@akagilnc/pi-workflow-roles 0.1.3572 → 0.1.3621

package/src/gatekeeper-role.ts

@@ -1,16 +1,11 @@
-import { Type } from "typebox";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { HostContext } from "./host-contracts.ts";
 
 import {
   auditorRunDirectory,
-  createAuditorDossierTool,
   persistGateSubmissionCandidate,
 } from "./auditor-dossier-tool.ts";
-import { executeAuditorChild, type AuditorDecisionTool } from "./evidence-child-executor.ts";
-import { openToolObject } from "./open-tool-schema.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
-import { loadGatekeeperSessionMaterials } from "./session-opening-materials.ts";
 import { GatekeeperDecisionError } from "./submission-errors.ts";
 import { INSPECTOR_OUTPUT_TOOL_NAME } from "./inspector-contracts.ts";
 import {
@@ -18,6 +13,9 @@ import {
   gatekeeperDecisionSchema,
   gatekeeperOutputSchema,
 } from "./package-contracts/gatekeeper-output.ts";
+import type { PublicSummonResult } from "./public-role-summons.ts";
+import type { TerminalResult } from "./public-cli/terminal.ts";
+import { retainedShapeUnreadable } from "./shape-unreadable-failure.ts";
 export const INSPECTOR_OUTPUT_TOOL = INSPECTOR_OUTPUT_TOOL_NAME;
 export const NOTARY_OUTPUT_TOOL = "ak_notary_output";
 
@@ -47,6 +45,13 @@ export type GatekeeperResult =
       readonly submission: unknown;
     }
   | { readonly status: "no_receipt"; readonly stage: "inspector" | "notary"; readonly reason: string; readonly facts: NoReceiptLifecycleFacts }
+  | {
+      /** Shape-unreadable officer output — typed fact, not a forged bounce (ADR 0055 / §0). */
+      readonly status: "unreadable";
+      readonly officer: "inspector" | "notary";
+      readonly reason: string;
+      readonly submission: unknown;
+    }
   | {
       readonly status: "transport_failure";
       readonly stage: "inspector" | "notary";
@@ -57,7 +62,7 @@ export type GatekeeperResult =
 
 export type GatekeeperNonPassResult = Extract<
   GatekeeperResult,
-  { status: "bounce" | "no_receipt" }
+  { status: "bounce" | "no_receipt" | "unreadable" }
 >;
 
 function gateSeatLabel(stage: "inspector" | "notary"): string {
@@ -75,14 +80,24 @@ export class GatekeeperEscalationError extends Error {
   }
 }
 
+export type GateOfficerSummon = (
+  officer: "inspector" | "notary",
+  sourceRunDirectory: string,
+  /** Parent cancellation forwarded to the nested activation (#675). */
+  signal?: AbortSignal,
+) => Promise<PublicSummonResult>;
+
 export type RunGatekeeperOptions = {
   readonly context: ExtensionContext | HostContext;
   readonly subject: GatekeeperSubject;
   readonly signal?: AbortSignal;
-  readonly loadSoul?: (role: "inspector" | "notary") => Promise<string>;
-  /** Run directory carrying the institutional resolution page (#518). Derives
-   * from context when absent. */
+  /** Run directory of the parent role (pointer-only summons, ADR 0079). */
   readonly runDirectory?: string;
+  /**
+   * Test seam for public-role summons. Production calls the shared public
+   * activation path (#675); inject only in offline tracers.
+   */
+  readonly summonOfficer?: GateOfficerSummon;
 };
 
 export type GatekeeperPassHostActions = {
@@ -91,15 +106,6 @@ export type GatekeeperPassHostActions = {
   bindSubmissionNonPass(toolCallId: string, result: GatekeeperNonPassResult): void;
 };
 
