@akagilnc/pi-workflow-roles 0.1.4321 → 0.1.4387

package/dist/public-cli/countersign-run.js

@@ -0,0 +1,439 @@
+import { engineSessionMaterialFromOptions, pickEngineAxis } from "../package-resources/engine-material.js";
+import { CliUsageError } from "./cli-errors.js";
+import { projectCourtTicketNumbers, } from "../diarist-contracts.js";
+import { isSafePositiveTicketNumber } from "../run-ticket-number.js";
+import { admitCountersignInvocation, bindAdmittedTicketNumber, bindCourtTicketNumbersOnAdmitted, buildCountersignTransportPrompt, relocateAdmittedRunToTicket, } from "./invocation.js";
+import { prepareSummonsResumeMaterials, presentControlledFailure, runPostAdmissionOneShot, runPostAdmissionSeatResume, resumeTurnRequestProjectionOptions, StationChildExhaustedError, } from "./post-admission.js";
+import { loadResumableCountersignRun, markRunAdmitted, markRunTerminal, } from "./run-lifecycle.js";
+import { tryResumeSameTicketSeatRun } from "./seat-ticket-binding.js";
+import { presentStructuralRejection, trySettleCountersignTerminalResult, } from "./settlement.js";
+import { projectRoleTurnRequest, } from "./turn-request.js";
+/** Project admitted invocation onto the host-neutral turn request. */
+export function buildCountersignTurnRequest(admitted, options) {
+    return projectRoleTurnRequest(admitted, {
+        activation: {
+            role: "countersign",
+            // Admitted typed binding rides the turn activation seam to the Notary gate.
+            ...(admitted.ticketNumber === undefined
+                ? {}
+                : { ticketNumber: admitted.ticketNumber }),
+        },
+    }, options);
+}
+/**
+ * Read #871 set from preserved diarist payloads.
+ * - Field absent / null / non-array → undefined (no new set; resume keeps store).
+ * - Explicit [] → single-ticket [main] whole-set replace (signed empty-set contract).
+ * - Non-empty array with zero lawful typed members after projection → not a new set
+ *   (do not impersonate explicit empty and wipe a stored multi-ticket fact).
+ * - Non-empty array with ≥1 lawful member → sole type/dedupe projection + principal guarantee.
+ * - Multiple submissions: last qualifying set wins.
+ * Live path never shape-rejects the role turn; durable damage is a separate seam.
+ */
+function courtTicketNumbersFromOutcome(roleOutcome, principalTicket) {
+    if (roleOutcome === undefined)
+        return undefined;
+    const payloads = roleOutcome.kind === "accepted" ||
+        roleOutcome.kind === "audit_escalation" ||
+        roleOutcome.kind === "failure"
+        ? roleOutcome.payloads ?? []
+        : [];
+    let latest;
+    for (const payload of payloads) {
+        if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+            continue;
+        }
+        const record = payload;
+        if (!Object.hasOwn(record, "courtTicketNumbers"))
+            continue;
+        const raw = record.courtTicketNumbers;
+        // Only a real array is a candidate set. Non-array is not explicit empty.
+        if (!Array.isArray(raw))
+            continue;
+        // Members only — do not inject principal yet, or all-invalid non-empty becomes [main].
+        const members = projectCourtTicketNumbers(raw);
+        if (members === null)
+            continue;
+        if (members.length === 0) {
+            // Literal [] is the intentional principal-only replace; non-empty garbage is not.
+            if (raw.length === 0) {
+                latest = projectCourtTicketNumbers([], { principalTicket }) ?? undefined;
+            }
+            continue;
+        }
+        latest =
+            projectCourtTicketNumbers(raw, { principalTicket }) ?? undefined;
+    }
+    return latest;
+}
+/** Routing boolean over the child's own typed sequence — does not pick or rewrite a sole row. */
+function courtDiaristEscalated(roleOutcome) {
+    if (roleOutcome === undefined)
+        return false;
+    if (roleOutcome.kind === "audit_escalation")
+        return true;
+    if (roleOutcome.kind !== "accepted")
+        return false;
+    return (roleOutcome.payloads ?? []).some((payload) => {
+        if (typeof payload !== "object" || payload === null || Array.isArray(payload))
+            return false;
+        const record = payload;
+        return record.status === "escalate" || record.countersignStatus === "escalate";
+    });
+}
+/**
+ * Invoke public 起居郎 under the court-pipeline quiet face.
