@akagilnc/pi-workflow-roles 0.1.3671 → 0.1.3682

package/src/public-cli/instruction-seat-run.ts

@@ -35,11 +35,7 @@ import {
   type PublicResumeRequest,
   type SameTicketSummonsMaterials,
 } from "./run-lifecycle.ts";
-import {
-  bindReusedTicketNumber,
-  resolveKnownTicketNumber,
-  tryResumeSameTicketSeatRun,
-} from "./seat-ticket-binding.ts";
+import { tryResumeSameTicketSeatRun } from "./seat-ticket-binding.ts";
 import {
   presentStructuralRejection,
   readEngineDetourInfrastructureFailure,
@@ -246,11 +242,11 @@ export async function runPublicInstructionSeat(
   let auditorSubject: "judge" | "doctor" | undefined;
   let auditorSourceRun: string | undefined;
   let auditorSourceTicket: number | undefined;
-  let reusedTicketNumber: number | undefined;
 
-  // #637 / #747: resume prior seat run with this summons' materials.
-  // Auditor (#747): parent --source-run path is the lookup key.
-  // Other instruction seats: reuse known ticket (#709). No bare catch→fresh.
+  // #637 / #747 / #771: resume prior seat run with this summons' materials.
+  // Auditor (#747): parent --source-run path is the lookup key (typed inherit).
+  // Other instruction seats: no mechanical ticket match against instruction text.
+  // No bare catch→fresh.
   const projectRoot = parsed.project ?? env.cwd;
   if (role === "auditor") {
     if (parsed.subject !== "judge" && parsed.subject !== "doctor") {
@@ -285,12 +281,6 @@ export async function runPublicInstructionSeat(
       );
       return { exitCode: 2 };
     }
-  } else {
-    reusedTicketNumber = await resolveKnownTicketNumber({
-      instruction: parsed.instruction,
-      projectRoot,
-      home: env.home,
-    });
   }
 
   const summons: SameTicketSummonsMaterials = {
@@ -319,22 +309,6 @@ export async function runPublicInstructionSeat(
         }),
     });
     if (resumed !== undefined) return resumed;
-  } else if (reusedTicketNumber !== undefined) {
-    const resumed = await tryResumeSameTicketSeatRun({
-      home: env.home,
-      projectRoot,
-      role,
-      ticketNumber: reusedTicketNumber,
-      freshSummons: env.freshSummons,
-      summons,
-      resume: (runId, materials) =>
-        runPublicInstructionSeatResume(
-          { runId, ...(materials === undefined ? {} : { summons: materials }) },
-          env,
-          io,
-        ),
-    });
-    if (resumed !== undefined) return resumed;
   }
 
   let admitted: AdmittedInstructionSeatInvocation;
@@ -399,13 +373,9 @@ export async function runPublicInstructionSeat(
         request: turnRequest,
         adapters: instructionSeatAdapters({
           beforeDispatch: async (admittedSeat) => {
-            // #635/#709: ticket bind inside controlled-failure boundary.
-            // Auditor inherits source-run ticket (notary face).
-            // Other seats: reuse known ticket identity.
+            // Auditor inherits source-run ticket (notary face) — typed, not prose match.
             if (auditorSourceTicket !== undefined) {
               await bindAdmittedTicketNumber(admittedSeat, auditorSourceTicket);
-            } else {
-              await bindReusedTicketNumber(admittedSeat, reusedTicketNumber);
             }
           },
         }),

package/src/public-cli/invocation.ts

@@ -3,6 +3,7 @@
  * Attachments, project default/override (ADR 0052 / #106).
  */
 import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import {
   lstat,
   mkdir,
@@ -487,6 +488,57 @@ export async function bindAdmittedTicketNumber(
   );
 }
 