-// Unknown fields so wrong types/spellings still reach projection (ADR 0055/0057; 仓第 0 条).
-// Opening goes through the sole openToolObject owner — no parallel transport helper.
-const officerDecisionSchema = openToolObject(Type.Object({
-  status: Type.Unknown({ description: "pass | bounce | escalate — 形状指引，非 schema 闸" }),
-  reason: Type.Optional(Type.Unknown({ description: "status 为 escalate 时的理由" })),
-  findings: Type.Unknown({ description: "string[] findings，随 pass、bounce 或 escalate 留存" }),
-}));
-
-
 /**
  * Direct-seat decision tool spec (#639). Lifecycle assembly stays on the
  * registration envelope — src/role-runtime.ts (ADR 0018). Schema authority is
@@ -121,30 +127,18 @@ function result(content: string, details: unknown) {
   return { content: [{ type: "text" as const, text: content }], details };
 }
 
-/** Shared officer decision tool — open transport; projection owns legality. */
-export function createOfficerDecisionTool(name: string): AuditorDecisionTool {
-  return {
-    name,
-    description: "提交一份 typed pass/bounce/escalate 决议。",
-    parameters: officerDecisionSchema,
-    async execute(_id, args) { return result(`已收 ${String((args as { status?: unknown })?.status)}`, args); },
-  };
-}
-
 /** Gatekeeper province decision tool — open transport; package-contract projection owns legality. */
-export function createGatekeeperOutputTool(): AuditorDecisionTool {
+export function createGatekeeperOutputTool() {
   return {
     name: GATEKEEPER_OUTPUT_TOOL_NAME,
     description: "提交门下省派官决定。",
     parameters: gatekeeperDecisionSchema,
-    async execute(_id, args) { return result(`已收 ${String((args as { status?: unknown })?.status)}`, args); },
+    async execute(_id: string, args: unknown) {
+      return result(`已收 ${String((args as { status?: unknown })?.status)}`, args);
+    },
   };
 }
 
-async function defaultLoadSoul(role: "inspector" | "notary"): Promise<string> {
-  return loadGatekeeperSessionMaterials(role);
-}
-
 function failureReason(error: unknown): string {
   if (error instanceof AggregateError) return error.errors.map(failureReason).join("; ");
   return error instanceof Error ? `${error.name}: ${error.message}` : String(error);
@@ -173,17 +167,19 @@ function retainedSubmission(decision: unknown): unknown {
 }
 
 /**
- * No usable explicit release is infrastructure failure, not a judgment status.
- * Original submission is retained for the failure channel (#475).
+ * Shape-unreadable officer decision — retain original candidate + typed reason.
+ * Not a forged bounce, not transport abort (CLAUDE.md §0 / ADR 0055).
+ * Real provider/engine/disk failures stay transport_failure elsewhere.
  */
-function noUsableReleaseFailure(
-  stage: "inspector" | "notary",
+function shapeUnreadable(
+  officer: "inspector" | "notary",
   decision: unknown,
-): Extract<GatekeeperResult, { status: "transport_failure" }> {
+  reason = "decision 无显式 pass/bounce/escalate",
+): Extract<GatekeeperResult, { status: "unreadable" }> {
   return {
-    status: "transport_failure",
-    stage,
-    reason: "decision 无显式 pass/bounce/escalate",
+    status: "unreadable",
+    officer,
+    reason,
     submission: retainedSubmission(decision),
   };
 }
@@ -198,7 +194,7 @@ function projectOfficerDecision(
   decision: unknown,
 ): GatekeeperResult {
   const record = readRecord(decision);
-  if (record === undefined) return noUsableReleaseFailure(officer, decision);
+  if (record === undefined) return shapeUnreadable(officer, decision);
   if (record.status === "bounce") {
     return {
       status: "bounce",
@@ -224,76 +220,121 @@ function projectOfficerDecision(
       submission: retainedSubmission(decision),
     };
   }
-  return noUsableReleaseFailure(officer, decision);
+  return shapeUnreadable(officer, decision);
 }
 
