@akagilnc/pi-workflow-roles 0.1.4062 → 0.1.4196

package/src/public-cli/countersign-run.ts

@@ -25,10 +25,16 @@
 import type { DurablePrincipalAuthority, RoleTurnRequest } from "../host-contracts.ts";
 import { engineSessionMaterialFromOptions, pickEngineAxis } from "../package-resources/engine-material.ts";
 import { CliUsageError } from "./cli-errors.ts";
+import {
+  projectCourtTicketNumbers,
+} from "../diarist-contracts.ts";
+import { isSafePositiveTicketNumber } from "../run-ticket-number.ts";
 import {
   admitCountersignInvocation,
   bindAdmittedTicketNumber,
+  bindCourtTicketNumbersOnAdmitted,
   buildCountersignTransportPrompt,
+  relocateAdmittedRunToTicket,
   type AdmittedCountersignInvocation,
   type ParseCountersignArgvResult,
 } from "./invocation.ts";
@@ -46,6 +52,7 @@ import {
   markRunAdmitted,
   markRunTerminal,
   type PublicResumeRequest,
+  type RunWriterLease,
   type SameTicketSummonsMaterials,
 } from "./run-lifecycle.ts";
 import { tryResumeSameTicketSeatRun } from "./seat-ticket-binding.ts";
@@ -70,6 +77,12 @@ export type CountersignRunEnv = PostAdmissionEnv & {
   runCourtDiaristStation?: (
     admitted: AdmittedCountersignInvocation,
   ) => Promise<void>;
+  /**
+   * #871: typed co-review set from the identity 起居郎 turn, applied onto the
+   * resumed run before bound refresh (same-ticket re-summons path). Whole-set
+   * replace — never union. Production leaves unset outside that handoff.
+   */
+  pendingCourtTicketNumbers?: readonly number[];
 };
 
 /** Project admitted invocation onto the host-neutral turn request. */
@@ -94,7 +107,16 @@ export function buildCountersignTurnRequest(
 
 /** 起居郎 identity outcome — escalate stays distinct from missing terminal. */
 type CourtDiaristIdentity =
-  | { readonly kind: "ticket"; readonly ticketNumber: number }
+  | {
+      readonly kind: "ticket";
+      readonly ticketNumber: number;
+      /**
+       * #871 typed co-review set when the LLM explicitly submitted one.
+       * Absent means "no new set this turn" — resume must keep the stored run fact
+       * (never silently degrade a multi-ticket set to [main]).
+       */
+      readonly courtTicketNumbers?: readonly number[];
+    }
   | { readonly kind: "unbound" }
   | { readonly kind: "escalate" };
 
@@ -103,6 +125,53 @@ type CourtDiaristInvocationResult = {
   readonly failedWithoutEscalate?: { readonly diagnostic: string };
 };
 
+/**
+ * Read #871 set from preserved diarist payloads.
+ * - Field absent / null / non-array → undefined (no new set; resume keeps store).
+ * - Explicit [] → single-ticket [main] whole-set replace (signed empty-set contract).
+ * - Non-empty array with zero lawful typed members after projection → not a new set
+ *   (do not impersonate explicit empty and wipe a stored multi-ticket fact).
+ * - Non-empty array with ≥1 lawful member → sole type/dedupe projection + principal guarantee.
+ * - Multiple submissions: last qualifying set wins.
+ * Live path never shape-rejects the role turn; durable damage is a separate seam.
+ */
+function courtTicketNumbersFromOutcome(
+  roleOutcome: TerminalRoleOutcome | undefined,
+  principalTicket: number,
+): readonly number[] | undefined {
+  if (roleOutcome === undefined) return undefined;
+  const payloads =
+    roleOutcome.kind === "accepted" ||
+    roleOutcome.kind === "audit_escalation" ||
+    roleOutcome.kind === "failure"
+      ? roleOutcome.payloads ?? []
+      : [];
+  let latest: readonly number[] | undefined;
+  for (const payload of payloads) {
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+      continue;
+    }
+    const record = payload as Record<string, unknown>;
+    if (!Object.hasOwn(record, "courtTicketNumbers")) continue;
+    const raw = record.courtTicketNumbers;
+    // Only a real array is a candidate set. Non-array is not explicit empty.
+    if (!Array.isArray(raw)) continue;
+    // Members only — do not inject principal yet, or all-invalid non-empty becomes [main].
+    const members = projectCourtTicketNumbers(raw);
+    if (members === null) continue;
+    if (members.length === 0) {
+      // Literal [] is the intentional principal-only replace; non-empty garbage is not.
+      if (raw.length === 0) {
+        latest = projectCourtTicketNumbers([], { principalTicket }) ?? undefined;
+      }
+      continue;
+    }
+    latest =
+      projectCourtTicketNumbers(raw, { principalTicket }) ?? undefined;
+  }
+  return latest;
+}
+
 /** Routing boolean over the child's own typed sequence — does not pick or rewrite a sole row. */
 function courtDiaristEscalated(roleOutcome: TerminalRoleOutcome | undefined): boolean {
   if (roleOutcome === undefined) return false;
@@ -181,13 +250,14 @@ async function invokeCourtDiarist(input: {
   }
 