+/**
+ * Bind ticket identity onto a run directory's durable pages when the admitted
+ * object is not in hand (起居郎 accept hook after LLM assertion, #771).
+ * Idempotent when the same number is already on the pages.
+ */
+export async function bindTicketNumberOnRunDirectory(
+  runDirectory: string,
+  ticketNumber: number,
+): Promise<void> {
+  if (!Number.isSafeInteger(ticketNumber) || ticketNumber < 1) {
+    throw new Error(
+      `bindTicketNumberOnRunDirectory requires a safe positive integer, got ${String(ticketNumber)}`,
+    );
+  }
+  const admittedPath = join(runDirectory, "admitted-request.json");
+  const invocationPath = join(runDirectory, "invocation.json");
+  const admitted = JSON.parse(await readFile(admittedPath, "utf8")) as Record<
+    string,
+    unknown
+  >;
+  const existing = admitted.ticketNumber;
+  if (typeof existing === "number") {
+    if (existing === ticketNumber) return;
+    throw new Error(
+      `bindTicketNumberOnRunDirectory refuses to replace existing ticket #${existing} with #${ticketNumber}`,
+    );
+  }
+  // Conflict guard before any write: crash window of bindAdmittedTicketNumber
+  // can leave invocation bound while admitted-request is still unbound — refuse
+  // silent rebind. Read-before-merge; never check the page just overwritten.
+  if (existsSync(invocationPath)) {
+    const invocation = JSON.parse(
+      await readFile(invocationPath, "utf8"),
+    ) as Record<string, unknown>;
+    if (
+      typeof invocation.ticketNumber === "number" &&
+      invocation.ticketNumber !== ticketNumber
+    ) {
+      throw new Error(
+        `bindTicketNumberOnRunDirectory refuses to replace invocation ticket #${invocation.ticketNumber} with #${ticketNumber}`,
+      );
+    }
+  }
+  await writeFile(
+    admittedPath,
+    `${JSON.stringify({ ...admitted, ticketNumber }, null, 2)}\n`,
+    "utf8",
+  );
+  await mergeInvocationIdentityPage(runDirectory, { ticketNumber });
+}
+
 /** Add the identity returned by the production Pi launch seam to its existing ledger page. */
 export async function recordLaunchedPiIdentity(
   runDirectory: string,

package/src/public-cli/judge-run.ts

@@ -15,7 +15,6 @@ import {
   buildJudgeTransportPrompt,
   type AdmittedJudgeInvocation,
 } from "./invocation.ts";
-import { resolveSeatTicketBinding } from "./seat-ticket-binding.ts";
 import {
   loadResumableJudgeRun,
   markRunAdmitted,
@@ -156,12 +155,7 @@ export async function runPublicJudge(
           }),
         },
       }),
-    adapters: {
-      ...judgeAdapters(),
-      beforeDispatch: async (admittedSeat) => {
-        await resolveSeatTicketBinding(admittedSeat, env);
-      },
-    },
+    adapters: judgeAdapters(),
     ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
   });
 }

package/src/public-cli/run-lifecycle.ts

@@ -1139,37 +1139,6 @@ export async function findLatestRunIdForSeatTicket(input: {
   return best;
 }
 
-/**
- * Ticket identities this book's retained runs already record (#709).
- * Read-only reuse surface for seat ticket binding — no ticket number is minted here.
- */
-export async function collectBookRunTicketNumbers(input: {
-  readonly home: string;
-  readonly bookKey: string;
-}): Promise<ReadonlySet<number>> {
-  const ledgerHome = resolveActivationLedgerHome(input.home);
-  const runsDir = join(
-    activationBookDirectory(ledgerHome, input.bookKey),
-    "runs",
-  );
-  let entries: string[];
-  try {
-    entries = await readdir(runsDir);
-  } catch (error) {
-    if (errorCodeOf(error) === "ENOENT") return new Set();
-    throw error;
-  }
-  const known = new Set<number>();
-  for (const entry of entries) {
-    // runs/ also holds non-run files (institutional-resolution.json, Finder
-    // .DS_Store); only `<runId>@<role>` directories are runs (#769).
-    if (!entry.includes("@")) continue;
-    const ticketNumber = await readRunTicketNumber(join(runsDir, entry));
-    if (ticketNumber !== undefined) known.add(ticketNumber);
-  }
-  return known;
-}
-
 type LoadedAdmittedRequestFields = {
   readonly instruction: string;
   readonly instructionEmpty: boolean;