-/** Submission-gate summons: subject kind determines the officer without a province child. */
-export async function runGatekeeper(options: RunGatekeeperOptions): Promise<GatekeeperResult> {
-  const loadSoul = options.loadSoul ?? defaultLoadSoul;
+/** Map a public-role terminal onto the gate officer result surface. */
+function projectOfficerTerminal(
+  officer: "inspector" | "notary",
+  summoned: PublicSummonResult,
+): GatekeeperResult {
+  const terminal: TerminalResult | undefined = summoned.terminal;
+  const outcome = terminal?.roleOutcome;
+  if (outcome === undefined) {
+    const detail = summoned.stderr?.trim();
+    return {
+      status: "transport_failure",
+      stage: officer,
+      reason: detail && detail.length > 0
+        ? `${gateSeatLabel(officer)} public summon exit ${summoned.exitCode}: ${detail}`
+        : `${gateSeatLabel(officer)} public summon produced no terminal (exit ${summoned.exitCode})`,
+      submission: summoned,
+    };
+  }
+  if (outcome.kind === "no_receipt") {
+    return {
+      status: "no_receipt",
+      stage: officer,
+      reason: `${gateSeatLabel(officer)}未产生已接受回执即散局`,
+      facts: outcome,
+    };
+  }
+  if (outcome.kind === "failure") {
+    // Single settlement marker only (ADR 0055 / #675) — no cause=output re-derivation.
+    const shape = retainedShapeUnreadable(outcome.decisiveFacts);
+    if (shape !== undefined) {
+      return shapeUnreadable(officer, shape.candidate, outcome.diagnostic);
+    }
+    return {
+      status: "transport_failure",
+      stage: officer,
+      reason: outcome.diagnostic,
+      submission: outcome.decisiveFacts,
+    };
+  }
+  if (outcome.kind === "accepted") {
+    return projectOfficerDecision(officer, {
+      status: outcome.status,
+      ...outcome.decisiveFacts,
+    });
+  }
+  return {
+    status: "transport_failure",
+    stage: officer,
+    reason: `${gateSeatLabel(officer)} public summon returned unusable terminal kind`,
+    submission: outcome,
+  };
+}
+
+/** Projection carrier for the shared submit envelope (ADR 0018). No lifecycle book here. */
+export type GatekeeperProjection = {
+  readonly officer: "inspector" | "notary";
+  readonly result: GatekeeperResult;
+  /** Present only when a public summon actually returned (not transport pre-summon failure). */
+  readonly summoned?: PublicSummonResult;
+};
+
+/**
+ * Summon + project only. Lifecycle book and host abort face live on the shared
+ * submit envelope (`gatekeeper-pass-envelope.ts`, ADR 0018 / #675).
+ */
+export async function projectGatekeeperRun(
+  options: RunGatekeeperOptions,
+): Promise<GatekeeperProjection> {
   const officer = options.subject.kind === "worker_completion" ? "inspector" : "notary";
-  // Resolve once so dossier tool and child session share the same run binding (#632).
   const runDirectory = options.runDirectory ?? auditorRunDirectory(options.context);
+  if (runDirectory === undefined) {
+    return {
+      officer,
+      result: {
+        status: "transport_failure",
+        stage: officer,
+        reason: `${gateSeatLabel(officer)} requires a parent run directory pointer`,
+      },
+    };
+  }
   // Pointer-only summons need a resolvable leaf: Grok session.jsonl is header-only
   // (#617 DK-4); write the in-memory tool-call candidate as a run artifact first (#632).
-  const submissionCandidate =
-    runDirectory === undefined
-      ? undefined
-      : persistGateSubmissionCandidate(runDirectory, options.context);
+  persistGateSubmissionCandidate(runDirectory, options.context);
+  let summoned: PublicSummonResult;
   try {
-    const officerRun = await executeAuditorChild({
-      context: options.context,
-      roleLabel: officer === "inspector" ? "Inspector" : "Notary",
-      gateSeat: officer,
-      systemPrompt: await loadSoul(officer),
-      prompt: "卷宗已受理。",
-      tool: createOfficerDecisionTool(officer === "inspector" ? INSPECTOR_OUTPUT_TOOL : NOTARY_OUTPUT_TOOL),
-      // Same locator as 审刑院 — run directory + path identifiers only; no receipt body (#632).
-      dossierTool: createAuditorDossierTool(
-        runDirectory,
-        submissionCandidate === undefined ? undefined : { submissionCandidate },
-      ),
-      ...(options.signal === undefined ? {} : { signal: options.signal }),
-      ...(runDirectory === undefined ? {} : { runDirectory }),
-    });
-    if (officerRun.noReceiptLifecycle !== undefined) {
-      return { status: "no_receipt", stage: officer, reason: `${gateSeatLabel(officer)}未产生已接受回执即散局`, facts: officerRun.noReceiptLifecycle };
-    }
-    return projectOfficerDecision(officer, officerRun.decision);
+    const summon =
+      options.summonOfficer
+      ?? (async (nextOfficer, sourceRunDirectory, officerSignal) => {
+        const { summonGateOfficer } = await import("./public-role-summons.ts");
+        return summonGateOfficer({
+          officer: nextOfficer,
+          sourceRunDirectory,
+          cwd: options.context.cwd ?? process.cwd(),
+          ...(officerSignal === undefined ? {} : { signal: officerSignal }),
+        });
+      });
+    summoned = await summon(officer, runDirectory, options.signal);
   } catch (error) {
-    return { status: "transport_failure", stage: officer, reason: failureReason(error) };
+    return {
+      officer,
+      result: { status: "transport_failure", stage: officer, reason: failureReason(error) },
+    };
   }
+  return {
+    officer,
+    result: projectOfficerTerminal(officer, summoned),
+    summoned,
+  };
 }
 
