@akagilnc/pi-workflow-roles 0.1.3648 → 0.1.3652

package/dist/gleaner-left-role.js

@@ -0,0 +1,26 @@
+import { Type } from "typebox";
+import { openToolObject } from "./open-tool-schema.js";
+import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.js";
+import { GLEANER_LEFT_OUTPUT_TOOL_NAME, validateRecordedGleanerLeftOutput, } from "./gleaner-left-contracts.js";
+export { GLEANER_LEFT_ACCEPTED_TEXT, GLEANER_LEFT_OUTPUT_TOOL_NAME, } from "./gleaner-left-contracts.js";
+export { validateRecordedGleanerLeftOutput };
+/** 左拾遗弹章交卷形状；形状指引，非 schema 闸。 */
+export const gleanerLeftOutputSchema = withInfrastructureFailureDeclaration(openToolObject(Type.Object({
+    status: Type.Unknown({
+        description: "completed — 形状指引，非 schema 闸",
+    }),
+    findings: Type.Array(Type.Object({
+        pointer: Type.String({ description: "文件/行指针" }),
+        statement: Type.String({ description: "疑点陈述" }),
+    }, { additionalProperties: true, description: "一条弹章" }), { description: "弹章列表；空列表合法完局" }),
+})));
+/**
+ * 决定工具规格。生命周期装配归注册信封 owner——src/role-runtime.ts（ADR 0018）。
+ */
+export const GLEANER_LEFT_TOOL_SPEC = {
+    name: GLEANER_LEFT_OUTPUT_TOOL_NAME,
+    label: "左拾遗输出",
+    description: "左拾遗弹章。",
+    promptSnippet: "左拾遗弹章",
+    parameters: gleanerLeftOutputSchema,
+};

package/dist/inspector-role.js

@@ -0,0 +1,29 @@
+import { Type } from "typebox";
+import { openToolObject } from "./open-tool-schema.js";
+import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.js";
+import { INSPECTOR_ACCEPTED_TEXT, INSPECTOR_OUTPUT_TOOL_NAME, validateRecordedInspectorOutput, } from "./inspector-contracts.js";
+export { INSPECTOR_ACCEPTED_TEXT, INSPECTOR_OUTPUT_TOOL_NAME, };
+export { INSPECTOR_OUTPUT_TOOL_NAME as INSPECTOR_OUTPUT_TOOL };
+export { validateRecordedInspectorOutput };
+/** 察院事后察举交卷形状；形状指引，非 schema 闸。 */
+export const inspectorOutputSchema = withInfrastructureFailureDeclaration(openToolObject(Type.Object({
+    status: Type.Unknown({
+        description: "pass | bounce | escalate — 形状指引，非 schema 闸",
+    }),
+    findings: Type.Unknown({
+        description: "随交卷留存的问题记录",
+    }),
+    reason: Type.Optional(Type.Unknown({
+        description: "status 为 escalate 时的上呈理由",
+    })),
+})));
+/**
+ * 决定工具规格。生命周期装配归注册信封 owner——src/role-runtime.ts（ADR 0018）。
+ */
+export const INSPECTOR_TOOL_SPEC = {
+    name: INSPECTOR_OUTPUT_TOOL_NAME,
+    label: "察院输出",
+    description: "察院终局回执，状态为 pass、bounce 或 escalate。",
+    promptSnippet: "察院终局回执",
+    parameters: inspectorOutputSchema,
+};

