@akagilnc/pi-workflow-roles 0.1.3826 → 0.1.3873

package/dist/reviewer-agent.js

@@ -76,6 +76,7 @@ export function createReviewerAgentRunner(dependencies = {}) {
                         ...(dependencies.packageRoot === undefined
                             ? {}
                             : { packageRoot: dependencies.packageRoot }),
+                        ...(options.getFlag === undefined ? {} : { getFlag: options.getFlag }),
                     });
                     const disposition = await workspaceOwner.dispose(workspace);
                     return [leg.axis, Object.freeze({ status: "successful", report: child.report, usage: child.usage, target: batch.target, prompt: child.prompt, workspaceDisposition: disposition })];

package/dist/reviewer-child-executor.js

@@ -1,5 +1,5 @@
 import { createEngineDetourToolDefinition } from "./engine-detour-tool.js";
-import { engineNameFromEnv } from "./engine-detour.js";
+import { resolveEngineName } from "./engine-detour.js";
 import { appendEngineSessionMaterial, engineSessionMaterialFromOptions, } from "./package-resources/engine-material.js";
 import { readPackageMaterial } from "./session-opening-materials.js";
 import { hasUpstreamErrorTestimony, isNonSuccessHttpStatus } from "./upstream-error-testimony.js";
@@ -98,7 +98,8 @@ export async function executeReviewerChild(workspace, leg, context, options = {}
         const selection = await parentSelection(context);
         const { openPiInProcessSession } = await import("./pi/in-process-session.js");
         const { createRecordSession } = await import("./archivist-record-entry.js");
-        const engineName = engineNameFromEnv();
+        // One gate with parent registration (#818): request flag, else pi child env.
+        const engineName = resolveEngineName(options.getFlag);
         const engineMaterial = engineName === undefined
             ? undefined
             : options.packageRoot === undefined || options.packageRoot.trim() === ""

package/dist/role-activation-flags.js

@@ -0,0 +1,50 @@
+import { packagedRoleInputFlag, packagedRolePhaseFlag } from "./packaged-role-registry.js";
+/** Project closed RoleTurnActivation onto the shared host flag map. */
+export function projectActivationFlags(request) {
+    const activation = request.activation;
+    const flags = new Map([["ak-role", activation.role]]);
+    const inputFlag = packagedRoleInputFlag(activation.role);
+    const phaseFlag = packagedRolePhaseFlag(activation.role);
+    if ("phase" in activation && phaseFlag !== undefined)
+        flags.set(phaseFlag, activation.phase);
+    if (inputFlag !== undefined) {
+        const path = "taskPath" in activation ? activation.taskPath
+            : "packetPath" in activation ? activation.packetPath
+                : "casePath" in activation ? activation.casePath
+                    : "inputPath" in activation ? activation.inputPath
+                        : "sourceRun" in activation ? activation.sourceRun
+                            : undefined;
+        if (path !== undefined)
+            flags.set(inputFlag, path);
+    }
+    if (activation.role === "fixer" && activation.prerequisitesPath !== undefined) {
+        flags.set("ak-fixer-prerequisites", activation.prerequisitesPath);
+    }
+    if (activation.role === "reviewer") {
+        flags.set("ak-review-base", activation.baseRevision);
+        flags.set("ak-review-authority-refs", JSON.stringify(activation.authorityRefs));
+        if (activation.ticketNumber !== undefined) {
+            flags.set("ak-review-ticket-number", String(activation.ticketNumber));
+        }
+    }
+    // countersign ticketNumber stays on activation/admission/invocation only —
+    // no private transport flag (inner-gate material path deleted in #632).
+    if (activation.role === "notary" && activation.ticketNumber !== undefined) {
+        flags.set("ak-notary-ticket-number", String(activation.ticketNumber));
+    }
+    if (activation.role === "gleaner-left") {
+        flags.set("ak-gleaner-left-base", activation.baseRevision);
+    }
+    if (activation.role === "collector") {
+        flags.set("ak-collector-repo", activation.repo);
+        // #676 D1: pr optional at admission; omit flag when role binds from materials.
+        if (activation.pr !== undefined)
+            flags.set("ak-collector-pr", activation.pr);
+        if (activation.requestManifestPath !== undefined) {
+            flags.set("ak-collector-request-manifest", activation.requestManifestPath);
+        }
+        if (activation.waitMs !== undefined)
+            flags.set("ak-collector-wait-ms", activation.waitMs);
+    }
+    return flags;
+}

