@akagilnc/pi-workflow-roles 0.1.4321 → 0.1.4387

package/src/role-runtime.ts

@@ -46,6 +46,7 @@ import {
 } from "./engine-detour.ts";
 import { engineSessionMaterialFromOptions } from "./package-resources/engine-material.ts";
 import { registerEngineDetourTool } from "./engine-detour-tool.ts";
+import { runIdFromRunDirectory } from "./run-terminal-artifacts.ts";
 import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT } from "./receipt-delivery-policy.ts";
 import type { AnyCanonicalSkillBinding } from "./canonical-skill-binding.ts";
 import type { CollectorClock } from "./collector-evidence.ts";
@@ -84,6 +85,18 @@ import {
   DIARIST_TOOL_SPEC,
   type DiaristRuntimeDependencies,
 } from "./diarist-role.ts";
+import {
+  SECRETARIAT_OUTPUT_TOOL_SPEC,
+  SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_SPEC,
+  projectSecretariatSummonResult,
+  type SecretariatRuntimeDependencies,
+  type SecretariatSummonCountersignParameters,
+} from "./secretariat-role.ts";
+import {
+  SECRETARIAT_ACCEPTED_TEXT,
+  SECRETARIAT_OUTPUT_TOOL_NAME,
+  SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME,
+} from "./secretariat-contracts.ts";
 import {
   DIARIST_ACCEPTED_TEXT,
   projectDiaristAmendments,
@@ -459,6 +472,7 @@ type ActivationRuntime = {
   navigator: { activate(): Promise<void> };
   auditor: { activate(): Promise<void> };
   diarist: { activate(): Promise<void> };
+  secretariat: { activate(): Promise<void> };
   merger(): Promise<void>;
 };
 
@@ -488,6 +502,7 @@ function activationStage(role: PackagedRole, runtime: ActivationRuntime): { id:
     case "navigator": return { id: "load-and-install", run: async () => runtime.navigator.activate() };
     case "auditor": return { id: "load-and-install", run: async () => runtime.auditor.activate() };
     case "diarist": return { id: "load-and-install", run: async () => runtime.diarist.activate() };
+    case "secretariat": return { id: "load-and-install", run: async () => runtime.secretariat.activate() };
     case "merger": return { id: "prepare-git-and-install", run: async () => runtime.merger() };
   }
 }
@@ -599,6 +614,7 @@ export type RoleRuntimeDependencies = {
   loadNavigatorSoul?(): Promise<string>;
   loadAuditorSoul?(): Promise<string>;
   loadDiaristSoul?(): Promise<string>;
+  loadSecretariatSoul?(): Promise<string>;
   loadDoctorCase?(path: string): Promise<import("./doctor-contracts.ts").DoctorCase>;
   loadMergerSoul?(): Promise<string>;
   loadMergerInput?(path: string): Promise<unknown>;
@@ -677,7 +693,8 @@ export function publicNavigatorSettlement(role: string, phase: NavigatorPhase, e
   const status = typeof details.status === "string"
     ? details.status
     : typeof details.judgeStatus === "string" ? details.judgeStatus
-    : typeof details.countersignStatus === "string" ? details.countersignStatus : undefined;
+    : typeof details.countersignStatus === "string" ? details.countersignStatus
+    : typeof details.secretariatStatus === "string" ? details.secretariatStatus : undefined;
   if (status !== undefined && status === "escalate") {
     return { kind: "human_decision", role, phase, status };
   }
@@ -909,35 +926,46 @@ function readDiaristTicketAssertion(
   return { kind: "invalid" };
 }
 