-/** Project GatekeeperResult onto a submit path: transport→failInfrastructure; bounce/no_receipt→typed throw; pass silent. */
-export async function requireGatekeeperPass(options: {
-  readonly context: ExtensionContext | HostContext;
-  readonly subject: GatekeeperSubject;
-  readonly signal?: AbortSignal;
-  readonly hostActions: GatekeeperPassHostActions;
-  readonly toolCallId: string;
-}): Promise<void> {
-  const gatekeeper = await runGatekeeper({
-    context: options.context,
-    subject: options.subject,
-    ...(options.signal === undefined ? {} : { signal: options.signal }),
-  });
-  if (gatekeeper.status === "pass") return;
-  if (gatekeeper.status === "transport_failure") {
-    // Typed stage/reason/submission ride failInfrastructure → durable tool_result (#475).
-    const error = new Error(`交卷闸 transport_failure（${gatekeeper.stage}）：${gatekeeper.reason}`) as Error & {
-      stage: typeof gatekeeper.stage;
-      reason: string;
-      submission?: unknown;
-    };
-    error.stage = gatekeeper.stage;
-    error.reason = gatekeeper.reason;
-    if (gatekeeper.submission !== undefined) error.submission = gatekeeper.submission;
-    options.hostActions.failInfrastructure(error, options.context, options.toolCallId);
-  }
-  if (gatekeeper.status === "escalate") {
-    throw new GatekeeperEscalationError(gatekeeper);
-  }
-  // Envelope owns the execute→tool_result bridge; this module only projects + throws.
-  options.hostActions.bindSubmissionNonPass(options.toolCallId, gatekeeper);
-  throw new GatekeeperDecisionError(gatekeeper);
+/** Submission-gate summons: subject kind → officer; activation is public role path (#675). Projection only. */
+export async function runGatekeeper(options: RunGatekeeperOptions): Promise<GatekeeperResult> {
+  const { result } = await projectGatekeeperRun(options);
+  return result;
 }