+ * Returns typed identity: ticket assertion, true-unbound, or escalate.
+ * Non-zero exit without escalate status is not rethrown here — caller decides
+ * whether refresh must fail or first-entry settles controlled failure.
+ * When `boundTicketNumber` is set (typed handoff from countersign), diarist
+ * binds under that key before the turn — never mechanical recognition from prose.
+ */
+export async function invokeCourtDiarist(input, env, io) {
+    // Quiet face: the countersign caller must not see diarist CLI chatter.
+    const quietIo = {
+        stdout() { },
+        stderr(text) {
+            // Surface nested failures onto the parent stderr only; no success noise.
+            if (text.trim() !== "")
+                io.stderr(text);
+        },
+    };
+    const { summonPublicRole } = await import("../public-role-summons.js");
+    const result = await summonPublicRole({
+        role: "diarist",
+        argv: [
+            "--project",
+            input.projectRoot,
+            ...(input.attachmentPaths ?? []).flatMap((path) => ["--attach", path]),
+            "--",
+            input.instruction,
+        ],
+        cwd: env.cwd,
+        home: env.home,
+        agentDir: env.agentDir,
+        packageRoot: env.packageRoot,
+        io: quietIo,
+        ...(env.credentials === undefined ? {} : { credentials: env.credentials }),
+        ...(env.signal === undefined ? {} : { signal: env.signal }),
+        ...(input.correlationId === undefined ? {} : { correlationId: input.correlationId }),
+        ...(input.boundTicketNumber === undefined
+            ? {}
+            : { boundTicketNumber: input.boundTicketNumber }),
+        // Child seat selects from the composition-root table. Do not pass the
+        // already-selected parent adapter (#840 / ADR 0082: --host 旗标>席位配置>缺省 pi).
+        ...(env.hostAdapters === undefined ? {} : { hostAdapters: env.hostAdapters }),
+    });
+    const roleOutcome = result.terminal?.roleOutcome;
+    // Escalate routing is a boolean over the preserved sequence (#881). Reasons and
+    // payload bodies stay on roleOutcome — never rewritten into a sole identity reason.
+    if (courtDiaristEscalated(roleOutcome)) {
+        return {
+            identity: { kind: "escalate" },
+        };
+    }
+    if (result.exitCode !== 0) {
+        const diagnostic = roleOutcome?.kind === "failure"
+            ? roleOutcome.diagnostic
+            : result.stderr?.trim() || `exit ${result.exitCode}`;
+        return {
+            identity: { kind: "unbound" },
+            failedWithoutEscalate: {
+                diagnostic: `court diarist station failed for ${input.failureLabel}: ${diagnostic}`,
+            },
+        };
+    }
+    const asserted = result.admitted?.ticketNumber;
+    if (isSafePositiveTicketNumber(asserted)) {
+        const courtTicketNumbers = courtTicketNumbersFromOutcome(roleOutcome, asserted);
+        return {
+            identity: {
+                kind: "ticket",
+                ticketNumber: asserted,
+                ...(courtTicketNumbers === undefined ? {} : { courtTicketNumbers }),
+            },
+        };
+    }
+    return {
+        identity: { kind: "unbound" },
+    };
+}
+/**
+ * Court-pipeline prior station: refresh this ticket's 起居录 before the
+ * countersign body turn when already bound (ADR 0075 每次过庭都跑)。
+ * Caller-invisible — no diarist argv on the countersign command line.
+ *
+ * Missing ticketNumber (true-unbound / identity deferred) skips the refresh
+ * station — no diary is minted for a true-unbound run. First-entry identity
+ * lives on `runPublicCountersign` (typed 起居郎 key for bind + same-ticket
+ * resume). Bound refresh: 起居郎 failure propagates (失败诚实).