-/** Run coordinates + optional pre-bound ticket from durable pages (#779). */
-function readDiaristRunCoordinates(ctx: HostContext): {
+/** Shared durable coordinates for role tools that summon another public role. */
+function readRoleRunCoordinates(ctx: HostContext, label: string): {
   readonly runDirectory: string;
   readonly projectRoot: string;
   readonly home: string;
-  readonly boundTicketNumber?: number;
+  readonly admitted: Record<string, unknown>;
 } {
   const runDirectory = runDirectoryFromHostContext(ctx);
-  if (runDirectory === undefined) {
-    throw new Error("diarist accept requires AK_ROLE_RUN_DIR");
-  }
+  if (runDirectory === undefined) throw new Error(`${label} requires AK_ROLE_RUN_DIR`);
   const admittedPath = join(runDirectory, "admitted-request.json");
-  const admitted = JSON.parse(readFileSync(admittedPath, "utf8")) as Record<
-    string,
-    unknown
-  >;
+  const admitted = JSON.parse(readFileSync(admittedPath, "utf8")) as Record<string, unknown>;
   if (typeof admitted.projectRoot !== "string" || admitted.projectRoot.trim() === "") {
-    throw new Error(`diarist admitted-request missing projectRoot (${admittedPath})`);
+    throw new Error(`${label} admitted-request missing projectRoot (${admittedPath})`);
   }
-  const bound =
-    typeof admitted.ticketNumber === "number" &&
-    Number.isSafeInteger(admitted.ticketNumber) &&
-    admitted.ticketNumber >= 1
-      ? admitted.ticketNumber
-      : undefined;
   return {
     runDirectory,
     projectRoot: admitted.projectRoot,
     home: homeFromRunDirectory(runDirectory),
+    admitted,
+  };
+}
+
+/** Run coordinates + optional pre-bound ticket from durable pages (#779). */
+function readDiaristRunCoordinates(ctx: HostContext): {
+  readonly runDirectory: string;
+  readonly projectRoot: string;
+  readonly home: string;
+  readonly boundTicketNumber?: number;
+} {
+  const coordinates = readRoleRunCoordinates(ctx, "diarist accept");
+  const bound =
+    typeof coordinates.admitted.ticketNumber === "number" &&
+    Number.isSafeInteger(coordinates.admitted.ticketNumber) &&
+    coordinates.admitted.ticketNumber >= 1
+      ? coordinates.admitted.ticketNumber
+      : undefined;
+  return {
+    runDirectory: coordinates.runDirectory,
+    projectRoot: coordinates.projectRoot,
+    home: coordinates.home,
     ...(bound === undefined ? {} : { boundTicketNumber: bound }),
   };
 }
@@ -1038,6 +1066,145 @@ const COUNTERSIGN_QUEUE_STATUSES = new Set(["converged", "continue", "escalate"]
 const COUNTERSIGN_STATUS_REASK =
   "countersignStatus 不是 converged、continue、escalate 三态之一。请重新交卷，status 写明其一。" as const;
 
