles/config display.
  * Model-axis projection stays seatModelOnly (single implementation in registry).
  */
 export function resolveConfiguredProvinceOfficer(
@@ -91,111 +44,3 @@ export function resolveConfiguredProvinceOfficer(
   }
   return { source: "unconfigured" };
 }
-
-/**
- * Resolve effective per-seat institutional selections (#518 §2 Hop 1; #620):
- * - gatekeeper / inspector / notary: resolveConfiguredProvinceOfficer then
- *   parent effective on the province path only
- * - auditor / evidenceChild: parent effective
- * - navigator: explicit config seat only. Navigator model authority stays
- *   `navigator-model.json`; the page never carries a parent-inherited navigator
- *   seat, so host-neutral transport cannot shadow that setting (#590 Out of Scope:
- *   席位表／模型路由变更归 owner 域).
- */
-export function resolveInstitutionalSeatSelections(
-  config: PublicCliConfig,
-  parentEffectiveModel?: { provider: string; model: string; thinking?: string },
-): InstitutionalResolutionPage {
-  const parentSelection = cleanSelection(parentEffectiveModel);
-
-  const gatekeeper =
-    resolveConfiguredProvinceOfficer(config, "gatekeeper").selection ?? parentSelection;
-  const inspector =
-    resolveConfiguredProvinceOfficer(config, "inspector").selection ?? parentSelection;
-  const notary =
-    resolveConfiguredProvinceOfficer(config, "notary").selection ?? parentSelection;
-  const auditor = parentSelection;
-  const evidenceChild = parentSelection;
-  const navigator = cleanSelection(seatModelOnly(config.seats?.navigator));
-
-  return {
-    version: 1,
-    seats: {
-      ...(gatekeeper === undefined ? {} : { gatekeeper }),
-      ...(inspector === undefined ? {} : { inspector }),
-      ...(notary === undefined ? {} : { notary }),
-      ...(auditor === undefined ? {} : { auditor }),
-      ...(evidenceChild === undefined ? {} : { evidenceChild }),
-      ...(navigator === undefined ? {} : { navigator }),
-    },
-  };
-}
-
-/**
- * Persist institutional resolution page to run directory (#518 §2 Hop 2).
- * Rewritten on each dispatch and resume. Zero secrets inside page.
- */
-export async function writeInstitutionalResolutionPage(
-  runDirectory: string,
-  page: InstitutionalResolutionPage,
-): Promise<void> {
-  const filePath = join(runDirectory, INSTITUTIONAL_RESOLUTION_FILE);
-  await writeFile(filePath, `${JSON.stringify(page, null, 2)}\n`, "utf8");
-}
-
-/**
- * Read institutional seat selection from run directory (#518 §2 Hop 3).
- * Fails loud if page is missing, corrupted, or does not contain a resolution for the seat.
- */
-export async function readInstitutionalSeatSelection(
-  runDirectory: string,
-  seat: string,
-): Promise<InstitutionalSeatSelection> {
-  const filePath = join(runDirectory, INSTITUTIONAL_RESOLUTION_FILE);
-  let raw: string;
-  try {
-    raw = await readFile(filePath, "utf8");
-  } catch (error) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page is missing at ${filePath}`,
-      "missing-page",
-      { cause: error },
-    );
-  }
-
-  let page: unknown;
-  try {
-    page = JSON.parse(raw);
-  } catch (error) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page is corrupted at ${filePath}`,
-      "corrupted",
-      { cause: error },
-    );
-  }
-
-  if (typeof page !== "object" || page === null || (page as { version?: unknown }).version !== 1) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page format is invalid at ${filePath}`,
-      "invalid-format",
-    );
-  }
-
-  const seats = (page as { seats?: Record<string, unknown> }).seats;
-  if (typeof seats !== "object" || seats === null) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page missing seats object at ${filePath}`,
-      "invalid-format",
-    );
-  }
-
-  const selection = cleanSelection(seats[seat] as InstitutionalSeatSelection | undefined);
-  if (selection === undefined) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page has no resolution for seat "${seat}" at ${filePath}`,
-      "missing-seat",
-    );
-  }
-
-  return selection;
-}