package/dist/judge-role.js

@@ -0,0 +1,106 @@
+import { stringEnum } from "./host-contracts.js";
+import { Type } from "typebox";
+import { disposeComplianceDecision } from "./audit-escalation.js";
+import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.js";
+import { JUDGE_ACCEPTED_AUDIT_NO_RECEIPT_TEXT, JUDGE_ACCEPTED_TEXT, JUDGE_OUTPUT_TOOL_NAME, validateAcceptedJudgeDetails, } from "./package-contracts/judge-output.js";
+export { JUDGE_OUTPUT_TOOL_NAME };
+export const judgeVerdictSchema = withInfrastructureFailureDeclaration(Type.Object({
+    judgeStatus: stringEnum(["converged", "continue", "escalate"], { description: "converged | continue | escalate — 形状指引，非 schema 闸" }),
+    fix: Type.Optional(Type.Object({ summary: Type.String({ minLength: 1, description: "continue 时的补救摘要" }) }, { additionalProperties: false, description: "continue 时的补救说明" })),
+    classes: Type.Optional(Type.Array(Type.Object({
+        name: Type.String({ minLength: 1 }),
+        owner: Type.String({ minLength: 1 }),
+        boundary: Type.String({ minLength: 1 }),
+        disposition: Type.String({ minLength: 1 }),
+    }, { additionalProperties: false }), { minItems: 1, description: "已裁决 finding 类及其 owner 与修理边界" })),
+    note: Type.Optional(Type.String({ minLength: 1, description: "可选裁决附注" })),
+    evidence: Type.Optional(Type.Unknown({ description: "留存的裁决证据" })),
+    decisionGate: Type.Optional(Type.Object({
+        question: Type.String({ minLength: 1 }),
+        options: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+    }, { additionalProperties: false, description: "需人权威处置的问题与选项" })),
+}, { additionalProperties: true }));
+judgeVerdictSchema.required = [];
+export function validateVerdict(verdict) {
+    return validateAcceptedJudgeDetails(verdict);
+}
+export function createJudgeRoleRuntime(pi, dependencies, hostActions) {
+    let soul;
+    let lifecycleRegistered = false;
+    return {
+        async activate() {
+            soul = (await dependencies.loadSoul()).trim();
+            if (soul.length === 0)
+                throw new Error("Judge soul is empty");
+            if (!lifecycleRegistered) {
+                lifecycleRegistered = true;
+                pi.registerTool({
+                    name: JUDGE_OUTPUT_TOOL_NAME,
+                    label: "大理寺输出",
+                    description: "提交大理寺终局判词；受理前经审刑院审计。",
+                    promptSnippet: "提交大理寺终局判词",
+                    parameters: judgeVerdictSchema,
+                    async execute(toolCallId, parameters, signal, _onUpdate, ctx) {
+                        if (soul === undefined)
+                            throw new Error("大理寺职分未装载");
+                        const verdict = validateVerdict(parameters);
+                        // Candidate verdict is already on the parent session books as this
+                        // tool-call leaf (first-record-then-audit; run 019fea05 L61/L62).
+                        // Gatekeeper runs after the draft is booked and before existing auditor.
+                        await pi.requireGatekeeperPass({
+                            context: ctx,
+                            subject: { kind: "judge_draft" },
+                            ...(signal === undefined ? {} : { signal }),
+                            hostActions,
+                            toolCallId,
+                        });
+                        let audit;
+                        try {
+                            audit = await dependencies.auditSoulCompliance(signal === undefined
+                                ? { context: ctx }
+                                : { context: ctx, signal });
+                        }
+                        catch (error) {
+                            hostActions.failInfrastructure(error, ctx, toolCallId);
+                        }
+                        const acceptedDetails = verdict;
+                        return disposeComplianceDecision(audit, {
+                            pass: (usage) => ({
+                                content: [{ type: "text", text: JUDGE_ACCEPTED_TEXT }],
+                                details: acceptedDetails,
+                                terminate: true,
+                                ...(usage === undefined ? {} : { usage }),
+                            }),
+                            noReceipt: (auditNoReceipt, usageProjection) => ({
+                                content: [{ type: "text", text: JUDGE_ACCEPTED_AUDIT_NO_RECEIPT_TEXT }],
+                                details: { ...acceptedDetails, auditNoReceipt },
+                                terminate: true,
+                                ...usageProjection,
+                            }),
+                            // #757: parent stands with auditor raw reply — no unreadable judgment.
+                            received: (auditReceived, usageProjection) => ({
+                                content: [{ type: "text", text: JUDGE_ACCEPTED_TEXT }],
+                                details: { ...acceptedDetails, audit: auditReceived.reply },
+                                terminate: true,
+                                ...usageProjection,
+                            }),
+                            bounce: (violations) => {
+                                throw new Error(`大理寺回执违 soul：${violations.join("; ")}`);
+                            },
+                            escalate: (result) => result,
+                        }, 
+                        // #380: escalate deliveredOutput must carry the same mechanical projection.
+                        acceptedDetails);
+                    },
+                });
+                pi.on("before_agent_start", (event) => {
+                    if (soul === undefined)
+                        throw new Error("大理寺职分未装载");
+                    return {
+                        systemPrompt: `${event.systemPrompt}\n\n<judge_soul>\n${soul}\n</judge_soul>`,
+                    };
+                });
+            }
+        },
+    };
+}