+/**
+ * #924 Secretariat on the shared filed-officer envelope + non-terminating
+ * summon-countersign tool (auditor dossier extension pattern).
+ * Nested countersign lifecycle stays on summonPublicRole (ADR 0018).
+ * #924 / 第 0 条: output tool records the receipt as submitted — no status
+ * shape/value reject or reask; legality is content-layer / downstream.
+ */
+export function createSecretariatRoleRuntime(
+  roleHost: RoleHost,
+  dependencies: SecretariatRuntimeDependencies,
+) {
+  let parentInstruction = "";
+  const base = createFiledOfficerRuntime(
+    roleHost,
+    {
+      role: "secretariat",
+      tool: SECRETARIAT_OUTPUT_TOOL_SPEC,
+      acceptedText: SECRETARIAT_ACCEPTED_TEXT,
+      soulTag: "secretariat",
+    },
+    dependencies,
+  );
+  let summonRegistered = false;
+  return {
+    async activate() {
+      await base.activate();
+      if (!summonRegistered) {
+        summonRegistered = true;
+        // Capture parent prompt for default summon instruction (envelope already
+      // owns soul inject; this handler only records the assignment text).
+      roleHost.on("before_agent_start", (event) => {
+        if (typeof event.prompt === "string" && event.prompt.trim() !== "") {
+          parentInstruction = event.prompt;
+        }
+      });
+      roleHost.registerTool({
+        name: SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME,
+        label: SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_SPEC.label,
+        description: SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_SPEC.description,
+        promptSnippet: SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_SPEC.promptSnippet,
+        parameters: SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_SPEC.parameters as never,
+        async execute(
+          _toolCallId,
+          parameters: SecretariatSummonCountersignParameters,
+          signal,
+          _onUpdate,
+          ctx,
+        ): Promise<HostToolResult<unknown>> {
+          const fromArgs =
+            typeof parameters?.instruction === "string"
+              ? parameters.instruction.trim()
+              : "";
+          // #924: instruction comes from tool args or parent prompt only — no
+          // unauthored default summons prose (票号写在传召里; no fabricated fallback).
+          const instruction =
+            fromArgs !== "" ? fromArgs : parentInstruction.trim();
+          const correlationId = (() => {
+            const runDirectory = runDirectoryFromHostContext(ctx);
+            if (runDirectory === undefined) return undefined;
+            return runIdFromRunDirectory(runDirectory);
+          })();
+          const summon = dependencies.summonCountersign;
+          const summoned = summon === undefined
+            ? await (async () => {
+                const coordinates = readRoleRunCoordinates(ctx, "secretariat summons");
+                const { summonPublicRole } = await import("./public-role-summons.ts");
+                return summonPublicRole({
+                  role: "countersign",
+                  argv: ["--project", coordinates.projectRoot, "--", instruction],
+                  cwd: coordinates.projectRoot,
+                  home: coordinates.home,
+                  ...(signal === undefined ? {} : { signal }),
+                  ...(correlationId === undefined ? {} : { correlationId }),
+                  ...(dependencies.packageRoot === undefined
+                    ? {}
+                    : { packageRoot: dependencies.packageRoot }),
+                  ...(dependencies.hostAdapters === undefined
+                    ? {}
+                    : { hostAdapters: dependencies.hostAdapters }),
+                });
+              })()
+            : await summon({
+                instruction,
+                cwd: ctx.cwd,
+                ...(signal === undefined ? {} : { signal }),
+                ...(correlationId === undefined ? {} : { correlationId }),
+                ...(dependencies.home === undefined ? {} : { home: dependencies.home }),
+                ...(dependencies.packageRoot === undefined
+                  ? {}
+                  : { packageRoot: dependencies.packageRoot }),