package/src/judge-auditor.ts

@@ -1,10 +1,9 @@
 import {
-  createComplianceDecisionTool,
   runComplianceAudit,
+  type AuditorSummon,
   type ComplianceDecision,
 } from "./compliance-transport.ts";
 import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
-import { loadAuditorSoul } from "./auditor-soul.ts";
 import {
   readJudgeAuditSubjects,
   requireAuditMaterials,
@@ -18,17 +17,13 @@ export const SOUL_AUDIT_TOOL_NAME = JUDGE_AUDIT_TOOL_NAME;
 export type JudgeAuditOptions = {
   context: HostContext;
   signal?: AbortSignal;
+  /** Same seam as runComplianceAudit options — offline tracers only. */
+  summonAuditor?: AuditorSummon;
 };
 
-const auditDecisionTool = createComplianceDecisionTool(
-  JUDGE_AUDIT_TOOL_NAME,
-  "提交 typed pass/revise/escalate 决议（大理寺审刑）。",
-);
-
 /**
- * Judge auditor: zero hand-delivered materials. Subjects recovered from the
- * parent-session books. Public CLI injects AK_ROLE_RUN_DIR; bare Pi (ADR 0052)
- * proceeds without that pointer and self-locates per soul.
+ * Judge compliance via public auditor activation (#675 / ADR 0062 / owner r11).
+ * 审刑院 is an independent role; subject=judge selects souls/judge-auditor.md.
  */
 export function createPiJudgeAuditor(): (options: JudgeAuditOptions) => Promise<ComplianceDecision> {
   return async (options) => {
@@ -38,13 +33,13 @@ export function createPiJudgeAuditor(): (options: JudgeAuditOptions) => Promise<
     requireAuditMaterials(subjects);
 
     return runComplianceAudit({
-      tool: auditDecisionTool,
-      systemPrompt: await loadAuditorSoul("judge"),
-      roleLabel: "Judge compliance audit",
-      invalidDecisionLabel: "invalid judge audit decision",
+      subject: "judge",
       context: options.context,
-      ...(auditorRunDirectory(options.context) === undefined ? {} : { runDirectory: auditorRunDirectory(options.context) }),
+      ...(auditorRunDirectory(options.context) === undefined
+        ? {}
+        : { runDirectory: auditorRunDirectory(options.context) }),
       ...(options.signal === undefined ? {} : { signal: options.signal }),
+      ...(options.summonAuditor === undefined ? {} : { summonAuditor: options.summonAuditor }),
     });
   };
 }

package/src/judge-role.ts

@@ -8,6 +8,7 @@ import { withInfrastructureFailureDeclaration } from "./package-contracts/termin
 
 import {
   JUDGE_ACCEPTED_AUDIT_NO_RECEIPT_TEXT,
+  JUDGE_ACCEPTED_AUDIT_UNREADABLE_TEXT,
   JUDGE_ACCEPTED_TEXT,
   JUDGE_OUTPUT_TOOL_NAME,
   validateAcceptedJudgeDetails,
@@ -127,6 +128,13 @@ export function createJudgeRoleRuntime(
                   terminate: true as const,
                   ...usageProjection,
                 }),
+                // ADR 0055: parent stands with typed unreadable audit fact — not forged pass.
+                unreadable: (auditUnreadable, usageProjection) => ({
+                  content: [{ type: "text" as const, text: JUDGE_ACCEPTED_AUDIT_UNREADABLE_TEXT }],
+                  details: { ...acceptedDetails, auditUnreadable },
+                  terminate: true as const,
+                  ...usageProjection,
+                }),
                 revise: (violations) => {
                   throw new Error(
                     `大理寺回执违 soul：${violations.join("; ")}`,

package/src/navigator-attendance.ts

@@ -16,7 +16,7 @@ import {
   resolveActivationLedgerHome,
 } from "./activation-ledger-topology.ts";
 import type { HostContext } from "./host-contracts.ts";
-import { createNativeNavigatorSessionFactory } from "./evidence-child-executor.ts";
+import { createNativeNavigatorSessionFactory } from "./navigator-public-session.ts";
 import {
   NAVIGATOR_DEFAULT_MODEL,
   NAVIGATOR_PREPARE_TOOL_NAME,
@@ -78,7 +78,9 @@ export function resolveNavigatorAuthorityMaterial(
   return undefined;
 }
 