   const asserted = (result.admitted as { ticketNumber?: number } | undefined)?.ticketNumber;
-  if (
-    typeof asserted === "number" &&
-    Number.isSafeInteger(asserted) &&
-    asserted >= 1
-  ) {
+  if (isSafePositiveTicketNumber(asserted)) {
+    const courtTicketNumbers = courtTicketNumbersFromOutcome(roleOutcome, asserted);
     return {
-      identity: { kind: "ticket", ticketNumber: asserted },
+      identity: {
+        kind: "ticket",
+        ticketNumber: asserted,
+        ...(courtTicketNumbers === undefined ? {} : { courtTicketNumbers }),
+      },
     };
   }
   return {
@@ -219,25 +289,45 @@ export async function runCountersignCourtDiaristStation(
   // First-entry unbound identity is owned by runPublicCountersign.
   if (admitted.ticketNumber === undefined) return;
 
-  const outcome = await invokeCourtDiarist(
-    {
-      instruction: `整理 #${admitted.ticketNumber} 的本案依据。`,
-      projectRoot: admitted.projectRoot,
-      failureLabel: `ticket #${admitted.ticketNumber}`,
-      // Refresh holds a typed key — hand it off so identity is bound before turn.
-      boundTicketNumber: admitted.ticketNumber,
-    },
-    env,
-    io,
-  );
+  // #871: refresh every member of the typed co-review set; single-ticket face
+  // is just the set [main]. Present-but-empty / missing-principal is damage —
+  // never silently fall back to main-only (legacy absent field still may).
+  let refreshTickets: readonly number[];
+  if (admitted.courtTicketNumbers !== undefined) {
+    if (
+      admitted.courtTicketNumbers.length === 0 ||
+      !admitted.courtTicketNumbers.includes(admitted.ticketNumber)
+    ) {
+      throw new StationChildExhaustedError(
+        `court diarist station: courtTicketNumbers is damaged (empty or missing principal #${admitted.ticketNumber})`,
+      );
+    }
+    refreshTickets = admitted.courtTicketNumbers;
+  } else {
+    refreshTickets = [admitted.ticketNumber];
+  }
 
-  if (outcome.identity.kind === "escalate") {
-    throw new StationChildExhaustedError(
-      "court diarist station escalated (cannot identify court target)",
+  for (const ticketNumber of refreshTickets) {
+    const outcome = await invokeCourtDiarist(
+      {
+        instruction: `整理 #${ticketNumber} 的本案依据。`,
+        projectRoot: admitted.projectRoot,
+        failureLabel: `ticket #${ticketNumber}`,
+        // Refresh holds a typed key — hand it off so identity is bound before turn.
+        boundTicketNumber: ticketNumber,
+      },
+      env,
+      io,
     );
-  }
-  if (outcome.failedWithoutEscalate !== undefined) {
-    throw new StationChildExhaustedError(outcome.failedWithoutEscalate.diagnostic);
+
+    if (outcome.identity.kind === "escalate") {
+      throw new StationChildExhaustedError(
+        "court diarist station escalated (cannot identify court target)",
+      );
+    }
+    if (outcome.failedWithoutEscalate !== undefined) {
+      throw new StationChildExhaustedError(outcome.failedWithoutEscalate.diagnostic);
+    }
   }
 }
 