package/src/public-cli/seat-ticket-binding.ts

@@ -1,157 +1,26 @@
 /**
- * Shared ticket identity seam for public court seats (#635 / #637 / #709 / #747).
- * One path: unbound admission → reuse a ticket number this book already records
- * (retained run pages + 起居录 volumes) → bindAdmittedTicketNumber.
- * ADR 0081 `reuse-case-ticket-without-extra-llm`: no seat-side model call, no
- * second ticket-number source of truth, no minting a number from human titles.
- * Nothing matched is not 真无票 — the run simply stays unbound, which is lawful.
- * No CLI --ticket and no attachment frontmatter binding.
- * #747: officer same-parent resume also lives here (shared seam).
+ * Shared ticket identity seam for public court seats (#635 / #637 / #709 / #747 / #771).
+ *
+ * ADR 0075 `diarist-resolves-ticket-llm-layer`: the seat's LLM names the court
+ * target as a typed assertion; the mechanical layer only verifies that assertion
+ * (complete decimal of N appears in the summons; ticket exists). Code never
+ * judges which ticket the summons is about — no prose harvest, no first-#N
+ * position pick, no matching book-known numbers against instruction text
+ * (锚定宪法; owner 2026-09-08: 代码不准做判断). Other seats reuse a typed
+ * identity already handed over (起居郎 assertion / source-run / already-bound
+ * resume) — they do not re-recognize from instruction. No CLI --ticket, no
+ * attachment frontmatter. #747: officer same-parent resume also lives here.
+ *
+ * Mechanical verify helpers live on diarist.ts / invocation.ts (sole owners).
+ * This module owns same-ticket / same-parent resume only.
  */
-import { existsSync } from "node:fs";
-
-import {
-  ActivationGitRepositoryRequiredError,
-  resolveBookKeyFromGit,
-} from "../activation-ledger-git.ts";
-import { resolveTicketProvenanceVolume } from "../ticket-provenance.ts";
-import {
-  bindAdmittedTicketNumber,
-  type AdmittedRoleInvocation,
-} from "./invocation.ts";
+import { resolveBookKeyFromGit } from "../activation-ledger-git.ts";
 import {
-  collectBookRunTicketNumbers,
   findLatestRunIdForSeatTicket,
   type RoleRunRecord,
   type SameTicketSummonsMaterials,
 } from "./run-lifecycle.ts";
 
-export type SeatTicketBindingEnv = {
-  readonly home: string;
-};
-
-/**
- * Complete decimal ticket tokens in an instruction.
- * A digit run is one token: `82` inside `#582` is not 82, and a leading zero
- * makes the run a different literal than the ticket number it would parse to.
- */
-export function instructionTicketTokens(
-  instruction: string,
-): readonly number[] {
-  const tokens = new Set<number>();
-  for (const run of instruction.match(/\d+/g) ?? []) {
-    if (run.startsWith("0")) continue;
-    const parsed = Number(run);
-    if (!Number.isSafeInteger(parsed) || parsed < 1) continue;
-    tokens.add(parsed);
-  }
-  return [...tokens];
-}
-
-/**
- * Ticket identity this summons reuses, or undefined when none is unambiguous.
- * Known identities come only from records this book already holds: 起居录 volume
- * partitions and ticket numbers on retained run pages. Zero or several known
- * tokens in the instruction leave the run unbound — never guess, never fail.
- */
-export async function resolveKnownTicketNumber(input: {
-  readonly instruction: string;
-  readonly projectRoot: string;
-  readonly home: string;
-  readonly bookKey?: string;
-}): Promise<number | undefined> {
-  const tokens = instructionTicketTokens(input.instruction);