-export const NAVIGATOR_TARGETS = PACKAGED_ROLE_REGISTRY.map(({ role, phases }) => ({ role, phases }));
+/** Every public role is a lawful navigator route target (#675 — no nested-only seats). */
+export const NAVIGATOR_TARGETS = PACKAGED_ROLE_REGISTRY
+  .map(({ role, phases }) => ({ role, phases }));
 
 export type NavigatorTargetRole = PackagedRole;
 export type NavigatorPhase = "plan" | "apply" | null;
@@ -591,11 +593,7 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
       const modelPromise = (async () => {
         try {
           // Same resolution authority as createNativeNavigatorSessionFactory (#590).
-          const resolved = await resolveNavigatorSeatSelection(
-            options.context,
-            options.modelSettingPath,
-            options.modelSettingPath ?? navigatorModelSettingPath(),
-          );
+          const resolved = await resolveNavigatorSeatSelection(options.context);
           return resolved.configuredLabel;
         } catch (error) {
           if (error instanceof NavigatorUnavailableError) throw error;
@@ -735,6 +733,14 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
               return;
             }
             if (promptFailure !== undefined) throw promptFailure;
+            const sessionNoReceipt = activeSession.noReceipt?.();
+            if (sessionNoReceipt !== undefined) {
+              // This session already settled without an accepted receipt on its own
+              // budget; one more prompt opens an independent summon, not a delivery
+              // request on the settled session (#675).
+              delivery.recordNestedNoReceipt(sessionNoReceipt);
+              return;
+            }
             if (deliveryRequest && output === undefined) delivery.recordDeliveryRequest();
           };
           await promptAllowingRejectedPrepare(request, false);
@@ -831,6 +837,8 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
   };
 
   async function settleOnce(settlement: NavigatorSettlement): Promise<void> {
+      // Dispose during post-role grace must ignore late completion entirely (#675).
+      if (disposed) return;
       const invocationId = activeInvocationId ?? invocationPrincipal;
       let report: NavigatorReport;
       if (settlement.kind === "human_decision" || settlement.kind === "role_infrastructure_failure") {
@@ -876,8 +884,10 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
           // table. After selection (speculative or rebound), advice is passed
           // through as-is (ADR 0010 / ADR 0061: caller may ignore).
           if (selected?.candidate.next !== undefined && !selected.matchedToSettlement) {
+            if (disposed) return;
             prepareBoundSettlement = settlement;
             prepared = await prepare();
+            if (disposed) return;
             selected = selectNavigatorCandidate(prepared, settlement);
           }
           // Budget exhaustion is affirmative typed no-advice; malformed submitted
@@ -933,10 +943,16 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
         ...(report.routePlaybookReadFailure === undefined ? {} : { routePlaybookReadFailure: report.routePlaybookReadFailure }),
         ...(report.arrivalMessage === undefined ? {} : { arrivalMessage: report.arrivalMessage }),
       };
-      // Dispose during post-role grace must ignore late completion (ADR 0052 / #106).
+      // Dispose during post-role grace must ignore late completion (ADR 0052 / #106 / #675).
       // Every settled disposition (recommendation | no-advice | unavailable | arrival) is affirmative.
-      if (!disposed) {
+      // Only the disposed bit is typed authority to drop — never match free-text Error.message.
+      if (disposed) return;
+      try {
         await options.onEvent(event, report);
+      } catch (error) {
+        // Race: dispose landed between the check and onEvent; drop only then.
+        if (disposed) return;
+        throw error;
       }
       preparation = undefined;
       sessionReady = undefined;