package/src/host-contracts.ts

@@ -126,6 +126,8 @@ export type RoleTurnActivation =
   | { readonly role: "inspector" }
   | { readonly role: "gatekeeper" }
   | { readonly role: "navigator" }
+  | { readonly role: "auditor" }
+  | { readonly role: "evidence-child" }
   | {
       readonly role: "diarist";
       /** Frozen source-catalog path; absent for a true-unbound summons (#708). */
@@ -170,6 +172,12 @@ export type RoleTurnRequest = {
   readonly runDirectory: string;
   readonly correlationId?: string;
   readonly timeoutMs?: number;
+  /**
+   * Parent cancellation for a nested activation (role-inside-role public summons,
+   * #675). The host terminates its child when this aborts; a public CLI process
+   * has no parent to observe and leaves it absent.
+   */
+  readonly signal?: AbortSignal;
   /** Set by post-admission only on a real host switch; never on same-host resume. */
   readonly hostTransition?: RoleTurnHostTransition;
   /**
@@ -295,7 +303,7 @@ type HostGatekeeperSubject = {
   readonly kind: "worker_completion" | "judge_draft" | "countersign_verdict";
 };
 /** Gatekeeper bounce/no_receipt plus other correct submission rejects share one projection map. */
-type HostGatekeeperNonPass = { readonly status: "bounce" | "no_receipt" } & Record<string, unknown>;
+type HostGatekeeperNonPass = { readonly status: "bounce" | "no_receipt" | "unreadable" } & Record<string, unknown>;
 export type HostSubmissionNonPass =
   | HostGatekeeperNonPass
   | { readonly code: "coder_skill_expansion_evidence_missing" };

package/src/institutional-resolution.ts

@@ -1,6 +1,9 @@
-import { readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import type { RoleTurnModelConfig } from "./host-contracts.ts";
+/**
+ * Province-officer model authority (#453/#620) and shared seatModelOnly projection.
+ * #675 deleted the independent institutional-resolution.json seat page and the
+ * child-session open path that consumed it. Seat resolution for every activation
+ * is the live public seat table (model/host/engine).
+ */
 import type {
   GateOfficerSeat,
   PublicCliConfig,
@@ -8,70 +11,20 @@ import type {
 } from "./public-cli/config.ts";
 import { seatModelOnly } from "./public-cli/registry.ts";
 
-export const INSTITUTIONAL_RESOLUTION_FILE = "institutional-resolution.json" as const;
-
-/** Non-secret per-seat model selection — alias of the single host-neutral RoleTurnModelConfig. */
-export type InstitutionalSeatSelection = RoleTurnModelConfig;
-
 /**
  * Configured province-officer resolution (#453/#620 authority seam):
  * officer persistent > gatekeeper persistent > unconfigured.
- * No startup candidates and no parent-session fallback — parent compose stays
- * in resolveInstitutionalSeatSelections; direct call and config display consume
- * this typed result as-is.
+ * No startup candidates and no parent-session fallback — direct call and config
+ * display consume this typed result as-is.
  */
 export type ConfiguredProvinceOfficerResolution = {
   readonly selection?: SeatModelConfig;
   readonly source: "persistent" | "inherit-gatekeeper" | "unconfigured";
 };
 