package/dist/merger-role.js

@@ -0,0 +1,66 @@
+import { MERGER_ACCEPTED_TEXT, MERGER_OUTPUT_TOOL_NAME, mergerOutputSchema, validateMergerInput, validateMergerOutput } from "./merger-contracts.js";
+import { exactUtf8 } from "./exact-utf8.js";
+import { isFullGitObjectId } from "./git-object-id.js";
+export { MERGER_OUTPUT_TOOL_NAME };
+export const MERGER_INPUT_FLAG = { name: "ak-merger-input", definition: { description: "Path to an immutable digest-bound Merger v1 input JSON file", type: "string" } };
+function same(a, b) { return a.length === b.length && a.every((value, i) => value === b[i]); }
+function materialText(input, key) { return exactUtf8(Buffer.from(input.materials[key].bytesBase64, "base64"), `Merger ${key}`); }
+export function createMergerRoleRuntime(pi, dependencies, host) {
+    let activation;
+    let registered = false;
+    let accepted = false;
+    pi.registerFlag(MERGER_INPUT_FLAG.name, MERGER_INPUT_FLAG.definition);
+    return { async activate() {
+            const path = pi.getFlag(MERGER_INPUT_FLAG.name);
+            if (typeof path !== "string" || path.trim().length === 0)
+                throw new Error("Merger requires --ak-merger-input");
+            const soul = (await dependencies.loadSoul()).trim();
+            if (!soul)
+                throw new Error("Merger soul is empty");
+            const input = validateMergerInput(await dependencies.loadInput(path));
+            const state = await dependencies.gitState.activeMerge();
+            if (state.targetObjectId !== input.targetObjectId || state.sourceObjectId !== input.sourceObjectId || !same(state.unmergedPaths, input.expectedConflictPaths) || state.unmergedPaths.length === 0 || !isFullGitObjectId(state.automaticMergeTreeId) || state.automaticMergeTreeId.length !== input.targetObjectId.length)
+                throw new Error("Merger activation rejected repository parent, merge, automatic-result, or complete conflict-set drift");
+            activation = { soul, input, automaticMergeTreeId: state.automaticMergeTreeId };
+            accepted = false;
+            if (!registered) {
+                registered = true;
+                pi.registerTool({ name: MERGER_OUTPUT_TOOL_NAME, label: "合并输出", description: "提交合并结果；输出分支为 completed 与 escalate；基础设施及 Git 失败由 abort 通道承接。", promptSnippet: "提交合并结果", parameters: mergerOutputSchema,
+                    async execute(id, params, _signal, _update, ctx) {
+                        if (!activation)
+                            throw new Error("校书郎未激活");
+                        if (accepted)
+                            throw new Error("合并回执已受理");
+                        let output;
+                        try {
+                            output = validateMergerOutput(params, activation.input.attemptId);
+                        }
+                        catch (error) {
+                            host.failInfrastructure(error, ctx, id);
+                        }
+                        if (output.status === "completed") {
+                            let state;
+                            try {
+                                state = await dependencies.gitState.completedMerge(output.mergeCommitId, activation.automaticMergeTreeId);
+                            }
+                            catch (error) {
+                                host.failInfrastructure(error, ctx, id);
+                            }
+                            const scope = new Set(activation.input.resolutionScope);
+                            if (state.mergeCommitId !== output.mergeCommitId || !same(state.parentObjectIds, [activation.input.targetObjectId, activation.input.sourceObjectId]) || state.unmergedPaths.length !== 0 || !state.worktreeClean || state.resolutionChangedPaths.some(path => !scope.has(path)))
+                                host.failInfrastructure(new Error("Merger completed-state verification failed"), ctx, id);
+                        }
+                        accepted = true;
+                        const acceptedDetails = output;
+                        return { content: [{ type: "text", text: MERGER_ACCEPTED_TEXT }], details: acceptedDetails, terminate: true };
+                    } });
+                pi.on("before_agent_start", (event) => { if (!activation)
+                    throw new Error("校书郎未激活"); const admitted = { attemptId: activation.input.attemptId, targetObjectId: activation.input.targetObjectId, sourceObjectId: activation.input.sourceObjectId, task: materialText(activation.input, "task"), authority: materialText(activation.input, "authority"), targetIntent: materialText(activation.input, "targetIntent"), sourceIntent: materialText(activation.input, "sourceIntent"), expectedConflictPaths: activation.input.expectedConflictPaths, resolutionScope: activation.input.resolutionScope, authorizedChecks: activation.input.authorizedChecks }; return { systemPrompt: `${event.systemPrompt}\n\n<merger_soul>\n${activation.soul}\n</merger_soul>\n\n<merger_assignment>\n${JSON.stringify(admitted)}\n</merger_assignment>` }; });
+            }
+            // Host-neutral AK output only (ADR 0018 fail-closed); no host-builtin name hard-require.
+            const all = pi.getAllTools().map(tool => tool.name);
+            if (all.filter(item => item === MERGER_OUTPUT_TOOL_NAME).length !== 1) {
+                throw new Error(`Merger required tool collision or missing: ${MERGER_OUTPUT_TOOL_NAME}`);
+            }
+        } };
+}