@@ -293,6 +383,7 @@ export async function runPublicCountersign(
   // hook failures stay on the parent call-local budget, exhausted nested
   // station children still skip parent auto-resume (#840 父子不层叠).
   let typedTicket: number | undefined;
+  let typedCourtTicketNumbers: readonly number[] | undefined;
   let identityDiaristRan = false;
 
   if (env.runCourtDiaristStation === undefined) {
@@ -347,7 +438,10 @@ export async function runPublicCountersign(
     // unbound and continue (true-unbound face). Escalate / typed failure above;
     // bound refresh still fails honest via runCountersignCourtDiaristStation.
     if (outcome.identity.kind === "ticket") {
-      typedTicket = outcome.identity.ticketNumber;
+      const assertedTicket = outcome.identity.ticketNumber;
+      typedTicket = assertedTicket;
+      // #871: identity may hand a co-review set; absent field defaults to [main].
+      typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
       const summons: SameTicketSummonsMaterials = {
         instruction: parsed.instruction,
         instructionEmpty: parsed.instruction.trim() === "",
@@ -361,16 +455,26 @@ export async function runPublicCountersign(
         freshSummons: env.freshSummons,
         summons,
         resume: async (runId, materials) => {
-          // Resume selected: abandon mint first so a throw cannot leave it admitted.
+          // Resume selected: file the provisional run under the asserted ticket
+          // before abandoning it, so typed identity never leaves an unbound row.
+          await bindAdmittedTicketNumber(admitted, assertedTicket);
+          await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
           await markRunTerminal(admitted.runDirectory);
           // Identity 起居郎 asserted unbound (no issue face). Resume still runs
           // the bound refresh station under the typed key (refresh-every-court).
+          // #871: hand the identity set so resume can whole-replace the run fact
+          // when this summons produced a new typed set (never union).
           return await runPublicCountersignResume(
             {
               runId,
               ...(materials === undefined ? {} : { summons: materials }),
             },
-            env,
+            {
+              ...env,
+              ...(typedCourtTicketNumbers === undefined
+                ? {}
+                : { pendingCourtTicketNumbers: typedCourtTicketNumbers }),
+            },
             io,
           );
         },
@@ -381,6 +485,33 @@ export async function runPublicCountersign(
     }
   }
 
+  if (identityDiaristRan && typedTicket !== undefined) {
+    try {
+      await bindAdmittedTicketNumber(admitted, typedTicket);
+      await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+      // First court: explicit set wins; omitted field → single-ticket face [main].
+      // Set persistence is outside beforeDispatch — route write failures into the
+      // same controlled-failure settlement as station children (#871 B7).
+      await bindCourtTicketNumbersOnAdmitted(
+        admitted,
+        typedCourtTicketNumbers ?? [typedTicket],
+      );
+    } catch (error) {
+      return await presentControlledFailure(
+        admitted,
+        {
+          timedOut: false,
+          code: null,
+          stderr: "",
+          thrown: error,
+        },
+        countersignAdapters(),
+        env.principalAuthority,
+        io,
+      );
+    }
+  }
+
   const turnProjection: RoleTurnRequestProjectionOptions = {
     packageRoot: env.packageRoot,
     home: env.home,
@@ -405,23 +536,25 @@ export async function runPublicCountersign(
   // Mutable shell: ticket bind re-projects activation before executeTurn.
   const turnRequest = buildCountersignTurnRequest(admitted, turnProjection);
 
-  return await runPostAdmissionOneShot({
+  const result = await runPostAdmissionOneShot({
     admitted,
     env,
     io,
     request: turnRequest,
     adapters: countersignAdapters({
-      beforeDispatch: async (admittedSeat) => {
+      beforeDispatch: async (admittedSeat, lease) => {
         // Dossier pointer delivery rides post-admission after this hook (#709).
         if (!identityDiaristRan) {
           // Test seam (or any deferred identity): station owns assert + bind.
           await runCountersignCourtDiaristStation(admittedSeat, env, io);
         } else if (typedTicket !== undefined) {
-          // Production identity asserted unbound; bind typed key, then bound
-          // refresh so freeze loads issue face (typed handoff, not prose match).
-          await bindAdmittedTicketNumber(admittedSeat, typedTicket);
           await runCountersignCourtDiaristStation(admittedSeat, env, io);
         }
+        await relocateAdmittedRunToTicket(
+          admittedSeat,
+          env.principalAuthority,
+          lease,
+        );
         Object.assign(
           turnRequest,
           buildCountersignTurnRequest(admittedSeat, turnProjection),
@@ -430,11 +563,14 @@ export async function runPublicCountersign(
     }),
     ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
   });
+  await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+  return result;
 }
 
