@akagilnc/pi-workflow-roles 0.1.3902 → 0.1.3932

package/dist/public-cli/role-turn-host-resolution.js

@@ -0,0 +1,59 @@
+import { packagedExternalHostNames } from "../host-descriptions.js";
+import { createPiRoleTurnHost } from "../pi/role-turn-host.js";
+import { observeLaunchedRolePackageIdentity, recordLaunchedPiIdentity, recordLaunchedRolePackageIdentity, } from "./invocation.js";
+import { createLazyProductionExternalHost } from "./load-production-external-host.js";
+export function formatHostSelectionFailure(failure) {
+    return `${failure.kind}: ${failure.host}; seat=${failure.seat}; model=${failure.model}; registered: ${failure.registeredHosts.join(", ")}`;
+}
+export class HostSelectionError extends Error {
+    failure;
+    constructor(failure) {
+        super(formatHostSelectionFailure(failure));
+        this.failure = failure;
+        this.name = "HostSelectionError";
+    }
+}
+export function composeRoleTurnHostAdapters(env, principalAuthority) {
+    const piHost = env.roleTurnHost ?? createPiRoleTurnHost({
+        packageRoot: env.packageRoot,
+        principalAuthority,
+        ...(env.extraPiArgs === undefined ? {} : { extraPiArgs: env.extraPiArgs }),
+        ...(env.timeoutMs === undefined ? {} : { timeoutMs: env.timeoutMs }),
+        recordLaunchedPiIdentity,
+        recordLaunchedRolePackageIdentity,
+        observeLaunchedRolePackageIdentity,
+    });
+    return env.hostAdapters ?? [
+        { name: "pi", create: () => ({ ok: true, host: piHost }) },
+        ...packagedExternalHostNames().map((name) => ({
+            name,
+            create: () => ({
+                ok: true,
+                host: createLazyProductionExternalHost({
+                    packageRoot: env.packageRoot,
+                    hostName: name,
+                    principalAuthority,
+                }),
+            }),
+        })),
+    ];
+}
+export function selectRoleTurnHost(adapters, options) {
+    const hostName = options.seat.host;
+    const adapter = adapters.find((candidate) => candidate.name === hostName);
+    const model = options.seat.selection === undefined
+        ? "unconfigured"
+        : `${options.seat.selection.provider}/${options.seat.selection.model}`;
+    const registeredHosts = adapters.map(({ name }) => name);
+    if (adapter === undefined) {
+        throw new HostSelectionError({ kind: "host-unregistered", host: hostName, seat: options.role, model, registeredHosts });
+    }
+    const selected = adapter.create({ role: options.role, model: options.seat.selection });
+    if (!selected.ok) {
+        throw new HostSelectionError({ kind: "host-model-mismatch", host: hostName, seat: options.role, model, registeredHosts });
+    }
+    return selected.host;
+}
+export function resolveRoleTurnHost(env, options) {
+    return selectRoleTurnHost(composeRoleTurnHostAdapters(env, options.principalAuthority), { role: options.role, seat: options.seat });
+}