+              });
+          const details = projectSecretariatSummonResult(summoned);
+          const outcomeKind =
+            typeof details.outcomeKind === "string" ? details.outcomeKind : "unknown";
+          const contentText =
+            outcomeKind === "accepted" || outcomeKind === "audit_escalation"
+              ? "给事中回执已送达中书省"
+              : outcomeKind === "failure"
+                ? "给事中传召失败"
+                : outcomeKind === "no_receipt"
+                  ? "给事中无回执"
+                  : "给事中传召未得终局";
+          return {
+            content: [{ type: "text" as const, text: contentText }],
+            details,
+          };
+        },
+        });
+      }
+      const packageRequired = [
+        SECRETARIAT_OUTPUT_TOOL_NAME,
+        SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME,
+      ] as const;
+      const all = roleHost.getAllTools().map((tool) => tool.name);
+      for (const name of packageRequired) {
+        if (all.filter((item) => item === name).length !== 1) {
+          throw new Error(`secretariat required tool collision or missing: ${name}`);
+        }
+      }
+      // Host-neutral minimum package surface (#924 G6): declare package tools via
+      // setActiveTools without hardcoding host builtin names. Preserve any host
+      // surface already visible on getAllTools/getActiveTools so body rewrite
+      // (public gh path) stays reachable on hosts that expose it.
+      const priorActive = roleHost.getActiveTools();
+      const hostSurface = priorActive.length > 0 ? priorActive : all;
+      const nextActive = [
+        ...new Set([...hostSurface, ...packageRequired]),
+      ];
+      roleHost.setActiveTools(nextActive);
+      const active = roleHost.getActiveTools();
+      for (const name of packageRequired) {
+        if (!active.includes(name)) {
+          throw new Error(`secretariat failed to activate required tool ${name}`);
+        }
+      }
+    },
+  };
+}
+
 export function createCountersignRoleRuntime(
   roleHost: RoleHost,
   dependencies: CountersignRuntimeDependencies,
@@ -1694,6 +1861,15 @@ export function createRoleRuntimeExtension(
         },
       },
     );
+    const secretariat = createSecretariatRoleRuntime(roleHost, {
+      async loadSoul() {
+        if (!dependencies.loadSecretariatSoul) throw new Error("Secretariat runtime dependencies are not configured");
+        return dependencies.loadSecretariatSoul();
+      },
+      ...(dependencies.packageRoot === undefined
+        ? {}
+        : { packageRoot: dependencies.packageRoot }),
+    });
     const merger = createMergerRoleRuntime(roleHost, {
       async loadSoul() { if (!dependencies.loadMergerSoul) throw new Error("Merger runtime dependencies are not configured"); return dependencies.loadMergerSoul(); },
       async loadInput(path) { if (!dependencies.loadMergerInput) throw new Error("Merger runtime dependencies are not configured"); return dependencies.loadMergerInput(path); },
@@ -1985,6 +2161,7 @@ export function createRoleRuntimeExtension(
         navigator,
         auditor,
         diarist,
+        secretariat,
         merger: async () => {
           await merger.activate();
         },
@@ -2097,6 +2274,14 @@ export function createRoleRuntimeExtension(
         if (!engineDetourRegistered) {
           engineDetourRegistered = registerEngineDetourTool(roleHost, hostActions);
         }
+        // Secretariat owns a declared active surface. The shared engine detour is
+        // registered after role activation, so include it here rather than leave
+        // a newly registered optional tool unreachable until a later reload.
+        if (entry.role === "secretariat" && engineDetourRegistered) {
+          roleHost.setActiveTools([
+            ...new Set([...roleHost.getActiveTools(), ENGINE_DETOUR_TOOL_NAME]),
+          ]);
+        }
         // Worker gates ①②: arm records baseline and runs private one-shot hook uninstall (ADR 0070).
         // Parent session feeds #216 createRecordSession so baseline/bounce survive resume.
         if (entry.role === "coder" || entry.role === "fixer") {