package/dist/navigator-role.js

@@ -0,0 +1,12 @@
+import { NAVIGATOR_OUTPUT_TOOL_NAME, navigatorOutputSchema } from "./package-contracts/navigator-output.js";
+/**
+ * 决定工具规格。生命周期装配归注册信封 owner——src/role-runtime.ts（ADR 0018）。
+ * Candidates share the route-advice shape the attendance prepare tool owns.
+ */
+export const NAVIGATOR_TOOL_SPEC = {
+    name: NAVIGATOR_OUTPUT_TOOL_NAME,
+    label: "游奕使建议",
+    description: "游奕使终局回执：排好序的下一步角色路线建议。",
+    promptSnippet: "游奕使建议",
+    parameters: navigatorOutputSchema,
+};

package/dist/notary-role.js

@@ -0,0 +1,137 @@
+/**
+ * Public Notary role runtime — direct officer seat (not through Gatekeeper province).
+ * Caller supplies only a source-run locator; Notary self-fetches authoritative materials.
+ * Ticket flag register/read/session bind is envelope-owned (ADR 0018 / #582).
+ * This module keeps evidence assembly + projection only.
+ */
+import { NOTARY_ACCEPTED_TEXT, NOTARY_OUTPUT_TOOL_NAME, NOTARY_SOURCE_RUN_FLAG, NOTARY_TICKET_FLAG, notaryOutputSchema, projectLawfulNotaryOutput, retainNotarySubmission, } from "./notary-contracts.js";
+export { NOTARY_ACCEPTED_TEXT, NOTARY_OUTPUT_TOOL_NAME, NOTARY_SOURCE_RUN_FLAG, NOTARY_TICKET_FLAG, };
+/** Optional ticket flag: absent/blank = unbound; non-empty invalid = honest fail. */
+export function readNotaryTicketFlag(flag) {
+    if (flag === undefined)
+        return undefined;
+    if (typeof flag !== "string") {
+        throw new Error("Notary ak-notary-ticket-number is present but not a safe positive integer string");
+    }
+    if (flag.trim() === "")
+        return undefined;
+    const n = Number(flag);
+    if (!Number.isSafeInteger(n) || n < 1) {
+        throw new Error("Notary ak-notary-ticket-number is present but not a safe positive integer string");
+    }
+    return n;
+}
+/**
+ * Typed session bound (locator + optional ticket).
+ * Sole production projection for agent-start material + session custom entry.
+ */
+export function projectNotarySessionBound(input) {
+    return {
+        sourceRun: input.sourceRun,
+        ...(input.ticketNumber === undefined ? {} : { ticketNumber: input.ticketNumber }),
+    };
+}
+/**
+ * Session custom-entry type for typed notary bound (written by shared envelope).
+ * Role module only projects; lifecycle write is envelope-owned (ADR 0018).
+ */
+export const NOTARY_SESSION_BOUND_ENTRY = "notary-session-bound";
+/**
+ * Project notary bound from host flags (envelope consumption seam).
+ * undefined when source-run flag absent/blank.
+ * Ticket invalid → throws (honest fail; envelope owns the read).
+ */
+export function projectNotaryBoundFromFlags(getFlag) {
+    const path = getFlag(NOTARY_SOURCE_RUN_FLAG.name);
+    if (typeof path !== "string" || path.trim() === "")
+        return undefined;
+    const ticketNumber = readNotaryTicketFlag(getFlag(NOTARY_TICKET_FLAG.name));
+    return {
+        sourceRunPath: path,
+        ...(ticketNumber === undefined ? {} : { ticketNumber }),
+    };
+}
+/** Assemble systemPrompt body from base + soul only (NO embedded bound JSON).
+ * The typed session bound travels separately as `readingMaterial`; adapters fold
+ * it into the provider-visible prompt at the send boundary. */
+export function assembleNotaryAgentStartPrompt(input) {
+    return `${input.baseSystemPrompt}\n\n<notary_soul>\n${input.soul}\n</notary_soul>`;
+}
+export function createNotaryRoleRuntime(pi, dependencies, host) {
+    let activation;
+    let registered = false;
+    // Baseline source-run flag registration (pre-#582). Ticket flag is envelope-owned.
+    pi.registerFlag(NOTARY_SOURCE_RUN_FLAG.name, NOTARY_SOURCE_RUN_FLAG.definition);
+    return {
