@akagilnc/pi-workflow-roles 0.1.3771 → 0.1.3783

package/src/public-role-summons.ts

@@ -65,6 +65,12 @@ export type PublicSummonRequest = {
    * Never folded into argv / parent-run lookup keys (ADR 0079 卷宗指针 stays pure).
    */
   readonly gateReviewInstruction?: string;
+  /**
+   * Parent-invocation host axis (#617 / #645). Nested institutional legs inherit
+   * the live parent `--host` so a single public entry does not require mutating
+   * persistent seat host. Seat model/thinking stay on the officer seat table.
+   */
+  readonly host?: string;
   /**
    * Offline test inject — same face as public CLI env.roleTurnHost. Production
    * summons leave this unset and use the seat-resolved host.
@@ -211,14 +217,13 @@ async function createSummonEnv(options: {
   const hostName = options.seat.host ?? "pi";
   let roleTurnHost = piHost;
   if (hostName !== "pi") {
-    const { lookupHostDescription } = await import("./host-descriptions.ts");
-    const { loadProductionAcpHostFactory } = await import(
-      "./public-cli/load-production-acp-host.ts"
+    const { lookupHostFamily } = await import("./host-descriptions.ts");
+    const { loadProductionExternalHostFactory } = await import(
+      "./public-cli/load-production-external-host.ts"
     );
-    // #729: the description table is the sole host authority — every registered
-    // key loads the same generic ACP factory (no per-host fork). Unregistered
-    // keys fail closed before any turn (#510), as the pre-merge fork did.
-    if (lookupHostDescription(hostName) === undefined) {
+    // #729 / #645: description tables are the sole host authority — family
+    // dispatch (ACP vs headless) is data-driven. Unregistered keys fail closed.
+    if (lookupHostFamily(hostName) === undefined) {
       throw new Error(
         `public role summons host unregistered: host=${hostName} seat=${options.role}`,
       );
@@ -226,7 +231,7 @@ async function createSummonEnv(options: {
     let hostPromise: Promise<RoleTurnHost> | undefined;
     roleTurnHost = {
       executeTurn: async (request) => {
-        hostPromise ??= loadProductionAcpHostFactory(options.packageRoot, hostName).then(
+        hostPromise ??= loadProductionExternalHostFactory(options.packageRoot, hostName).then(
           (create) =>
             create({
               packageRoot: options.packageRoot,
@@ -286,7 +291,10 @@ export async function summonPublicRole(
   const credentials =
     options.credentials ?? (await loadCredentialProviders(agentDir));
   const config = await loadPublicCliConfig(home);
-  const seat = resolveEffectiveSeat(config, options.role, credentials);
+  // Nested legs inherit parent invocation host when provided (#645 review path).
+  // Model/thinking stay on the officer seat — host-only inherit (seat-table law).
+  const invocation = options.host === undefined ? undefined : { host: options.host };
+  const seat = resolveEffectiveSeat(config, options.role, credentials, invocation);
   const env = {
     ...(await createSummonEnv({
       role: options.role,
@@ -412,6 +420,47 @@ export async function summonPublicRole(
 }
 
 /** Gate officer summons: notary/auditor via --source-run; inspector via pointer instruction. */
+/**
+ * Read parent invocation host so nested officers inherit live --host only (#645).
+ * Gate source runs necessarily own invocation.json — missing page, bad JSON, or
+ * bad shape stay loud (failure-honesty). Absent host field is lawful (seat default).
+ */
+async function parentInvocationHost(sourceRunDirectory: string): Promise<string | undefined> {
+  const { readFile } = await import("node:fs/promises");
+  const path = join(sourceRunDirectory, "invocation.json");
+  let text: string;
+  try {
+    text = await readFile(path, "utf8");
+  } catch (error) {
+    const code =
+      error instanceof Error && "code" in error
+        ? (error as NodeJS.ErrnoException).code
+        : undefined;
+    throw new Error(
+      `parent invocation.json required for gate source run at ${path}: ${code ?? (error instanceof Error ? error.message : String(error))}`,
+      { cause: error },
+    );
+  }
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text) as unknown;
+  } catch (error) {
+    throw new Error(
+      `parent invocation.json unreadable at ${path}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    );
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error(`parent invocation.json has non-object shape at ${path}`);
+  }
+  const host = (raw as Record<string, unknown>).host;
+  if (host === undefined) return undefined;
+  if (typeof host !== "string" || host.trim() === "") {
+    throw new Error(`parent invocation.json host must be a non-empty string at ${path}`);
+  }
+  return host;
+}
+
 export async function summonGateOfficer(options: {
   readonly officer: "inspector" | "notary" | "auditor";
   readonly sourceRunDirectory: string;
@@ -452,6 +501,9 @@ export async function summonGateOfficer(options: {
       submission: options.submission,
     });
   }
+  // Inherit parent live --host only so review roundtrip stays on one host without
+  // mutating persistent seat tables (#645). Officer model/thinking stay seat-owned.
+  const parentHost = await parentInvocationHost(options.sourceRunDirectory);
   const common = {
     cwd: options.cwd,
     ...(home === undefined ? {} : { home }),
@@ -462,6 +514,7 @@ export async function summonGateOfficer(options: {
     ...(gateReviewInstruction === undefined
       ? {}
       : { gateReviewInstruction }),
+    ...(parentHost === undefined ? {} : { host: parentHost }),
     ...(options.roleTurnHost === undefined ? {} : { roleTurnHost: options.roleTurnHost }),
     ...(options.createRunId === undefined ? {} : { createRunId: options.createRunId }),
   } as const;