-  if (tokens.length === 0) return undefined;
-  const known: number[] = [];
-  let runTickets: ReadonlySet<number> | undefined;
-  for (const token of tokens) {
-    const volume = resolveTicketProvenanceVolume(
-      token,
-      input.projectRoot,
-      input.home,
-    );
-    if (existsSync(volume.volumeDir)) {
-      known.push(token);
-      continue;
-    }
-    if (runTickets === undefined) {
-      runTickets = await readBookRunTickets(input);
-    }
-    if (runTickets.has(token)) known.push(token);
-  }
-  return known.length === 1 ? known[0] : undefined;
-}
-
-/**
- * Diarist first-summons identity (ADR 0081 `initial-court-ticket-supplied`).
- * Prefer a book-known reuse; when the book has no record yet, the sole complete
- * decimal token in the caller's dispatch is the supplied ticket — the working
- * 起居郎 round establishes the volume. Several tokens or none stay unbound.
- * Not a second ticket-number source of truth and not an extra recognizer call.
- */
-export async function resolveDiaristSummonsTicketNumber(input: {
-  readonly instruction: string;
-  readonly projectRoot: string;
-  readonly home: string;
-  readonly bookKey?: string;
-}): Promise<number | undefined> {
-  const known = await resolveKnownTicketNumber(input);
-  if (known !== undefined) return known;
-  const tokens = instructionTicketTokens(input.instruction);
-  return tokens.length === 1 ? tokens[0] : undefined;
-}
-
-/**
- * Ticket numbers on this book's retained runs.
- * A directory with no book (not a git repository) simply holds no run history —
- * admission owns that rejection face, this lookup does not pre-empt it.
- */
-async function readBookRunTickets(input: {
-  readonly projectRoot: string;
-  readonly home: string;
-  readonly bookKey?: string;
-}): Promise<ReadonlySet<number>> {
-  let bookKey: string;
-  try {
-    bookKey = input.bookKey ?? resolveBookKeyFromGit(input.projectRoot);
-  } catch (error) {
-    if (error instanceof ActivationGitRepositoryRequiredError) return new Set();
-    throw error;
-  }
-  return await collectBookRunTicketNumbers({ home: input.home, bookKey });
-}
-
-/** Bind a reused ticket number onto an admission that is still unbound. */
-export async function bindReusedTicketNumber(
-  admitted: AdmittedRoleInvocation,
-  ticketNumber: number | undefined,
-): Promise<void> {
-  if (ticketNumber === undefined) return;
-  if (admitted.ticketNumber !== undefined) return;
-  await bindAdmittedTicketNumber(admitted, ticketNumber);
-}
-
-/**
- * Sole seat disposition for an unbound admission (#635 / #709).
- * Already-bound admissions short-circuit — resume keeps the identity it has.
- * Used by seats that do not pre-resolve for same-ticket resume; the seats that
- * do (countersign / inspector / diarist) reuse the number they already resolved.
- */
-export async function resolveSeatTicketBinding(
-  admitted: AdmittedRoleInvocation,
-  env: SeatTicketBindingEnv,
-): Promise<number | undefined> {
-  if (admitted.ticketNumber !== undefined) return admitted.ticketNumber;
-  const ticketNumber = await resolveKnownTicketNumber({
-    instruction: admitted.instruction,
-    projectRoot: admitted.projectRoot,
-    home: env.home,
-    bookKey: admitted.bookKey,
-  });
-  await bindReusedTicketNumber(admitted, ticketNumber);
-  return ticketNumber;
-}
-
 /**
  * Sole same-seat → resume decision (#637 / #724 / #747).
  * Officer seats (notary/inspector/auditor) look up by parent run path; countersign