+        /**
+         * @param admitted Optional ticket from envelope flag decode (ADR 0018).
+         * Role module never getFlag's the ticket — envelope owns that read.
+         */
+        async activate(admitted) {
+            const path = pi.getFlag(NOTARY_SOURCE_RUN_FLAG.name);
+            if (typeof path !== "string" || path.trim() === "") {
+                throw new Error("Notary requires --ak-notary-source-run");
+            }
+            const soul = (await dependencies.loadSoul()).trim();
+            if (soul.length === 0)
+                throw new Error("Notary soul is empty");
+            const sourceRun = await dependencies.loadSourceRunLocator(path);
+            activation = {
+                soul,
+                sourceRun,
+                ...(admitted?.ticketNumber === undefined
+                    ? {}
+                    : { ticketNumber: admitted.ticketNumber }),
+            };
+            if (!registered) {
+                registered = true;
+                pi.registerTool({
+                    name: NOTARY_OUTPUT_TOOL_NAME,
+                    label: "符宝郎输出",
+                    description: "提交引文保真与票面对齐的 typed pass/bounce/escalate 决议。",
+                    promptSnippet: "提交符宝郎决议",
+                    parameters: notaryOutputSchema,
+                    async execute(toolCallId, parameters, _signal, _onUpdate, ctx) {
+                        if (activation === undefined) {
+                            throw new Error("符宝郎未激活");
+                        }
+                        // Unique submission + terminate only. Shape is not an admission gate
+                        // (第 0 条 / ADR 0055): lawful pass/bounce/escalate projected; else params as-is.
+                        // #541 infra declaration + sole-final barrier are ledger-owned (#575).
+                        const lawful = projectLawfulNotaryOutput(parameters);
+                        const details = lawful ?? retainNotarySubmission(parameters);
+                        return {
+                            content: [{ type: "text", text: NOTARY_ACCEPTED_TEXT }],
+                            details,
+                            terminate: true,
+                        };
+                    },
+                });
+                // Evidence assembly only (ADR 0018): soul + bound projection.
+                // Ticket value is envelope-admitted at activate — not re-read from flags here.
+                pi.on("before_agent_start", (event) => {
+                    if (activation === undefined) {
+                        throw new Error("符宝郎未激活");
+                    }
+                    return {
+                        systemPrompt: assembleNotaryAgentStartPrompt({
+                            baseSystemPrompt: event.systemPrompt,
+                            soul: activation.soul,
+                        }),
+                        readingMaterial: projectNotarySessionBound({
+                            sourceRun: activation.sourceRun,
+                            ...(activation.ticketNumber === undefined
+                                ? {}
+                                : { ticketNumber: activation.ticketNumber }),
+                        }),
+                    };
+                });
+            }
+            // Evidence role: keep Pi default tools + notary output (ADR 0064 unrestricted).
+            const all = pi.getAllTools().map((tool) => tool.name);
+            if (all.filter((name) => name === NOTARY_OUTPUT_TOOL_NAME).length !== 1) {
+                throw new Error(`Notary required tool collision or missing: ${NOTARY_OUTPUT_TOOL_NAME}`);
+            }
+        },
+    };
+}