package/dist/role-runtime.js

@@ -748,17 +748,14 @@ export function createRoleRuntimeExtension(dependencies) {
             const role = roleHost.getFlag(ROLE_FLAG.name);
             if (role !== undefined && !admitted)
                 return { action: "handled" };
-            // Envelope exclusively owns Reviewer Skill invocation transform + original-request capture.
+            // Reviewer: recover original request; Pi argv may already carry native form.
             if (role === "reviewer"
                 && admitted
                 && activeReviewerParent !== undefined
                 && reviewerOriginalRequest === undefined) {
-                reviewerOriginalRequest = event.text;
-                return {
-                    action: "transform",
-                    text: activeReviewerParent.skillBinding.invocation(event.text),
-                    ...(event.images === undefined ? {} : { images: event.images }),
-                };
+                reviewerOriginalRequest =
+                    roleHost.capabilities?.skillOriginalRequest?.(activeReviewerParent.skillBinding.name, event.text) ?? event.text;
+                return { action: "continue" };
             }
             return { action: "continue" };
         });
@@ -1093,7 +1090,12 @@ export function createRoleRuntimeExtension(dependencies) {
             async runDispatch(dispatch, options) {
                 if (dependencies.runReviewerDispatch === undefined)
                     throw new Error("Reviewer runtime dependencies are not configured");
-                return dependencies.runReviewerDispatch(dispatch, options);
+                // #818: request-scoped engine flag reaches axis sub-session via same RoleHost
+                // that parent registerEngineDetourTool reads — never ambient process.env.
+                return dependencies.runReviewerDispatch(dispatch, {
+                    ...options,
+                    getFlag: (name) => roleHost.getFlag(name),
+                });
             },
             ...(dependencies.shutdownReviewerAgent === undefined
                 ? {}
@@ -1570,8 +1572,8 @@ export function createRoleRuntimeExtension(dependencies) {
                     }
                 }
                 await executeActivationStage(entry.role, activationStage(entry.role, runtime), { clock, writeTrace });
-                // #357 T2 / #378 / #380 / #391: any role+engine activation registers the package detour tool once.
-                // Gate is env presence only — no per-engine execute branch; no role-module spawn.
+                // #357 T2 / #378 / #380 / #391 / #818: any role+engine activation registers the package detour tool once.
+                // Gate is resolveEngineName (RoleHost flag → env fallback) — no per-engine execute branch; no role-module spawn.
                 if (!engineDetourRegistered) {
                     engineDetourRegistered = registerEngineDetourTool(roleHost, hostActions);
                 }