package/src/secretariat-contracts.ts

@@ -0,0 +1,27 @@
+/**
+ * Public Secretariat (中书省) terminating receipt contracts.
+ * Public terminal domain: converged (署) | escalate (上呈).
+ * A countersign continue is an internal rewrite-and-resubmit fact, not a
+ * Secretariat terminal.
+ * (#924) — 原卷保真: the verdict is recognized read-only; no field
+ * is defaulted, rewritten, or dropped (ADR 0055).
+ */
+
+export const SECRETARIAT_OUTPUT_TOOL_NAME = "ak_secretariat_output";
+export const SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME =
+  "ak_secretariat_summon_countersign";
+export const SECRETARIAT_ACCEPTED_TEXT = "中书省回执已接受";
+
+export type SecretariatVerdict =
+  | {
+      secretariatStatus: "converged";
+      ticketNumber?: number;
+      note?: string;
+      evidence?: unknown;
+    }
+  | {
+      secretariatStatus: "escalate";
+      decisionGate?: { question: string; options: string[] };
+      note?: string;
+      evidence?: unknown;
+    };

package/src/secretariat-role.ts

@@ -0,0 +1,210 @@
+/**
+ * Secretariat (中书省) label, soul shape, decision-tool specs, result projection.
+ * Lifecycle assembly (activate, register, prompt inject, inventory) lives on the
+ * shared envelope — src/role-runtime.ts (ADR 0018 / #924).
+ */
+import type { Static } from "typebox";
+import { Type } from "typebox";
+
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
+import type { NamedRoleTurnHostAdapter } from "./public-cli/role-turn-host-resolution.ts";
+import type { PublicSummonResult } from "./public-role-summons.ts";
+import {
+  SECRETARIAT_ACCEPTED_TEXT,
+  SECRETARIAT_OUTPUT_TOOL_NAME,
+  SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME,
+  type SecretariatVerdict,
+} from "./secretariat-contracts.ts";
+import { runIdFromRunDirectory } from "./run-terminal-artifacts.ts";
+
+export {
+  SECRETARIAT_ACCEPTED_TEXT,
+  SECRETARIAT_OUTPUT_TOOL_NAME,
+  SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME,
+} from "./secretariat-contracts.ts";
+export type { SecretariatVerdict };
+
+/** 中书省终局回执形状；形状指引，非 schema 闸。 */
+export const secretariatVerdictSchema = withTerminatingOutputDeclarations(
+  Type.Object(
+    {
+      secretariatStatus: Type.Unknown({
+        description: "converged | escalate（终局形状指引，非闸）",
+      }),
+      ticketNumber: Type.Optional(
+        Type.Number({ description: "本票号；署时指向最终正文所在票" }),
+      ),
+      note: Type.Optional(Type.String({ description: "附注" })),
+      evidence: Type.Optional(Type.Unknown({ description: "留存证据" })),
+      decisionGate: Type.Optional(
+        Type.Object(
+          {
+            question: Type.Optional(Type.String()),
+            options: Type.Optional(Type.Array(Type.String())),
+          },
+          { additionalProperties: true, description: "需陛下处置的问题与选项" },
+        ),
+      ),
+    },
+    { additionalProperties: true },
+  ),
+);
+(secretariatVerdictSchema as unknown as { required: string[] }).required = [];
+
+export type SecretariatVerdictParameters = Static<typeof secretariatVerdictSchema>;
+
+/** 传召给事中参数；形状指引，非 schema 闸。 */
+export const secretariatSummonCountersignSchema = Type.Object(
+  {
+    instruction: Type.Optional(
+      Type.String({
+        description: "传召散文；票号写在其中。空则沿用本局指令。",
+      }),
+    ),
+  },
+  { additionalProperties: true },
+);
+(secretariatSummonCountersignSchema as unknown as { required: string[] }).required = [];
+
+export type SecretariatSummonCountersignParameters = Static<
+  typeof secretariatSummonCountersignSchema
+>;
+
+export const SECRETARIAT_OUTPUT_TOOL_SPEC = {
+  name: SECRETARIAT_OUTPUT_TOOL_NAME,
+  label: "中书省输出",
+  description: "中书省终局回执（署或上呈）；给事中封驳须改票重送，不在此终局。",
+  promptSnippet: "中书省终局回执",
+  parameters: secretariatVerdictSchema,
+} as const;
+
+export const SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_SPEC = {
+  name: SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME,
+  label: "传召给事中",
+  description: "经共享执行接缝传召给事中审票；封驳后续同一 run 再送。",
+  promptSnippet: "传召给事中",
+  parameters: secretariatSummonCountersignSchema,
+} as const;
+
+export type SecretariatSummonCountersign = (input: {
+  readonly instruction: string;
+  readonly cwd: string;
+  readonly signal?: AbortSignal;
+  readonly correlationId?: string;
+  readonly home?: string;
+  readonly packageRoot?: string;