package/dist/oauth-keepalive.js

@@ -0,0 +1,158 @@
+/**
+ * Extension-side OAuth credential keepalive (#351).
+ *
+ * Periodically calls the public `ctx.modelRegistry.refresh` facade so expired
+ * OAuth tokens (e.g. kimi-coding 900s TTL) are renewed during long sessions.
+ * Does not read auth.json, touch pi-ai private APIs, or reuse the 183s idle gate.
+ */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const DEFAULT_OAUTH_KEEPALIVE_PROVIDERS = ["kimi-coding"];
+export const OAUTH_KEEPALIVE_INTERVAL_MS = 60_000;
+/** Persistent extension setting filename under PI_CODING_AGENT_DIR / ~/.pi/agent. */
+export const OAUTH_KEEPALIVE_SETTING_FILENAME = "oauth-keepalive.json";
+/** Path to the static provider-list extension setting (default ["kimi-coding"]). */
+export function oauthKeepaliveSettingPath() {
+    return join(process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent"), OAUTH_KEEPALIVE_SETTING_FILENAME);
+}
+function isExactRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Read the static keepalive provider list from the extension setting file.
+ * Missing file → default ["kimi-coding"]. Malformed content fails closed.
+ * Production extension root is the sole caller that feeds this into keepalive.
+ */
+export function readOAuthKeepaliveProviders(path = oauthKeepaliveSettingPath()) {
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        if (!isExactRecord(raw) || !Array.isArray(raw.providers)) {
+            throw new Error("OAuth keepalive setting is malformed: expected { providers: string[] }");
+        }
+        const providers = raw.providers.map((id, index) => {
+            if (typeof id !== "string" || id.trim() === "") {
+                throw new Error(`OAuth keepalive setting providers[${index}] must be a non-empty string`);
+            }
+            // Accept via trim-non-empty; return the normalized id so refresh can hit real providers.
+            return id.trim();
+        });
+        return Object.freeze(providers);
+    }
+    catch (error) {
+        // Absent optional setting uses the documented default; all other causes propagate.
+        if (error instanceof Error &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return DEFAULT_OAUTH_KEEPALIVE_PROVIDERS;
+        }
+        throw error;
+    }
+}
+const defaultScheduler = {
+    every(ms, tick) {
+        const timer = setInterval(tick, ms);
+        // Allow the process to exit if a caller forgets stop (same discipline as trajectory).
+        timer.unref?.();
+        return () => clearInterval(timer);
+    },
+};
+function errorClassName(error) {
+    if (error instanceof Error && error.name.trim() !== "")
+        return error.name;
+    if (error !== null && typeof error === "object" && "name" in error) {
+        const name = error.name;
+        if (typeof name === "string" && name.trim() !== "")
+            return name;
+    }
+    return "Error";
+}
+function formatWarning(providerId, error) {
+    const cls = errorClassName(error);
+    const detail = error instanceof Error
+        ? error.message
+        : typeof error === "string"
+            ? error
+            : String(error);
+    return `oauth-keepalive: refresh failed for provider ${providerId} (${cls}): ${detail}`;
+}
+function emitWarning(ctx, providerId, error) {
+    const text = formatWarning(providerId, error);
+    // Exactly one visible surface per failure: prefer ui.notify when present;
+    // console.warn only when notify is unavailable (print/json / headless)
+    // or when notify itself throws (still one surface; carry the notify cause).
+    const notify = ctx.ui?.notify;
+    if (typeof notify === "function") {
+        try {
+            notify(text, "warning");
+        }
+        catch (notifyError) {
+            // Notify threw: fall back once so refresh failure stays visible.
+            console.warn(text, notifyError);
+        }
+        return;
+    }
+    console.warn(text);
+}
+/**
+ * Session-lifecycle owner for periodic OAuth refresh via the public modelRegistry facade.
+ * Single-flight: overlapping ticks are skipped. stop() cancels the interval and aborts in-flight work.
+ */
+export function createOAuthKeepalive(options = {}) {
+    const providers = Object.freeze((options.providers ?? DEFAULT_OAUTH_KEEPALIVE_PROVIDERS).map((id) => id));
+    const intervalMs = options.intervalMs ?? OAUTH_KEEPALIVE_INTERVAL_MS;
+    const scheduler = options.scheduler ?? defaultScheduler;
+    let cancel;
+    let abortController;
+    /** Bare single-flight gate; survives stop/start until the in-flight call settles. */
+    let inFlight = false;
+    const stop = () => {
+        cancel?.();
+        cancel = undefined;
+        abortController?.abort();
+        abortController = undefined;
+        // Do not clear unsettled inFlight — single-flight is continuous across stop/start.
+    };
+    const runTick = async (ctx) => {
+        if (inFlight)
+            return;
+        const ac = abortController;
+        if (ac === undefined || ac.signal.aborted)
+            return;
+        inFlight = true;
+        try {
+            const result = await ctx.modelRegistry.refresh({
+                providers: [...providers],
+                allowNetwork: true,
+                signal: ac.signal,
+            });
+            if (ac.signal.aborted || result.aborted)
+                return;
+            for (const [providerId, error] of result.errors) {
+                emitWarning(ctx, providerId, error);
+            }
+        }
+        catch (error) {
+            if (ac.signal.aborted)
+                return;
+            // Whole-call failure: one warning per configured provider (ticket error surface).
+            for (const providerId of providers) {
+                emitWarning(ctx, providerId, error);
+            }
+        }
+        finally {
+            inFlight = false;
+        }
+    };
+    return {
+        start(ctx) {
+            // Reload / re-start: tear down any prior interval before hanging a new one.
+            stop();
+            abortController = new AbortController();
+            cancel = scheduler.every(intervalMs, () => {
+                void runTick(ctx);
+            });
+        },
+        stop,
+    };
+}