-export type InstitutionalResolutionPage = {
-  readonly version: 1;
-  readonly seats: {
-    readonly gatekeeper?: InstitutionalSeatSelection;
-    readonly inspector?: InstitutionalSeatSelection;
-    readonly notary?: InstitutionalSeatSelection;
-    readonly auditor?: InstitutionalSeatSelection;
-    readonly evidenceChild?: InstitutionalSeatSelection;
-    readonly [seat: string]: InstitutionalSeatSelection | undefined;
-  };
-};
-
-/** Why institutional seat read failed — structured, not free-text. */
-export type InstitutionalResolutionFailureReason =
-  | "missing-page"
-  | "missing-seat"
-  | "corrupted"
-  | "invalid-format";
-
-export class InstitutionalResolutionError extends Error {
-  readonly reason: InstitutionalResolutionFailureReason;
-  constructor(
-    message: string,
-    reason: InstitutionalResolutionFailureReason,
-    options?: ErrorOptions,
-  ) {
-    super(message, options);
-    this.name = "InstitutionalResolutionError";
-    this.reason = reason;
-  }
-}
-
-function cleanSelection(model?: { provider?: string; model?: string; thinking?: string }): InstitutionalSeatSelection | undefined {
-  if (model === undefined) return undefined;
-  if (typeof model.provider !== "string" || typeof model.model !== "string") return undefined;
-  return {
-    provider: model.provider,
-    model: model.model,
-    ...(model.thinking === undefined ? {} : { thinking: model.thinking }),
-  };
-}
-
 /**
  * Authority for configured province-officer model+source (#453/#620):
  * own persistent > gatekeeper persistent > unconfigured.
- * Shared by resolveInstitutionalSeatSelections (plus parent fallback),
- * resolveEffectiveSeat subordinate branch, and roles/config display.
  * Model-axis projection stays seatModelOnly (single implementation in registry).
  */
 export function resolveConfiguredProvinceOfficer(
@@ -91,111 +44,3 @@ export function resolveConfiguredProvinceOfficer(
   }
   return { source: "unconfigured" };
 }
-
-/**
- * Resolve effective per-seat institutional selections (#518 §2 Hop 1; #620):
- * - gatekeeper / inspector / notary: resolveConfiguredProvinceOfficer then
- *   parent effective on the province path only
- * - auditor / evidenceChild: parent effective
- * - navigator: explicit config seat only. Navigator model authority stays
- *   `navigator-model.json`; the page never carries a parent-inherited navigator
- *   seat, so host-neutral transport cannot shadow that setting (#590 Out of Scope:
- *   席位表／模型路由变更归 owner 域).
- */
-export function resolveInstitutionalSeatSelections(
-  config: PublicCliConfig,
-  parentEffectiveModel?: { provider: string; model: string; thinking?: string },
-): InstitutionalResolutionPage {
-  const parentSelection = cleanSelection(parentEffectiveModel);
-
-  const gatekeeper =
-    resolveConfiguredProvinceOfficer(config, "gatekeeper").selection ?? parentSelection;
-  const inspector =
-    resolveConfiguredProvinceOfficer(config, "inspector").selection ?? parentSelection;
-  const notary =
-    resolveConfiguredProvinceOfficer(config, "notary").selection ?? parentSelection;
-  const auditor = parentSelection;
-  const evidenceChild = parentSelection;
-  const navigator = cleanSelection(seatModelOnly(config.seats?.navigator));
-
-  return {
-    version: 1,
-    seats: {
-      ...(gatekeeper === undefined ? {} : { gatekeeper }),
-      ...(inspector === undefined ? {} : { inspector }),
-      ...(notary === undefined ? {} : { notary }),
-      ...(auditor === undefined ? {} : { auditor }),
-      ...(evidenceChild === undefined ? {} : { evidenceChild }),
-      ...(navigator === undefined ? {} : { navigator }),
-    },
-  };
-}
-
-/**
- * Persist institutional resolution page to run directory (#518 §2 Hop 2).
- * Rewritten on each dispatch and resume. Zero secrets inside page.
- */
-export async function writeInstitutionalResolutionPage(
-  runDirectory: string,
-  page: InstitutionalResolutionPage,
-): Promise<void> {
-  const filePath = join(runDirectory, INSTITUTIONAL_RESOLUTION_FILE);
-  await writeFile(filePath, `${JSON.stringify(page, null, 2)}\n`, "utf8");
-}
-
-/**
- * Read institutional seat selection from run directory (#518 §2 Hop 3).
- * Fails loud if page is missing, corrupted, or does not contain a resolution for the seat.
- */
-export async function readInstitutionalSeatSelection(
-  runDirectory: string,
-  seat: string,
-): Promise<InstitutionalSeatSelection> {
-  const filePath = join(runDirectory, INSTITUTIONAL_RESOLUTION_FILE);
-  let raw: string;
-  try {
-    raw = await readFile(filePath, "utf8");
-  } catch (error) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page is missing at ${filePath}`,
-      "missing-page",
-      { cause: error },
-    );
-  }
-
-  let page: unknown;
-  try {
-    page = JSON.parse(raw);
-  } catch (error) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page is corrupted at ${filePath}`,
-      "corrupted",
-      { cause: error },
-    );
-  }
-
-  if (typeof page !== "object" || page === null || (page as { version?: unknown }).version !== 1) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page format is invalid at ${filePath}`,
-      "invalid-format",
-    );
-  }
-
-  const seats = (page as { seats?: Record<string, unknown> }).seats;
-  if (typeof seats !== "object" || seats === null) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page missing seats object at ${filePath}`,
-      "invalid-format",
-    );
-  }
-
-  const selection = cleanSelection(seats[seat] as InstitutionalSeatSelection | undefined);
-  if (selection === undefined) {
-    throw new InstitutionalResolutionError(
-      `institutional resolution page has no resolution for seat "${seat}" at ${filePath}`,
-      "missing-seat",
-    );
-  }
-
-  return selection;
-}