package/dist/public-cli/run-lifecycle.js

@@ -335,19 +335,21 @@ export async function markRunAdmitted(admitted, authority) {
     });
 }
 /**
- * Shared dispatch execution seam: record the effective launch model (initial or
- * resume override) and the authoritative seat engine/host onto invocation.json,
- * then transition to running.
+ * Shared dispatch execution seam: transition to running, then record the
+ * effective launch model (initial or resume override) and the authoritative
+ * seat engine/host onto invocation.json.
  * Role runners must not coordinate lifecycle ledger writes themselves.
  * Engine axis is authoritative here (#617): present string is written; omit/undefined
  * clears any prior engine key so unset-engine + resume does not keep a stale value.
  * (Non-authoritative partial updates still use recordEffectiveInvocationModel directly
  * with `engine: undefined` to preserve.)
+ * Host-page write is deliberately the last step (#840 r9 判词 class 2): this
+ * function is not atomic, and a caller retrying after it throws must not see
+ * the new host already committed while the run-state transition itself never
+ * completed — the run-state write happens first, so any failure past that
+ * point still leaves the prior invocation host in place for the retry.
  */
 export async function markRunRunning(runDirectory, effectiveModel, effectiveEngine, effectiveHost) {
-    await recordEffectiveInvocationModel(runDirectory, effectiveModel, 
-    // Authoritative seat projection: absent engine ⇒ null (delete).
-    effectiveEngine === undefined ? null : effectiveEngine, effectiveHost);
     const current = await readRoleRunStateDisk(runDirectory);
     if (current === undefined) {
         throw new Error("cannot mark running: run state missing");
@@ -366,6 +368,9 @@ export async function markRunRunning(runDirectory, effectiveModel, effectiveEngi
         ...(current.phase === undefined ? {} : { phase: current.phase }),
         ...(current.currentCourt === undefined ? {} : { currentCourt: current.currentCourt }),
     });
+    await recordEffectiveInvocationModel(runDirectory, effectiveModel, 
+    // Authoritative seat projection: absent engine ⇒ null (delete).
+    effectiveEngine === undefined ? null : effectiveEngine, effectiveHost);
 }
 /** @deprecated #416: 429-only resumable marker; kept for historical runs. */
 export async function markRunResumable(runDirectory, observation) {

package/dist/public-cli/turn-request.js

@@ -24,5 +24,6 @@ export function projectRoleTurnRequest(admitted, roleDetails, options) {
         ...(options.courtAttemptId === undefined || options.courtAttemptId.length === 0
             ? {}
             : { courtAttemptId: options.courtAttemptId }),
+        ...(options.stationChild === undefined ? {} : { stationChild: options.stationChild }),
     };
 }