+}) => Promise<PublicSummonResult>;
+
+export type SecretariatRuntimeDependencies = {
+  loadSoul(): Promise<string>;
+  /** Package root for nested public summons. */
+  packageRoot?: string;
+  /**
+   * Nested countersign summon. Production uses shared summonPublicRole;
+   * tests may inject a tracer. Prefer hostAdapters on the default path.
+   */
+  summonCountersign?: SecretariatSummonCountersign;
+  /** Optional home override for nested summons (tests). */
+  home?: string;
+  /**
+   * Composition-root adapter table forwarded by the default summonPublicRole
+   * path (tests). Production leaves unset.
+   */
+  hostAdapters?: readonly NamedRoleTurnHostAdapter[];
+};
+
+function latestObjectPayload(
+  payloads: readonly unknown[] | undefined,
+): Record<string, unknown> | undefined {
+  if (payloads === undefined || payloads.length === 0) return undefined;
+  const latest = payloads[payloads.length - 1];
+  if (latest === null || typeof latest !== "object" || Array.isArray(latest)) {
+    return undefined;
+  }
+  return latest as Record<string, unknown>;
+}
+
+/**
+ * Project nested countersign PublicSummonResult onto tool details.
+ * Authority: keep typed terminal kind + payloads/diagnostic intact (gatekeeper
+ * projectOfficerTerminal precedent / ADR 0052 / 失败诚实). No content gate.
+ */
+export function projectSecretariatSummonResult(
+  summoned: PublicSummonResult,
+): Record<string, unknown> {
+  const terminal = summoned.terminal;
+  const roleOutcome = terminal?.roleOutcome;
+  const runDirectory = summoned.runDirectory;
+  const runId =
+    typeof runDirectory === "string" && runDirectory.trim() !== ""
+      ? runIdFromRunDirectory(runDirectory)
+      : undefined;
+  const base: Record<string, unknown> = {
+    exitCode: summoned.exitCode,
+    ...(runId === undefined ? {} : { runId }),
+    ...(runDirectory === undefined ? {} : { runDirectory }),
+    ...(summoned.stderr === undefined || summoned.stderr === ""
+      ? {}
+      : { stderr: summoned.stderr }),
+  };
+
+  if (roleOutcome === undefined) {
+    return { ...base, outcomeKind: "no_terminal" };
+  }
+
+  if (roleOutcome.kind === "accepted" || roleOutcome.kind === "audit_escalation") {
+    const payloads = Array.isArray(roleOutcome.payloads) ? roleOutcome.payloads : undefined;
+    const latest = latestObjectPayload(payloads);
+    const countersignStatus =
+      latest !== undefined && typeof latest.countersignStatus === "string"
+        ? latest.countersignStatus
+        : undefined;
+    return {
+      ...base,
+      outcomeKind: roleOutcome.kind,
+      // audit_escalation carries typed status; accepted may carry fixture/compat status.
+      ...("status" in roleOutcome &&
+      typeof roleOutcome.status === "string" &&
+      roleOutcome.status.length > 0
+        ? { status: roleOutcome.status }
+        : {}),
+      ...(countersignStatus === undefined ? {} : { countersignStatus }),
+      ...(latest === undefined ? {} : { receipt: latest }),
+      ...(payloads === undefined ? {} : { payloads }),
+      ...(roleOutcome.decisiveFacts === undefined
+        ? {}
+        : { decisiveFacts: roleOutcome.decisiveFacts }),
+    };
+  }
+
+  if (roleOutcome.kind === "failure") {
+    const payloads = Array.isArray(roleOutcome.payloads) ? roleOutcome.payloads : undefined;
+    return {
+      ...base,
+      outcomeKind: "failure",
+      diagnostic: roleOutcome.diagnostic,
+      ...(roleOutcome.cause === undefined ? {} : { cause: roleOutcome.cause }),
+      ...(roleOutcome.decisiveFacts === undefined
+        ? {}
+        : { decisiveFacts: roleOutcome.decisiveFacts }),
+      ...(payloads === undefined ? {} : { payloads }),
+      ...(latestObjectPayload(payloads) === undefined
+        ? {}
+        : { receipt: latestObjectPayload(payloads) }),
+    };
+  }
+
+  // no_receipt (and any future kind still carries decisiveFacts when present)
+  return {
+    ...base,
+    outcomeKind: roleOutcome.kind,
+    ...("status" in roleOutcome &&
+    typeof roleOutcome.status === "string" &&
+    roleOutcome.status.length > 0
+      ? { status: roleOutcome.status }
+      : {}),
+    ...("decisiveFacts" in roleOutcome && roleOutcome.decisiveFacts !== undefined
+      ? { decisiveFacts: roleOutcome.decisiveFacts }
+      : {}),
+  };
+}