 function countersignAdapters(options?: {
   beforeDispatch?: (
     admitted: AdmittedCountersignInvocation,
+    lease: RunWriterLease,
   ) => void | Promise<void>;
 }) {
   return {
@@ -496,6 +632,20 @@ export async function runPublicCountersignResume(
     },
     adapters: countersignAdapters({
       beforeDispatch: async (admitted) => {
+        // #871 B7: durable set damage already identified at load — settle as
+        // station-child exhausted → presentControlledFailure (not structural exit 2).
+        if (admitted.courtTicketNumbersDamage !== undefined) {
+          throw new StationChildExhaustedError(admitted.courtTicketNumbersDamage);
+        }
+        // #871: same-ticket re-summons may hand a fresh typed set from identity.
+        // Whole-set replace onto this run fact; no new set → keep stored set.
+        // Manual resume (no pending) keeps the durable set and never invents one.
+        if (env.pendingCourtTicketNumbers !== undefined) {
+          await bindCourtTicketNumbersOnAdmitted(
+            admitted,
+            env.pendingCourtTicketNumbers,
+          );
+        }
         await runCountersignCourtDiaristStation(admitted, env, io);
       },
     }),

package/src/public-cli/diarist-run.ts

@@ -12,6 +12,7 @@ import {
   admitDiaristInvocation,
   bindAdmittedTicketNumber,
   buildInstructionTransportPrompt,
+  relocateAdmittedRunToTicket,
   type AdmittedDiaristInvocation,
   type ParseDiaristArgvResult,
 } from "./invocation.ts";
@@ -27,6 +28,7 @@ import {
   loadResumableDiaristRun,
   markRunAdmitted,
   type PublicResumeRequest,
+  type RunWriterLease,
   type SameTicketSummonsMaterials,
 } from "./run-lifecycle.ts";
 import { tryResumeSameTicketSeatRun } from "./seat-ticket-binding.ts";
@@ -40,7 +42,7 @@ import {
   projectRoleTurnRequest,
   type RoleTurnRequestProjectionOptions,
 } from "./turn-request.ts";
-import { readRunTicketNumber } from "../run-ticket-number.ts";
+import { readBoardTicketNumber } from "../run-ticket-number.ts";
 
 export type DiaristRunEnv = PostAdmissionEnv & {
   principalAuthority: DurablePrincipalAuthority;
@@ -66,11 +68,38 @@ export function buildDiaristTurnRequest(
   );
 }
 
-function diaristAdapters(): PostAdmissionAdapters<AdmittedDiaristInvocation> {
+/**
+ * Board-bound ticket on pages → memory bind + unbound→ticket relocate under lease.
+ * Shared by resume (interrupted board-bound unbound) and post-turn first assert.
+ */
+async function bindAndRelocateDiaristIfBoardBound(
+  admitted: AdmittedDiaristInvocation,
+  authority: DiaristRunEnv["principalAuthority"],
+  lease: RunWriterLease,
+): Promise<void> {
+  const boardTicket = await readBoardTicketNumber(admitted.runDirectory);
+  if (boardTicket === undefined) return;
+  if (admitted.ticketNumber === undefined) {
+    await bindAdmittedTicketNumber(admitted, boardTicket);
+  }
+  await relocateAdmittedRunToTicket(admitted, authority, lease);
+}
+
+function diaristAdapters(
+  env: DiaristRunEnv,
+): PostAdmissionAdapters<AdmittedDiaristInvocation> {
   return {
     trySettle: (admitted, authority, scope) =>
       trySettleDiaristTerminalResult(admitted, authority, scope),
     shouldPresentSettled: () => true,
+    // Resume interrupted state: board ticket already on pages, run still under unbound/.
+    beforeDispatch: async (admitted, lease) => {
+      await bindAndRelocateDiaristIfBoardBound(admitted, env.principalAuthority, lease);
+    },
+    // First post-turn assert: accept hook wrote board pages; relocate before lease release.
+    afterDispatch: async (admitted, lease) => {
+      await bindAndRelocateDiaristIfBoardBound(admitted, env.principalAuthority, lease);
+    },
   };
 }
 