package/dist/public-role-summons.js

@@ -70,48 +70,29 @@ function projectSeatEngine(seat) {
 function projectSeatHost(seat) {
   return seat.host === void 0 ? {} : { host: seat.host };
 }
+function hostSelectionFailureFromUnknown(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  if (error.name !== "HostSelectionError") return void 0;
+  const failure = error.failure;
+  return failure;
+}
 async function createSummonEnv(options) {
-  const [{ piDurablePrincipalAuthority }, { appendPiSessionCustomEntry, createPiRoleTurnHost }] = await Promise.all([
+  const [{ piDurablePrincipalAuthority }, { appendPiSessionCustomEntry }, { resolveRoleTurnHost }] = await Promise.all([
     import("./pi/durable-principal.js"),
-    import("./pi/role-turn-host.js")
+    import("./pi/role-turn-host.js"),
+    import("./public-cli/role-turn-host-resolution.js")
   ]);
   const principalAuthority = piDurablePrincipalAuthority;
-  const piRecords = {
-    async recordLaunchedPiIdentity(runDirectory, identity) {
-      const { recordLaunchedPiIdentity } = await import("./public-cli/invocation.js");
-      return recordLaunchedPiIdentity(runDirectory, identity);
-    },
-    async recordLaunchedRolePackageIdentity(runDirectory, identity) {
-      const { recordLaunchedRolePackageIdentity } = await import("./public-cli/invocation.js");
-      return recordLaunchedRolePackageIdentity(runDirectory, identity);
+  const roleTurnHost = resolveRoleTurnHost(
+    {
+      packageRoot: options.packageRoot,
+      ...options.roleTurnHost === void 0 ? {} : { roleTurnHost: options.roleTurnHost },
+      ...options.hostAdapters === void 0 ? {} : { hostAdapters: options.hostAdapters },
+      ...options.extraPiArgs === void 0 || options.extraPiArgs.length === 0 ? {} : { extraPiArgs: options.extraPiArgs }
     },
-    async observeLaunchedRolePackageIdentity(root, roleEntry) {
-      const { observeLaunchedRolePackageIdentity } = await import("./public-cli/invocation.js");
-      return observeLaunchedRolePackageIdentity(root, roleEntry);
-    }
-  };
-  const piHost = createPiRoleTurnHost({
-    packageRoot: options.packageRoot,
-    principalAuthority,
-    ...options.extraPiArgs === void 0 || options.extraPiArgs.length === 0 ? {} : { extraPiArgs: options.extraPiArgs },
-    ...piRecords
-  });
+    { role: options.role, seat: options.seat, principalAuthority }
+  );
   const hostName = options.seat.host ?? "pi";
-  let roleTurnHost = piHost;
-  if (hostName !== "pi") {
-    const { lookupHostFamily } = await import("./host-descriptions.js");
-    const { createLazyProductionExternalHost } = await import("./public-cli/load-production-external-host.js");
-    if (lookupHostFamily(hostName) === void 0) {
-      throw new Error(
-        `public role summons host unregistered: host=${hostName} seat=${options.role}`
-      );
-    }
-    roleTurnHost = createLazyProductionExternalHost({
-      packageRoot: options.packageRoot,
-      hostName,
-      principalAuthority
-    });
-  }
   const { loadHostProvidersTable, projectHostFacingProvider } = await import("./public-cli/host-providers.js");
   const hostFacingSelection = options.seat.selection === void 0 ? void 0 : projectHostFacingProvider(
     options.seat.selection,
@@ -145,8 +126,9 @@ async function summonPublicRole(options) {
   const credentials = options.credentials ?? await loadCredentialProviders(agentDir);
   const config = await loadPublicCliConfig(home);
   const seat = resolveEffectiveSeat(config, options.role, credentials);
-  const env = {
-    ...await createSummonEnv({
+  let summonEnv;
+  try {
+    summonEnv = await createSummonEnv({
       role: options.role,
       home,
       agentDir,
@@ -154,8 +136,22 @@ async function summonPublicRole(options) {
       packageRoot,
       credentials,
       seat,
-      ...options.extraPiArgs === void 0 ? {} : { extraPiArgs: options.extraPiArgs }
-    }),
+      ...options.extraPiArgs === void 0 ? {} : { extraPiArgs: options.extraPiArgs },
+      ...options.roleTurnHost === void 0 ? {} : { roleTurnHost: options.roleTurnHost },
+      ...options.hostAdapters === void 0 ? {} : { hostAdapters: options.hostAdapters }
+    });
+  } catch (error) {
+    const failure = hostSelectionFailureFromUnknown(error);
+    if (failure !== void 0) {
+      const { formatHostSelectionFailure } = await import("./public-cli/role-turn-host-resolution.js");
+      return { exitCode: 1, stderr: formatHostSelectionFailure(failure) };
+    }
+    throw error;
+  }
+  const env = {
+    ...summonEnv,
+    // Station child role run (#840): omit automatic navigator attendance.
+    stationChild: true,
     // Host config passthrough only — same face as public CLI (#422 / #675).
     ...config.autoResumeLimit === void 0 ? {} : { autoResumeLimit: config.autoResumeLimit },
     // Parent cancellation reaches the nested activation's own turn dispatch.
@@ -164,8 +160,8 @@ async function summonPublicRole(options) {
     ...options.reviewReask === void 0 ? {} : { reviewReask: options.reviewReask },
     // #786: verbatim submission body on same-parent resume (not conclusion re-ask).
     ...options.gateReviewInstruction === void 0 ? {} : { gateReviewInstruction: options.gateReviewInstruction },
-    // Offline test injects — same faces as public CLI env (production leaves unset).
-    ...options.roleTurnHost === void 0 ? {} : { roleTurnHost: options.roleTurnHost },
+    ...options.boundTicketNumber === void 0 ? {} : { boundTicketNumber: options.boundTicketNumber },
+    // createRunId is the only remaining env overlay — host is seat-selected above.
     ...options.createRunId === void 0 ? {} : { createRunId: options.createRunId }
   };
   const captured = options.io === void 0 ? createCapturingIo() : void 0;
@@ -246,12 +242,21 @@ async function summonPublicRole(options) {
       result = await runPublicDoctor(options.argv, env, io, parseDoctorArgv);
       break;
     }
+    case "diarist": {
+      const [{ runPublicDiarist }, { parseDiaristArgv }] = await Promise.all([
+        import("./public-cli/diarist-run.js"),
+        import("./public-cli/invocation.js")
+      ]);
+      result = await runPublicDiarist(options.argv, env, io, parseDiaristArgv);
+      break;
+    }
   }
   const stderr = captured?.stderrText();
   const runDirectory = result.admitted?.runDirectory;
   return {
     exitCode: result.exitCode,
     ...result.terminal === void 0 ? {} : { terminal: result.terminal },
+    ...result.admitted === void 0 ? {} : { admitted: result.admitted },
     ...typeof runDirectory === "string" && runDirectory.trim() !== "" ? { runDirectory } : {},
     ...stderr === void 0 || stderr === "" ? {} : { stderr }
   };
@@ -278,6 +283,7 @@ async function summonGateOfficer(options) {
     ...options.reask === void 0 ? {} : { reviewReask: options.reask },
     ...gateReviewInstruction === void 0 ? {} : { gateReviewInstruction },
     ...options.roleTurnHost === void 0 ? {} : { roleTurnHost: options.roleTurnHost },
+    ...options.hostAdapters === void 0 ? {} : { hostAdapters: options.hostAdapters },
     ...options.createRunId === void 0 ? {} : { createRunId: options.createRunId }
   };
   if (options.officer === "notary") {