package/dist/worker-role.js

@@ -227,6 +227,12 @@ export function createCoderRoleRuntime(pi, dependencies, hostActions) {
     });
     return {
         async activate(ctx) {
+            // Each activation owns its own Skill capture state; prior-session flags must
+            // not authorize a later apply completed (same RoleHost, sequential activate).
+            tddInvocationInjected = false;
+            originalRequest = undefined;
+            expansionPending = false;
+            expansionCaptured = false;
             soul = (await dependencies.loadSoul()).trim();
             if (soul.length === 0)
                 throw new Error("Coder soul is empty");
@@ -303,18 +309,14 @@ export function createCoderRoleRuntime(pi, dependencies, hostActions) {
                     }
                     tddInvocationInjected = true;
                     expansionPending = true;
-                    const isNativeTdd = event.text === "/skill:tdd" ||
-                        event.text.startsWith("/skill:tdd ");
-                    if (isNativeTdd) {
-                        originalRequest = event.text.slice("/skill:tdd".length).trim();
-                        return { action: "continue" };
-                    }
-                    originalRequest = event.text.trim();
-                    return {
-                        action: "transform",
-                        text: binding?.invocation(event.text) ?? `/skill:tdd ${event.text}`,
-                        ...(event.images === undefined ? {} : { images: event.images }),
-                    };
+                    // Original request via host capability when Pi argv already carries native form;
+                    // non-pi keeps plain original bytes (no consumer trim; #822 r3 / reviewer-aligned).
+                    // Role never emits or parses `/skill:` (ADR 0082).
+                    originalRequest = binding === undefined
+                        ? event.text
+                        : (pi.capabilities?.skillOriginalRequest?.(binding.name, event.text)
+                            ?? event.text);
+                    return { action: "continue" };
                 });
                 pi.on("before_agent_start", (event, ctx) => {
                     if (soul === undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.3826",
+  "version": "0.1.3873",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/scripts/build-package.mjs

@@ -109,7 +109,7 @@ export async function buildAcpProductionHost(
   });
   // role-envelope resolves ./mcp-relay.mjs from import.meta.url — keep it beside the bundle.
   await copyFile(
-    resolve("src/acp-host/mcp-relay.mjs"),
+    resolve("src/mcp-relay.mjs"),
     join(dirname(outfile), "mcp-relay.mjs"),
   );
 }
@@ -136,7 +136,7 @@ export async function buildHeadlessProductionHost(
   // Shared envelope resolves ./mcp-relay.mjs from import.meta.url of the bundle
   // (#645 headless reuses the ACP relay for AK tools under --mcp-config).
   await copyFile(
-    resolve("src/acp-host/mcp-relay.mjs"),
+    resolve("src/mcp-relay.mjs"),
     join(dirname(outfile), "mcp-relay.mjs"),
   );
 }

package/src/acp-host/production-host.ts

@@ -6,108 +6,44 @@
  * factory does not create a run-scoped agent home, does not rewrite HOME, and
  * does not copy or scrub credentials. Sitian records on the run are the dossier.
  */
-import { readFile } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
+import { randomUUID } from "node:crypto";
 
-import { loadCanonicalSkillBinding as loadHomeCanonicalSkillBinding } from "../canonical-skill-binding.ts";
-import { createGhCollectorGitHubTransport, createGhIssueSoftFetcher } from "../collector-github.ts";
-import { createPiDoctorAuditor } from "../doctor-auditor.ts";
-import { loadDoctorCase } from "../doctor-evidence.ts";
-import type { DurablePrincipalAuthority, RoleTurnHost } from "../host-contracts.ts";
-import { createProductionMergerGitState } from "../merger-git-state.ts";
-import { createNativeNavigatorSessionFactory, createNavigatorAttendance } from "../navigator-attendance.ts";
-import { loadNavigatorWorkContext } from "../navigator-work-context.ts";
-import { loadNotarySourceRunLocator } from "../notary-source-run.ts";
-import { loadPackagedCanonicalSkillBinding } from "../package-resources/method-skill-binding.ts";
-import { createPerDispatchReviewerAgent } from "../reviewer-agent.ts";
-import { formatNavigatorRoleHelp, type RoleRuntimeDependencies } from "../role-runtime.ts";
-import { createReviewerPinnedGitReader } from "../reviewer-pinned-git.ts";
-import { loadAuditorSoulFromSubjectInput } from "../auditor-soul.ts";
-import { loadGatekeeperSessionMaterials, loadMainRoleSessionMaterials } from "../session-opening-materials.ts";
+import type { DurablePrincipalAuthority, RoleTurnHost, RoleTurnRequest } from "../host-contracts.ts";
+import { prepareRoleEnvelope } from "../role-envelope.ts";
+import type { RoleRuntimeDependencies } from "../role-runtime.ts";
+import { createRoleRuntimeDependencies } from "../role-runtime-dependencies.ts";
+import { createSessionIdentityAuthority } from "../session-identity.ts";
 import { acpStdioArgs, resolveAcpBinary, type AcpHostDescription } from "./description.ts";
-import { createComposedAcpRoleTurnHost } from "./role-envelope.ts";
-import { connectAcpStdio } from "./role-turn-host.ts";
+import {
+  connectAcpStdio,
+  createAcpRoleTurnHost,
+  type AcpRoleTurnHostConfig,
+} from "./role-turn-host.ts";
 import { ensureSeatProfileSoul } from "./seat-profile-soul.ts";
-import { createAcpSessionIdentityAuthority } from "./session-identity.ts";
 