package/src/sitian-appender.ts

@@ -210,6 +210,22 @@ type SitianRecordPath = {
   readonly ledgerHome: string;
 };
 
+/** Sole records leaf under every sitian volume directory. */
+const SITIAN_RECORDS_LEAF = "records.jsonl" as const;
+
+/**
+ * Ticket-provenance under-book paths (docs/dossier-topology.md sole authority).
+ * Writer ticket branch and owner-visible shape share this join — one code path.
+ */
+function ticketProvenanceUnderBookPaths(
+  ledgerHome: string,
+  bookKey: string,
+  ticketId: string,
+): { sessionDir: string; recordFile: string } {
+  const sessionDir = join(activationBookDirectory(ledgerHome, bookKey), ticketId);
+  return { sessionDir, recordFile: join(sessionDir, SITIAN_RECORDS_LEAF) };
+}
+
 /** Pure topology owner shared by ambient writes and explicit-home submission reads. */
 export function resolveSitianRecordPathInLedger(
   input: SitianRecordInput,
@@ -228,13 +244,16 @@ export function resolveSitianRecordPathInLedger(
     : undefined;
 
   let sessionDir: string;
+  let recordFile: string;
   if (ticketNumber !== undefined) {
     // docs/dossier-topology.md: ticket dir holds the unique records.jsonl directly (#900).
-    const bookDir = activationBookDirectory(
+    const paths = ticketProvenanceUnderBookPaths(
       ledgerHome,
       resolveBookKeyFromGit(input.cwd ?? process.cwd()),
+      ticketNumber,
     );
-    sessionDir = join(bookDir, ticketNumber);
+    sessionDir = paths.sessionDir;
+    recordFile = paths.recordFile;
   } else {
     if (
       input.sessionParent === undefined
@@ -244,12 +263,26 @@ export function resolveSitianRecordPathInLedger(
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
     sessionDir = join(dirname(input.sessionParent), category);
+    recordFile = join(sessionDir, SITIAN_RECORDS_LEAF);
   }
 
-  const recordFile = join(sessionDir, "records.jsonl");
   return { sessionDir, recordFile, ledgerHome };
 }
 
+/**
+ * Owner-visible ticket 起居录 path shape via the writer ticket joins
+ * (ticketProvenanceUnderBookPaths). Ledger leaf is the package-owned `.ak-roles`
+ * name (ADR 0048); variable slots keep owner labels; no fake-home path reverse.
+ */
+export function projectTicketRecordsPathShape(): string {
+  const { recordFile } = ticketProvenanceUnderBookPaths(
+    join("~", ".ak-roles"),
+    "<簿>",
+    "<票号>",
+  );
+  return recordFile.replace(/\\/g, "/");
+}
+
 /** Compute a write destination from ambient ledger topology (ADR 0065). */
 export function resolveSitianRecordPath(input: SitianRecordInput): SitianRecordPath {
   const ledgerHome =

package/src/worker-role.ts

@@ -1,7 +1,7 @@
 import type { RoleHost, HostContext, HostToolResult, HostGatekeeperActions } from "./host-contracts.ts";
 import { Type, type Static } from "typebox";
 import { openToolObjectFromUnion } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 import { CorrectableSubmissionError } from "./submission-correctable-error.ts";
 
 import type {
@@ -73,7 +73,7 @@ const coderOutputVariants = Type.Union([
     })),
   }, { additionalProperties: false }),
 ]);
-export const coderOutputSchema = withInfrastructureFailureDeclaration(
+export const coderOutputSchema = withTerminatingOutputDeclarations(
   openToolObjectFromUnion(coderOutputVariants),
 );
 export type { FixerOutput, CoderOutput };