+ * Path delivery onto materials is not this station's job — post-admission owns it.
+ */
+export async function runCountersignCourtDiaristStation(admitted, env, io) {
+    if (env.runCourtDiaristStation !== undefined) {
+        await env.runCourtDiaristStation(admitted);
+        return;
+    }
+    // Production court refresh (ADR 0075: 每次过庭都跑是调用者用法) only under a known ticket identity.
+    // First-entry unbound identity is owned by runPublicCountersign.
+    if (admitted.ticketNumber === undefined)
+        return;
+    // #871: refresh every member of the typed co-review set; single-ticket face
+    // is just the set [main]. Present-but-empty / missing-principal is damage —
+    // never silently fall back to main-only (legacy absent field still may).
+    let refreshTickets;
+    if (admitted.courtTicketNumbers !== undefined) {
+        if (admitted.courtTicketNumbers.length === 0 ||
+            !admitted.courtTicketNumbers.includes(admitted.ticketNumber)) {
+            throw new StationChildExhaustedError(`court diarist station: courtTicketNumbers is damaged (empty or missing principal #${admitted.ticketNumber})`);
+        }
+        refreshTickets = admitted.courtTicketNumbers;
+    }
+    else {
+        refreshTickets = [admitted.ticketNumber];
+    }
+    for (const ticketNumber of refreshTickets) {
+        const outcome = await invokeCourtDiarist({
+            instruction: `整理 #${ticketNumber} 的本案依据。`,
+            projectRoot: admitted.projectRoot,
+            failureLabel: `ticket #${ticketNumber}`,
+            correlationId: admitted.runId,
+            // Refresh holds a typed key — hand it off so identity is bound before turn.
+            boundTicketNumber: ticketNumber,
+        }, env, io);
+        if (outcome.identity.kind === "escalate") {
+            throw new StationChildExhaustedError("court diarist station escalated (cannot identify court target)");
+        }
+        if (outcome.failedWithoutEscalate !== undefined) {
+            throw new StationChildExhaustedError(outcome.failedWithoutEscalate.diagnostic);
+        }
+    }
+}
+export async function runPublicCountersign(argv, env, io, parseCountersignArgv) {
+    let parsed;
+    try {
+        parsed = parseCountersignArgv(argv);
+    }
+    catch (error) {
+        if (error instanceof CliUsageError) {
+            presentStructuralRejection(error, io);
+            return { exitCode: 2 };
+        }
+        throw error;
+    }
+    let admitted;
+    try {
+        admitted = await admitCountersignInvocation({
+            home: env.home,
+            principalAuthority: env.principalAuthority,
+            cwd: env.cwd,
+            instruction: parsed.instruction,
+            attachmentPaths: parsed.attachmentPaths,
+            ...(parsed.project === undefined ? {} : { project: parsed.project }),
+            ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
+            ...(env.model === undefined ? {} : { model: env.model }),
+            ...(env.correlationId === undefined ? {} : { correlationId: env.correlationId }),
+        });
+    }
+    catch (error) {
+        if (error instanceof CliUsageError) {
+            presentStructuralRejection(error, io);
+            return { exitCode: 2 };
+        }
+        throw error;
+    }
+    await markRunAdmitted(admitted, env.principalAuthority);
+    // #637 / #771 / ADR 0079: ticket identity is the 起居郎 LLM typed assertion
+    // (never mechanical matching of summons text). Resolve that typed key after
+    // admit so the countersign run page exists first; same-ticket re-summons
+    // resume the prior run on the typed key (unused mint is abandoned). The test
+    // seam `runCourtDiaristStation` defers identity to beforeDispatch; generic
+    // hook failures stay on the parent call-local budget, exhausted nested
+    // station children still skip parent auto-resume (#840 父子不层叠).