 export type ProductionAcpHostOptions = Readonly<{
   packageRoot: string;
   principalAuthority: DurablePrincipalAuthority;
   description: AcpHostDescription;
+  /** Seat-table host key (e.g. grok-build). */
+  hostName: string;
 }>;
 
-const navigatorRoutePlaybookPath = fileURLToPath(
-  new URL("../../resources/navigator-route-playbook.md", import.meta.url),
-);
-const collectorHandbookSeedPath = fileURLToPath(
-  new URL("../../resources/collector-bot-handbook.md", import.meta.url),
-);
-
-/** Host-neutral packaged role runtime deps for the ACP parent-process envelope. */
-export function createAcpRoleRuntimeDependencies(packageRoot: string): RoleRuntimeDependencies {
-  const doctorAuditor = createPiDoctorAuditor();
-  const reviewerAgent = createPerDispatchReviewerAgent({ packageRoot });
-  const navigatorSessionFactory = createNativeNavigatorSessionFactory();
-  return {
-    loadJudgeSoul: () => loadMainRoleSessionMaterials("judge"),
-    loadFixerSoul: () => loadMainRoleSessionMaterials("fixer"),
-    loadFixPacket: (path) => readFile(path, "utf8"),
-    loadCoderSoul: () => loadMainRoleSessionMaterials("coder"),
-    loadCoderTask: (path) => readFile(path, "utf8"),
-    loadReviewerSoul: () => loadMainRoleSessionMaterials("reviewer"),
-    createReviewerPinnedGitReader: () => createReviewerPinnedGitReader(),
-    createReviewerIssueFetcher: () => createGhIssueSoftFetcher(),
-    loadCollectorSoul: () => loadMainRoleSessionMaterials("collector"),
-    loadCollectorHandbookSeed: () => readFile(collectorHandbookSeedPath, "utf8"),
-    createCollectorTransport: () => createGhCollectorGitHubTransport(),
-    loadDoctorSoul: () => loadMainRoleSessionMaterials("doctor"),
-    loadDoctorCase,
-    loadInspectorSoul: () => loadMainRoleSessionMaterials("inspector"),
-    loadGatekeeperSoul: () => loadGatekeeperSessionMaterials("gatekeeper"),
-    loadNavigatorSoul: () => loadMainRoleSessionMaterials("navigator"),
-    loadAuditorSoul: () => loadAuditorSoulFromSubjectInput(),
-    loadNotarySoul: () => loadMainRoleSessionMaterials("notary"),
-    loadCountersignSoul: () => loadMainRoleSessionMaterials("countersign"),
-    loadGleanerLeftSoul: () => loadMainRoleSessionMaterials("gleaner-left"),
-    loadDiaristSoul: () => loadMainRoleSessionMaterials("diarist"),
-    loadNotarySourceRun: loadNotarySourceRunLocator,
-    loadMergerSoul: () => loadMainRoleSessionMaterials("merger"),
-    loadMergerInput: async (path) => JSON.parse(await readFile(path, "utf8")),
-    createMergerGitState: (repositoryRoot) => createProductionMergerGitState(repositoryRoot),
-    async loadCanonicalSkillBinding(name) {
-      if (name === "tdd") {
-        return loadPackagedCanonicalSkillBinding(packageRoot, "tdd");
-      }
-      if (name === "code-review") {
-        return loadPackagedCanonicalSkillBinding(packageRoot, "code-review");
-      }
-      return loadHomeCanonicalSkillBinding(name);
-    },
-    // #590: doctor compliance still on disposeCompliance path; judge→auditor is gate queue (#756).
-    auditDoctorCompliance: (options) => doctorAuditor(options),
-    runReviewerDispatch: (dispatch, options) => reviewerAgent.run(dispatch, options),
-    shutdownReviewerAgent: () => reviewerAgent.shutdown(),
-    loadNavigatorWorkContext: (options) => loadNavigatorWorkContext({
-      context: options.context,
-      role: options.role,
-      ...(options.getFlag === undefined ? {} : { getFlag: options.getFlag }),
-    }),
-    createNavigatorAttendance: (options) => createNavigatorAttendance({
-      context: options.context,
-      role: options.role,
-      phase: options.phase,
-      subjectKey: options.subjectKey,
-      subject: options.subject,
-      authority: options.authority,
-      invocationId: options.invocationId,
-      loadSoul: () => loadMainRoleSessionMaterials("navigator"),
-      loadRoutePlaybook: () => readFile(navigatorRoutePlaybookPath, "utf8"),
-      loadRoleHelp: async (role) => formatNavigatorRoleHelp(role),
-      createSession: navigatorSessionFactory,
-      ...(options.contextError === undefined ? {} : { contextError: options.contextError }),
-      onEvent: options.onEvent,
+function createComposedAcpRoleTurnHost(
+  config: Omit<AcpRoleTurnHostConfig, "prepare"> & {
+    readonly roleRuntimeDependencies: RoleRuntimeDependencies;
+    readonly socketPath?: (request: RoleTurnRequest) => string;
+  },
+) {
+  return createAcpRoleTurnHost({
+    ...config,
+    prepare: (request) => prepareRoleEnvelope({
+      request,
+      dependencies: config.roleRuntimeDependencies,
+      sessionFile: config.sessionIdentity.resolveSessionFile(request.principal),
+      socketPath: config.socketPath?.(request) ?? `/tmp/ak-acp-mcp-${randomUUID()}.sock`,
     }),
-  };
+  });
 }
 