package/src/judge-auditor.ts

@@ -1,10 +1,9 @@
 import {
-  createComplianceDecisionTool,
   runComplianceAudit,
+  type AuditorSummon,
   type ComplianceDecision,
 } from "./compliance-transport.ts";
 import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
-import { loadAuditorSoul } from "./auditor-soul.ts";
 import {
   readJudgeAuditSubjects,
   requireAuditMaterials,
@@ -18,17 +17,13 @@ export const SOUL_AUDIT_TOOL_NAME = JUDGE_AUDIT_TOOL_NAME;
 export type JudgeAuditOptions = {
   context: HostContext;
   signal?: AbortSignal;
+  /** Same seam as runComplianceAudit options — offline tracers only. */
+  summonAuditor?: AuditorSummon;
 };
 
-const auditDecisionTool = createComplianceDecisionTool(
-  JUDGE_AUDIT_TOOL_NAME,
-  "提交 typed pass/revise/escalate 决议（大理寺审刑）。",
-);
-
 /**
- * Judge auditor: zero hand-delivered materials. Subjects recovered from the
- * parent-session books. Public CLI injects AK_ROLE_RUN_DIR; bare Pi (ADR 0052)
- * proceeds without that pointer and self-locates per soul.
+ * Judge compliance via public auditor activation (#675 / ADR 0062 / owner r11).
+ * 审刑院 is an independent role; subject=judge selects souls/judge-auditor.md.
  */
 export function createPiJudgeAuditor(): (options: JudgeAuditOptions) => Promise<ComplianceDecision> {
   return async (options) => {
@@ -38,13 +33,13 @@ export function createPiJudgeAuditor(): (options: JudgeAuditOptions) => Promise<
     requireAuditMaterials(subjects);
 
     return runComplianceAudit({
-      tool: auditDecisionTool,
-      systemPrompt: await loadAuditorSoul("judge"),
-      roleLabel: "Judge compliance audit",
-      invalidDecisionLabel: "invalid judge audit decision",
+      subject: "judge",
       context: options.context,
-      ...(auditorRunDirectory(options.context) === undefined ? {} : { runDirectory: auditorRunDirectory(options.context) }),
+      ...(auditorRunDirectory(options.context) === undefined
+        ? {}
+        : { runDirectory: auditorRunDirectory(options.context) }),
       ...(options.signal === undefined ? {} : { signal: options.signal }),
+      ...(options.summonAuditor === undefined ? {} : { summonAuditor: options.summonAuditor }),
     });
   };
 }

package/src/judge-role.ts

@@ -8,6 +8,7 @@ import { withInfrastructureFailureDeclaration } from "./package-contracts/termin
 
 import {
   JUDGE_ACCEPTED_AUDIT_NO_RECEIPT_TEXT,
+  JUDGE_ACCEPTED_AUDIT_UNREADABLE_TEXT,
   JUDGE_ACCEPTED_TEXT,
   JUDGE_OUTPUT_TOOL_NAME,
   validateAcceptedJudgeDetails,
@@ -127,6 +128,13 @@ export function createJudgeRoleRuntime(
                   terminate: true as const,
                   ...usageProjection,
                 }),
+                // ADR 0055: parent stands with typed unreadable audit fact — not forged pass.
+                unreadable: (auditUnreadable, usageProjection) => ({
+                  content: [{ type: "text" as const, text: JUDGE_ACCEPTED_AUDIT_UNREADABLE_TEXT }],
+                  details: { ...acceptedDetails, auditUnreadable },
+                  terminate: true as const,
+                  ...usageProjection,
+                }),
                 revise: (violations) => {
                   throw new Error(
                     `大理寺回执违 soul：${violations.join("; ")}`,