package/dist/role-activation-flags.js

@@ -3,6 +3,9 @@ import { packagedRoleInputFlag, packagedRolePhaseFlag } from "./packaged-role-re
 export function projectActivationFlags(request) {
     const activation = request.activation;
     const flags = new Map([["ak-role", activation.role]]);
+    if (request.stationChild === true) {
+        flags.set("ak-station-child", true);
+    }
     const inputFlag = packagedRoleInputFlag(activation.role);
     const phaseFlag = packagedRolePhaseFlag(activation.role);
     if ("phase" in activation && phaseFlag !== undefined)

package/dist/role-runtime.js

@@ -91,6 +91,13 @@ const GLEANER_LEFT_TRANSPORT_FLAGS = Object.freeze([
         definition: GLEANER_LEFT_BASE_FLAG.definition,
     }),
 ]);
+export const STATION_CHILD_FLAG = Object.freeze({
+    name: "ak-station-child",
+    definition: Object.freeze({
+        description: "Station-child role run (omit automatic navigator attendance; #840)",
+        type: "boolean",
+    }),
+});
 /**
  * Decode private transport flags into frozen admitted inputs.
  * Envelope-owned; necessary JSON decode only (public --authority-ref owns grammar).
@@ -674,6 +681,8 @@ export function createRoleRuntimeExtension(dependencies) {
         for (const flag of COLLECTOR_TRANSPORT_FLAGS) {
             roleHost.registerFlag(flag.name, flag.definition);
         }
+        // Station-child identity (#840): omit navigator attendance. One flag.
+        roleHost.registerFlag(STATION_CHILD_FLAG.name, STATION_CHILD_FLAG.definition);
         let admitted = false;
         let selectedRole;
         /** Live Reviewer parent activation for envelope agent_start prompt assembly. */
@@ -1473,12 +1482,14 @@ export function createRoleRuntimeExtension(dependencies) {
                 const sessionFile = ctx.sessionManager.getSessionFile?.() || ctx.sessionManager.getSessionDir?.();
                 const ledgerHome = resolveActivationLedgerHomeForPath(sessionFile);
                 const session = durableSessionPointer(ctx.sessionManager);
-                // Same public activation face for every role (#675 / owner 09-06): no nested-env
-                // skip, no work-role whitelist. Attendance attaches when the envelope supplies it.
+                // Station children (court diarist, inner-gate summons) omit navigator sidecar (#840).
+                // Top-level public entry legs still attend automatically.
                 // Navigator seat never re-attaches itself — prepare turns already ARE the navigator
                 // public activation (prevents summonPublicRole navigator ↔ attendance recursion).
+                const isStationChild = roleHost.getFlag(STATION_CHILD_FLAG.name) === true;
                 if (dependencies.createNavigatorAttendance !== undefined
-                    && entry.role !== "navigator") {
+                    && entry.role !== "navigator"
+                    && !isStationChild) {
                     let work;
                     let contextError;
                     if (dependencies.loadNavigatorWorkContext === undefined) {