 /**
@@ -116,7 +52,7 @@ export function createAcpRoleRuntimeDependencies(packageRoot: string): RoleRunti
  * is sitian-only.
  */
 export function createProductionAcpRoleTurnHost(options: ProductionAcpHostOptions): RoleTurnHost {
-  const { packageRoot, principalAuthority, description } = options;
+  const { packageRoot, principalAuthority, description, hostName } = options;
   const env: NodeJS.ProcessEnv = {
     ...process.env,
     ...description.childEnv,
@@ -124,10 +60,11 @@ export function createProductionAcpRoleTurnHost(options: ProductionAcpHostOption
   };
 
   return createComposedAcpRoleTurnHost({
-    sessionIdentity: createAcpSessionIdentityAuthority(principalAuthority, description.sessionBindingFile),
+    hostName,
+    sessionIdentity: createSessionIdentityAuthority(principalAuthority, description.sessionBindingFile),
     boundResume: description.boundResume,
     modelPassing: description.modelPassing,
-    roleRuntimeDependencies: createAcpRoleRuntimeDependencies(packageRoot),
+    roleRuntimeDependencies: createRoleRuntimeDependencies(packageRoot),
     async connect(request) {
       const seatProfile = description.seatProfileSoul;
       const profileName = seatProfile === undefined