@@ -141,6 +170,7 @@ export async function runPublicDiarist(
       ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
       ...(env.model === undefined ? {} : { model: env.model }),
       ...(env.correlationId === undefined ? {} : { correlationId: env.correlationId }),
+      ...(handoffTicket === undefined ? {} : { assertedTicketNumber: handoffTicket }),
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -152,14 +182,6 @@ export async function runPublicDiarist(
 
   await markRunAdmitted(admitted, env.principalAuthority);
 
-  // Typed handoff: bind before the turn so identity is on durable pages.
-  if (
-    typeof handoffTicket === "number" &&
-    Number.isSafeInteger(handoffTicket) &&
-    handoffTicket >= 1
-  ) {
-    await bindAdmittedTicketNumber(admitted, handoffTicket);
-  }
 
   const turnProjection: RoleTurnRequestProjectionOptions = {
     packageRoot: env.packageRoot,
@@ -189,22 +211,8 @@ export async function runPublicDiarist(
     env,
     io,
     request: turnRequest,
-    adapters: diaristAdapters(),
+    adapters: diaristAdapters(env),
     ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
-  }).then(async (result) => {
-    // Accept hook binds ticket onto durable pages (#771). Mirror that page fact
-    // onto the caller-visible admitted object — never pick a ticketNumber out of
-    // the payload sequence (#881 sole-collapse ban on ticket/escalate).
-    if (admitted.ticketNumber === undefined && result.admitted !== undefined) {
-      const fromPages = await readRunTicketNumber(admitted.runDirectory);
-      if (fromPages !== undefined) {
-        await bindAdmittedTicketNumber(admitted, fromPages);
-        if (result.admitted.ticketNumber === undefined) {
-          (result.admitted as { ticketNumber?: number }).ticketNumber = fromPages;
-        }
-      }
-    }
-    return result;
   });
 }
 
@@ -242,7 +250,7 @@ export async function runPublicDiaristResume(
         ),
       );
     },
-    adapters: diaristAdapters(),
+    adapters: diaristAdapters(env),
     ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
   });
 }

package/src/public-cli/instruction-seat-run.ts

@@ -7,13 +7,12 @@
  */
 import type { DurablePrincipalAuthority, RoleTurnRequest } from "../host-contracts.ts";
 import { engineSessionMaterialFromOptions, pickEngineAxis } from "../package-resources/engine-material.ts";
-import { readRunTicketNumber } from "../run-ticket-number.ts";
+import { readBoardTicketNumber } from "../run-ticket-number.ts";
 import { CliUsageError } from "./cli-errors.ts";
 import {
   admitAuditorInvocation,
   admitGatekeeperInvocation,
   admitNavigatorInvocation,
-  bindAdmittedTicketNumber,
   buildInstructionTransportPrompt,
   persistAdmittedSourceRunPath,
   type AdmittedAuditorInvocation,
@@ -286,7 +285,8 @@ export async function runPublicInstructionSeat(
         home: env.home,
       });
       auditorSourceRun = resolved.runDirectory;
-      auditorSourceTicket = await readRunTicketNumber(resolved.runDirectory);
+      // Auditor inherits board identity only — migration-derived is display, not admission.
+      auditorSourceTicket = await readBoardTicketNumber(resolved.runDirectory);
     } catch (error) {
       presentStructuralRejection(
         new CliUsageError(error instanceof Error ? error.message : String(error)),
@@ -345,6 +345,9 @@ export async function runPublicInstructionSeat(
       ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
       ...(env.model === undefined ? {} : { model: env.model }),
       ...(env.correlationId === undefined ? {} : { correlationId: env.correlationId }),
+      ...(auditorSourceTicket === undefined
+        ? {}
+        : { assertedTicketNumber: auditorSourceTicket }),
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -395,14 +398,7 @@ export async function runPublicInstructionSeat(
         env,
         io,
         request: turnRequest,
-        adapters: instructionSeatAdapters({
-          beforeDispatch: async (admittedSeat) => {
-            // Auditor inherits source-run ticket (notary face) — typed, not prose match.
-            if (auditorSourceTicket !== undefined) {
-              await bindAdmittedTicketNumber(admittedSeat, auditorSourceTicket);
-            }
-          },
-        }),
+        adapters: instructionSeatAdapters(),
         ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
       });
     },