package/src/role-runtime.ts

@@ -81,9 +81,12 @@ import {
 } from "./diarist-contracts.ts";
 import {
   commitDiaristSelections,
+  DiaristTicketVerificationError,
   loadDiaristSourceCatalog,
+  verifyAssertedTicketNumber,
   type DiaristSourceCatalog,
 } from "./diarist.ts";
+import { bindTicketNumberOnRunDirectory } from "./public-cli/invocation.ts";
 import {
   GATEKEEPER_TOOL_SPEC,
   type GatekeeperRuntimeDependencies,
@@ -925,12 +928,40 @@ export function createAuditorRoleRuntime(
   };
 }
 
+/**
+ * LLM typed court-target assertion from diarist output (ADR 0075).
+ * null/absent = true-unbound; positive safe integer = ticket N.
+ * Any other shape fails honestly — never washes into unbound.
+ */
+function readDiaristTicketAssertion(
+  submitted: Record<string, unknown> | undefined,
+): { kind: "true-unbound" } | { kind: "ticket"; ticketNumber: number } {
+  if (submitted === undefined || !("ticketNumber" in submitted)) {
+    return { kind: "true-unbound" };
+  }
+  const raw = submitted.ticketNumber;
+  if (raw === null) return { kind: "true-unbound" };
+  if (typeof raw === "number" && Number.isSafeInteger(raw) && raw >= 1) {
+    return { kind: "ticket", ticketNumber: raw };
+  }
+  if (typeof raw === "string" && /^[1-9]\d*$/.test(raw)) {
+    const n = Number(raw);
+    if (Number.isSafeInteger(n) && n >= 1) {
+      return { kind: "ticket", ticketNumber: n };
+    }
+  }
+  throw new DiaristTicketVerificationError(
+    "assertion-uninterpretable",
+    "diarist ticketNumber must be a safe integer >= 1, null, or absent",
+  );
+}
+
 /**
  * #708: 起居郎 public seat on the shared filed-officer envelope.
  * Semantic collection happened in this role's own turn; the accept hook runs the
- * mechanical band (verbatim reverse-verify → idempotent sitian append →
- * watermark) and records the resulting sitian facts next to the receipt.
- * Machine facts never come from model self-report (锚定宪法).
+ * mechanical band (ticket verify when first-summons + verbatim reverse-verify →
+ * idempotent sitian append → watermark) and records the resulting sitian facts
+ * next to the receipt. Machine facts never come from model self-report (锚定宪法).
  */
 export function createDiaristRoleRuntime(
   roleHost: RoleHost,
@@ -953,21 +984,88 @@ export function createDiaristRoleRuntime(
           parameters !== null && typeof parameters === "object" && !Array.isArray(parameters)
             ? (parameters as Record<string, unknown>)
             : undefined;
-        // True-unbound summons: no ticket, no catalog, no diary committed — so
-        // this turn produced no sitian facts. A self-reported `sitian` is not
-        // one (锚定宪法); drop it rather than let it ride into decisiveFacts.
-        // Carrying the field is not a reason to bounce the receipt (第 0 条).
+
+        // LLM cannot identify the court target — escalate without machine facts.
+        // Strip sitian (锚定宪法) and ticketNumber (unverified — must not leak
+        // into caller-visible admitted typed key via decisiveFacts mirror).
+        if (submitted?.status === "escalate") {
+          if (!("sitian" in submitted) && !("ticketNumber" in submitted)) {
+            return submitted;
+          }
+          const stripped = { ...submitted };
+          delete stripped.sitian;
+          delete stripped.ticketNumber;
+          return stripped;
+        }
+
+        const assertion = readDiaristTicketAssertion(submitted);
+
+        // No frozen catalog: only true-unbound is lawful without volume work.
+        // A self-reported `sitian` is not machine fact (锚定宪法).
         if (catalog === undefined) {
+          if (assertion.kind === "ticket") {
+            throw new DiaristTicketVerificationError(
+              "assertion-uninterpretable",
+              `diarist asserted ticket #${assertion.ticketNumber} but no source catalog was frozen for this turn`,
+            );
+          }
           if (submitted === undefined || !("sitian" in submitted)) return undefined;
           const stripped = { ...submitted };
           delete stripped.sitian;
           return stripped;
         }
+
+        // Already bound before the turn (typed handoff / resume): skip re-recognition
+        // (ADR 0075 已绑定 ticket 优先) and commit under that identity.
+        if (catalog.ticketNumber !== undefined) {
+          const facts = await commitDiaristSelections({
+            catalog,
+            selections: projectDiaristSelections(parameters),
+          });
+          return {
+            ...(submitted ?? { receipt: parameters }),
+            ticketNumber: catalog.ticketNumber,
+            sitian: facts,
+          };
+        }
+
+        // First summons: LLM typed assertion → mechanical verify → bind → commit.
+        // true-unbound → 无录 (no volume). Verification failure throws (失败诚实).
+        // Cannot-identify must arrive as status=escalate above — never as silent unbound.
+        if (assertion.kind === "true-unbound") {
+          if (submitted === undefined || !("sitian" in submitted)) {
+            return { ...(submitted ?? { receipt: parameters }), ticketNumber: null };
+          }
+          const stripped: Record<string, unknown> = {
+            ...submitted,
+            ticketNumber: null,
+          };
+          delete stripped.sitian;
+          return stripped;
+        }
+
+        await verifyAssertedTicketNumber({
+          ticketNumber: assertion.ticketNumber,
+          instruction: catalog.instruction,
+          projectRoot: catalog.projectRoot,
+        });
+        await bindTicketNumberOnRunDirectory(
+          catalog.runDirectory,
+          assertion.ticketNumber,
+        );
+        const boundCatalog: DiaristSourceCatalog = {
+          ...catalog,
+          ticketNumber: assertion.ticketNumber,
+        };
         const facts = await commitDiaristSelections({
-          catalog,
+          catalog: boundCatalog,
           selections: projectDiaristSelections(parameters),
         });
-        return { ...(submitted ?? { receipt: parameters }), sitian: facts };
+        return {
+          ...(submitted ?? { receipt: parameters }),
+          ticketNumber: assertion.ticketNumber,
+          sitian: facts,
+        };
       },
     },
     dependencies,