package/src/navigator-public-session.ts

@@ -0,0 +1,217 @@
+/**
+ * Navigator attendance session factory (#675 r3).
+ * Each prepare turn uses the public navigator activation path (summonPublicRole) —
+ * same seat table and shared envelope as `ak-role navigator`.
+ * Archivist createRecordSession only books route-memory nest under the parent;
+ * no openPiInProcessSession second lifecycle / no agentDir patch on the old path.
+ */
+import { sitianReport } from "./sitian-facade.ts";
+import {
+  NavigatorUnavailableError,
+  navigatorProviderFailureFromDiagnostics,
+  navigatorProviderFailureFromError,
+  navigatorProviderFailureFromStatus,
+  navigatorUnavailableError,
+  parseNavigatorModelSetting,
+  resolveNavigatorSeatSelection,
+  type NavigatorProviderFailureFact,
+  type NavigatorSessionFactory,
+} from "./navigator-session-contracts.ts";
+import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
+
+/**
+ * Classify public-navigator failure terminal from structured decisiveFacts only
+ * (httpStatus / diagnostics / secondaryEvidence on the terminal) — same fields
+ * settlement already stamps from typed HTTP observation / provider stop.
+ */
+function providerFailureFromPublicTerminal(outcome: {
+  readonly cause: string;
+  readonly diagnostic: string;
+  readonly decisiveFacts: Readonly<Record<string, unknown>>;
+}): NavigatorProviderFailureFact {
+  const facts = outcome.decisiveFacts;
+  const secondary =
+    typeof facts.secondaryEvidence === "object" && facts.secondaryEvidence !== null
+      ? (facts.secondaryEvidence as Record<string, unknown>)
+      : undefined;
+  const httpStatus =
+    typeof secondary?.httpStatus === "number"
+      ? secondary.httpStatus
+      : typeof facts.httpStatus === "number"
+        ? facts.httpStatus
+        : typeof facts.errorCode === "number"
+          ? facts.errorCode
+          : undefined;
+  const fromStatus = navigatorProviderFailureFromStatus(httpStatus);
+  if (fromStatus !== undefined) return fromStatus;
+  const diagnostics = secondary?.diagnostics ?? facts.diagnostics;
+  const fromDiagnostics = navigatorProviderFailureFromDiagnostics(diagnostics);
+  if (fromDiagnostics !== undefined) return fromDiagnostics;
+  const fromCode = navigatorProviderFailureFromError({
+    code: secondary?.code ?? facts.errorCode,
+  });
+  if (fromCode !== undefined) return fromCode;
+  if (outcome.cause === "provider") return { source: "transport", cause: "transport" };
+  return { source: "session", cause: "session" };
+}
+
+export function createNativeNavigatorSessionFactory(): NavigatorSessionFactory {
+  return async ({ context, subject, tool }) => {
+    const resolved = await resolveNavigatorSeatSelection(context);
+    let thinkingLevel = resolved.thinkingLevel;
+
+    // Archivist nest for attendance route memory only (ADR 0018 / 0065) — not a session open.
+    const { createRecordSession } = await import("./archivist-record-entry.ts");
+    const sessionManager = createRecordSession({
+      cwd: context.cwd,
+      kind: "navigator",
+      subject,
+      parent: context.sessionManager,
+    });
+
+    let providerFailure: NavigatorProviderFailureFact | undefined;
+    let noReceipt: NoReceiptLifecycleFacts | undefined;
+    let disposed = false;
+    let inFlightPrompt: Promise<unknown> | undefined;
+
+    const resolveHome = async (): Promise<string | undefined> => {
+      const parentFile = context.sessionManager?.getSessionFile?.();
+      if (typeof parentFile === "string" && parentFile.trim() !== "") {
+        try {
+          const { tryHomeFromAkRolesPath, homeFromRunDirectory } = await import(
+            "./activation-ledger-topology.ts"
+          );
+          const fromParent = tryHomeFromAkRolesPath(parentFile);
+          if (fromParent !== undefined && fromParent.length > 0) return fromParent;
+          const runDir = parentFile.replace(/\/session\/session\.jsonl$/, "");
+          if (runDir !== parentFile) {
+            try {
+              return homeFromRunDirectory(runDir);
+            } catch {
+              // fall through
+            }
+          }
+        } catch {
+          // fall through
+        }
+      }
+      const envHome = process.env.HOME;
+      return typeof envHome === "string" && envHome.trim() !== "" ? envHome : undefined;
+    };
+
+    return {
+      prompt: async (text) => {
+        if (disposed) {
+          throw navigatorUnavailableError("session", new Error("Navigator attendance was disposed"));