package/dist/package-contracts/terminating-tools.js

@@ -11,7 +11,6 @@ import { DOCTOR_ACCEPTED_TEXT, DOCTOR_OUTPUT_TOOL_NAME, validateDoctorSubmission
 import { GATEKEEPER_ACCEPTED_TEXT, GATEKEEPER_OUTPUT_TOOL_NAME, validateRecordedGatekeeperOutput } from "./gatekeeper-output.js";
 import { NAVIGATOR_ACCEPTED_TEXT, NAVIGATOR_OUTPUT_TOOL_NAME, validateRecordedNavigatorOutput } from "./navigator-output.js";
 import { AUDITOR_ACCEPTED_TEXT, AUDITOR_OUTPUT_TOOL_NAME, validateRecordedAuditorOutput } from "./auditor-output.js";
-import { EVIDENCE_CHILD_ACCEPTED_TEXT, EVIDENCE_CHILD_OUTPUT_TOOL_NAME, validateRecordedEvidenceChildOutput } from "./evidence-child-output.js";
 import { MERGER_ACCEPTED_TEXT, MERGER_OUTPUT_TOOL_NAME, validateMergerOutput } from "../merger-contracts.js";
 import { NOTARY_ACCEPTED_TEXT, NOTARY_OUTPUT_TOOL_NAME, validateRecordedNotaryOutput } from "../notary-contracts.js";
 import { COUNTERSIGN_ACCEPTED_TEXT, COUNTERSIGN_OUTPUT_TOOL_NAME, validateRecordedCountersignOutput } from "../countersign-contracts.js";
@@ -19,7 +18,7 @@ import { GLEANER_LEFT_ACCEPTED_TEXT, GLEANER_LEFT_OUTPUT_TOOL_NAME, validateReco
 import { INSPECTOR_ACCEPTED_TEXT, INSPECTOR_OUTPUT_TOOL_NAME, validateRecordedInspectorOutput } from "../inspector-contracts.js";
 import { DIARIST_ACCEPTED_TEXT, DIARIST_OUTPUT_TOOL_NAME, validateRecordedDiaristOutput } from "../diarist-contracts.js";
 import { CODER_ACCEPTED_TEXT, CODER_OUTPUT_TOOL_NAME, FIXER_ACCEPTED_TEXT, FIXER_OUTPUT_TOOL_NAME, validateAcceptedWorkerDetails, } from "./worker-output.js";
-export { CODER_ACCEPTED_TEXT, CODER_OUTPUT_TOOL_NAME, COLLECTOR_ACCEPTED_TEXT, COLLECTOR_OUTPUT_TOOL, FIXER_ACCEPTED_TEXT, FIXER_OUTPUT_TOOL_NAME, JUDGE_ACCEPTED_TEXT, JUDGE_OUTPUT_TOOL_NAME, REVIEWER_ACCEPTED_TEXT, REVIEWER_OUTPUT_TOOL_NAME, MERGER_ACCEPTED_TEXT, MERGER_OUTPUT_TOOL_NAME, validateAcceptedCollectorReceipt, validateAcceptedJudgeDetails, projectReviewerIntentToReceipt, validateReviewerIntent, validateRuntimeReviewerReceipt, validateAcceptedWorkerDetails, validateDoctorSubmissionShape, validateRecordedDoctorOutput, validateMergerOutput, validateRecordedNotaryOutput, validateRecordedCountersignOutput, validateRecordedGleanerLeftOutput, validateRecordedInspectorOutput, validateRecordedGatekeeperOutput, validateRecordedNavigatorOutput, validateRecordedAuditorOutput, validateRecordedEvidenceChildOutput, validateRecordedDiaristOutput, };
+export { CODER_ACCEPTED_TEXT, CODER_OUTPUT_TOOL_NAME, COLLECTOR_ACCEPTED_TEXT, COLLECTOR_OUTPUT_TOOL, FIXER_ACCEPTED_TEXT, FIXER_OUTPUT_TOOL_NAME, JUDGE_ACCEPTED_TEXT, JUDGE_OUTPUT_TOOL_NAME, REVIEWER_ACCEPTED_TEXT, REVIEWER_OUTPUT_TOOL_NAME, MERGER_ACCEPTED_TEXT, MERGER_OUTPUT_TOOL_NAME, validateAcceptedCollectorReceipt, validateAcceptedJudgeDetails, projectReviewerIntentToReceipt, validateReviewerIntent, validateRuntimeReviewerReceipt, validateAcceptedWorkerDetails, validateDoctorSubmissionShape, validateRecordedDoctorOutput, validateMergerOutput, validateRecordedNotaryOutput, validateRecordedCountersignOutput, validateRecordedGleanerLeftOutput, validateRecordedInspectorOutput, validateRecordedGatekeeperOutput, validateRecordedNavigatorOutput, validateRecordedAuditorOutput, validateRecordedDiaristOutput, };
 export const TERMINATING_TOOL_NAMES = [