package/dist/session-identity.js

@@ -0,0 +1,58 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { DEFAULT_ROLE_TURN_HOST, lookupHeadlessHostDescription, lookupHostDescription, } from "./host-descriptions.js";
+/** Durable session binding stored beside the host-owned session principal. */
+export function createSessionIdentityAuthority(authority, sessionBindingFile) {
+    const bindingPath = (principal) => join(authority.decode(principal).sessionDirectory, sessionBindingFile);
+    return {
+        resolveSessionFile(principal) {
+            return authority.decode(principal).sessionFile;
+        },
+        async load(principal) {
+            try {
+                const value = JSON.parse(await readFile(bindingPath(principal), "utf8"));
+                if (typeof value !== "object" || value === null || typeof value.sessionId !== "string") {
+                    throw new Error("durable session binding is invalid");
+                }
+                return value.sessionId;
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    return undefined;
+                throw error;
+            }
+        },
+        async bind(principal, sessionId) {
+            const target = bindingPath(principal);
+            await mkdir(dirname(target), { recursive: true });
+            const temporary = `${target}.${process.pid}.tmp`;
+            await writeFile(temporary, `${JSON.stringify({ sessionId })}\n`, { encoding: "utf8", mode: 0o600 });
+            await rename(temporary, target);
+        },
+    };
+}
+/**
+ * Host-aware resumable-session probe (#840 P1). The shared auto-resume loop
+ * (public-cli/auto-resume.ts) asks one question — "can this principal's turn
+ * still be resumed" — without itself knowing which concrete host executed it.
+ * Pi's own session.jsonl transcript (DurablePrincipalAuthority#isAvailable)
+ * answers that only for the pi host; ACP and headless hosts persist their
+ * resumable native session id under their own session-identity binding file
+ * instead (#729 / #731 / #645) and never write session.jsonl, so the plain
+ * pi check always reports them unavailable after one attempt. One lookup per
+ * registered host family — no per-host-name branch, no per-seat whitelist.
+ */
+export function resolveHostAwareSessionAvailability(host, principalAuthority) {
+    if (host === undefined || host === DEFAULT_ROLE_TURN_HOST) {
+        return (principal) => principalAuthority.isAvailable(principal);
+    }
+    const description = lookupHostDescription(host) ?? lookupHeadlessHostDescription(host);
+    if (description === undefined) {
+        // Host selection already fails closed on an unregistered name (#510) long
+        // before a turn dispatches; mirror the same fail-closed default here
+        // rather than guessing at pi's binding for a name pi does not own.
+        return () => Promise.resolve(false);
+    }
+    const sessionIdentity = createSessionIdentityAuthority(principalAuthority, description.sessionBindingFile);
+    return async (principal) => (await sessionIdentity.load(principal)) !== undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.3902",
+  "version": "0.1.3932",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/compliance-transport.ts

@@ -124,7 +124,12 @@ async function usageFromSummonedSession(summoned: PublicSummonResult): Promise<U
 async function projectAuditorTerminal(summoned: PublicSummonResult): Promise<ComplianceDecision> {
   const outcome = summoned.terminal?.roleOutcome;
   if (outcome === undefined) {
-    throw new Error(`Auditor public summon produced no terminal (exit ${summoned.exitCode})`);
+    const detail = summoned.stderr?.trim();
+    throw new Error(
+      detail && detail.length > 0
+        ? `Auditor public summon produced no terminal (exit ${summoned.exitCode}: ${detail})`
+        : `Auditor public summon produced no terminal (exit ${summoned.exitCode})`,
+    );
   }
   const usage = await usageFromSummonedSession(summoned);
   if (outcome.kind === "no_receipt") {

package/src/host-contracts.ts

@@ -183,6 +183,8 @@ export type RoleTurnRequest = {
    * and resume-with-message set this; bare resume without an open court omits it.
    */
   readonly courtAttemptId?: string;
+  /** Station child role run (#840): omit automatic navigator attendance. */
+  readonly stationChild?: boolean;
 };
 
 /** Turn result — only fields upper layers currently consume. */