+        }
+        providerFailure = undefined;
+        noReceipt = undefined;
+        const run = (async () => {
+        try {
+          const { summonPublicRole } = await import("./public-role-summons.ts");
+          const home = await resolveHome();
+          // Public activation — same face as `ak-role navigator <instruction>` (#675).
+          const summoned = await summonPublicRole({
+            role: "navigator",
+            argv: [text],
+            cwd: context.cwd,
+            ...(home === undefined ? {} : { home }),
+          });
+
+          const outcome = summoned.terminal?.roleOutcome;
+          if (outcome === undefined) {
+            const detail = summoned.stderr?.trim() || `exit ${summoned.exitCode}`;
+            providerFailure = { source: "transport", cause: "transport" };
+            throw navigatorUnavailableError(
+              "transport",
+              new Error(`Navigator public summon produced no terminal (${detail})`),
+            );
+          }
+          if (outcome.kind === "failure") {
+            providerFailure = providerFailureFromPublicTerminal(outcome);
+            throw navigatorUnavailableError(
+              providerFailure.source,
+              new Error(outcome.diagnostic),
+              providerFailure.cause,
+            );
+          }
+          if (outcome.kind === "no_receipt") {
+            // The nested session spent its own delivery budget; attendance settles
+            // no-receipt on these facts instead of opening another summon (#675).
+            noReceipt = outcome;
+            return;
+          }
+          if (outcome.kind !== "accepted") {
+            providerFailure = { source: "session", cause: "session" };
+            throw navigatorUnavailableError(
+              "session",
+              new Error("Navigator public summon returned unusable terminal"),
+            );
+          }
+          const candidates = outcome.decisiveFacts.candidates;
+          if (!Array.isArray(candidates)) {
+            return;
+          }
+          // Rejoin attendance prepare tool sink (same candidate shape as public advice).
+          await tool.execute(
+            "navigator-public-prepare",
+            { candidates },
+            undefined,
+            undefined,
+            context as never,
+          );
+        } catch (error) {
+          if (error instanceof NavigatorUnavailableError) throw error;
+          const fact = navigatorProviderFailureFromError(error);
+          providerFailure = fact ?? { source: "transport", cause: "transport" };
+          throw navigatorUnavailableError(providerFailure.source, error, providerFailure.cause);
+        }
+        })();
+        inFlightPrompt = run;
+        try {
+          await run;
+        } finally {
+          if (inFlightPrompt === run) inFlightPrompt = undefined;
+        }
+      },
+      providerFailure: () => providerFailure,
+      noReceipt: () => noReceipt,
+      appendEntry: (customType, data) => {
+        sessionManager.appendCustomEntry(customType, data);
+        try {
+          sitianReport({
+            level: "event",
+            kind: "attendance",
+            cwd: context.cwd,
+            sessionParent: sessionManager.getSessionFile(),
+            payload: { customType, data },
+            source: "navigator-public-session",
+          });
+        } catch {
+          // best-effort
+        }
+      },
+      entries: () => sessionManager.getEntries(),
+      setModel: async (next, nextThinking) => {
+        let nextParsed: ReturnType<typeof parseNavigatorModelSetting>;
+        try {
+          nextParsed = parseNavigatorModelSetting(next);
+        } catch (error) {
+          throw navigatorUnavailableError("model", error);
+        }
+        // No live provider session is pinned here: every prompt is an independent
+        // public summon whose nested CLI reads the current seat table (#675 验收②
+        // / #617 DK-3). A seat edit between prepares therefore applies on the next
+        // summon — it is never an unavailable session.
+        thinkingLevel = nextThinking ?? nextParsed.thinkingLevel;
+      },
+      getThinkingLevel: () => thinkingLevel,
+      recordPointer: () => sessionManager.getSessionDir(),
+      dispose: async () => {
+        disposed = true;
+        const pending = inFlightPrompt;
+        if (pending !== undefined) await pending.catch(() => undefined);
+      },
+    };
+  };
+}