     CODER_OUTPUT_TOOL_NAME,
     FIXER_OUTPUT_TOOL_NAME,
@@ -35,7 +34,6 @@ export const TERMINATING_TOOL_NAMES = [
     GATEKEEPER_OUTPUT_TOOL_NAME,
     NAVIGATOR_OUTPUT_TOOL_NAME,
     AUDITOR_OUTPUT_TOOL_NAME,
-    EVIDENCE_CHILD_OUTPUT_TOOL_NAME,
     DIARIST_OUTPUT_TOOL_NAME,
 ];
 export function isTerminatingToolName(name) {
@@ -71,8 +69,6 @@ export function acceptedTextFor(toolName) {
             return NAVIGATOR_ACCEPTED_TEXT;
         case AUDITOR_OUTPUT_TOOL_NAME:
             return AUDITOR_ACCEPTED_TEXT;
-        case EVIDENCE_CHILD_OUTPUT_TOOL_NAME:
-            return EVIDENCE_CHILD_ACCEPTED_TEXT;
         case DIARIST_OUTPUT_TOOL_NAME:
             return DIARIST_ACCEPTED_TEXT;
     }
@@ -127,20 +123,14 @@ export function validateAcceptedDetails(toolName, details) {
         [GATEKEEPER_OUTPUT_TOOL_NAME]: ["dispatch", "pass"],
         [NAVIGATOR_OUTPUT_TOOL_NAME]: ["advice"],
         [AUDITOR_OUTPUT_TOOL_NAME]: ["pass", "bounce", "escalate"],
-        [EVIDENCE_CHILD_OUTPUT_TOOL_NAME]: [],
         [DIARIST_OUTPUT_TOOL_NAME]: ["completed"],
     };
     const collectorDiscriminator = toolName === COLLECTOR_OUTPUT_TOOL && Array.isArray(candidate?.groups);
-    // Evidence-child: any object is a candidate body — no report-field presence gate (#675 / ADR 0055).
-    const evidenceChildDiscriminator = toolName === EVIDENCE_CHILD_OUTPUT_TOOL_NAME
-        && candidate !== null
-        && typeof candidate === "object"
-        && !Array.isArray(candidate);
     const baseDiscriminator = discriminator;
     const runtimeBindingMissing = (toolName === DOCTOR_OUTPUT_TOOL_NAME && baseDiscriminator === "completed" && !(candidate?.cost !== null && typeof candidate?.cost === "object")) ||
         (toolName === REVIEWER_OUTPUT_TOOL_NAME && candidate?.version !== 2);
     if (runtimeBindingMissing ||
-        (!collectorDiscriminator && !evidenceChildDiscriminator && (typeof discriminator !== "string" || !lawfulStatuses[toolName].includes(baseDiscriminator)))) {
+        (!collectorDiscriminator && (typeof discriminator !== "string" || !lawfulStatuses[toolName].includes(baseDiscriminator)))) {
         throw new AcceptedDetailsContractError("terminating receipt has no recognized execution discriminator");
     }
     try {
@@ -173,8 +163,6 @@ export function validateAcceptedDetails(toolName, details) {
                 return validateRecordedNavigatorOutput(details);
             case AUDITOR_OUTPUT_TOOL_NAME:
                 return validateRecordedAuditorOutput(details);
-            case EVIDENCE_CHILD_OUTPUT_TOOL_NAME:
-                return validateRecordedEvidenceChildOutput(details);
             case DIARIST_OUTPUT_TOOL_NAME:
                 return validateRecordedDiaristOutput(details);
         }
@@ -231,8 +219,6 @@ export function acceptedFacts(toolName, details) {
         case NAVIGATOR_OUTPUT_TOOL_NAME:
         case AUDITOR_OUTPUT_TOOL_NAME:
             return { status: details.status };
-        case EVIDENCE_CHILD_OUTPUT_TOOL_NAME:
-            return { status: "report" };
         case DIARIST_OUTPUT_TOOL_NAME: return { status: details.status };
         case JUDGE_OUTPUT_TOOL_NAME: return { status: details.judgeStatus };
         case COUNTERSIGN_OUTPUT_TOOL_NAME: return { status: details.countersignStatus };