+    let typedTicket;
+    let typedCourtTicketNumbers;
+    let identityDiaristRan = false;
+    if (env.runCourtDiaristStation === undefined) {
+        const outcome = await invokeCourtDiarist({
+            instruction: parsed.instruction,
+            projectRoot: admitted.projectRoot,
+            failureLabel: "unbound summons",
+            correlationId: admitted.runId,
+        }, env, io);
+        identityDiaristRan = true;
+        if (outcome.identity.kind === "escalate") {
+            // 御批: 识别不了就上抛 — settle on the admitted countersign run.
+            return await presentControlledFailure(admitted, {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: new Error("court diarist station escalated (cannot identify court target)"),
+            }, countersignAdapters(), env.principalAuthority, io);
+        }
+        // Typed failure terminal (verification / infra / non-zero without escalate)
+        // is not 真无票 — settle controlled failure on the admitted run (失败诚实).
+        // Only a true missing lawful typed terminal keeps the r5 unbound-continue.
+        if (outcome.failedWithoutEscalate !== undefined) {
+            return await presentControlledFailure(admitted, {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: new Error(outcome.failedWithoutEscalate.diagnostic),
+            }, countersignAdapters(), env.principalAuthority, io);
+        }
+        // Missing lawful 起居郎 terminal is not countersign body failure: leave
+        // unbound and continue (true-unbound face). Escalate / typed failure above;
+        // bound refresh still fails honest via runCountersignCourtDiaristStation.
+        if (outcome.identity.kind === "ticket") {
+            const assertedTicket = outcome.identity.ticketNumber;
+            typedTicket = assertedTicket;
+            // #871: identity may hand a co-review set; absent field defaults to [main].
+            typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
+            const summons = {
+                instruction: parsed.instruction,
+                instructionEmpty: parsed.instruction.trim() === "",
+                attachmentPaths: parsed.attachmentPaths,
+            };
+            const resumed = await tryResumeSameTicketSeatRun({
+                home: env.home,
+                projectRoot: admitted.projectRoot,
+                role: "countersign",
+                ticketNumber: typedTicket,
+                freshSummons: env.freshSummons,
+                summons,
+                resume: async (runId, materials) => {
+                    // Resume selected: file the provisional run under the asserted ticket
+                    // before abandoning it, so typed identity never leaves an unbound row.
+                    await bindAdmittedTicketNumber(admitted, assertedTicket);
+                    await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+                    await markRunTerminal(admitted.runDirectory);
+                    // Identity 起居郎 asserted unbound (no issue face). Resume still runs
+                    // the bound refresh station under the typed key (ADR 0075: 每次过庭都跑是调用者用法).
+                    // #871: hand the identity set so resume can whole-replace the run fact
+                    // when this summons produced a new typed set (never union).
+                    return await runPublicCountersignResume({
+                        runId,
+                        ...(materials === undefined ? {} : { summons: materials }),
+                    }, {
+                        ...env,
+                        ...(typedCourtTicketNumbers === undefined
+                            ? {}
+                            : { pendingCourtTicketNumbers: typedCourtTicketNumbers }),
+                    }, io);
+                },
+            });
+            if (resumed !== undefined) {
+                return resumed;
+            }
+        }
+    }
+    if (identityDiaristRan && typedTicket !== undefined) {
+        try {
+            await bindAdmittedTicketNumber(admitted, typedTicket);
+            await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+            // First court: explicit set wins; omitted field → single-ticket face [main].
+            // Set persistence is outside beforeDispatch — route write failures into the
+            // same controlled-failure settlement as station children (#871 B7).
+            await bindCourtTicketNumbersOnAdmitted(admitted, typedCourtTicketNumbers ?? [typedTicket]);
+        }
+        catch (error) {
+            return await presentControlledFailure(admitted, {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: error,
+            }, countersignAdapters(), env.principalAuthority, io);
+        }
+    }
+    const turnProjection = {
+        packageRoot: env.packageRoot,
+        home: env.home,
+        agentDir: env.agentDir,
+        ...(env.model === undefined ? {} : { model: env.model }),
+        ...pickEngineAxis(env),
+        ...(env.timeoutMs === undefined ? {} : { timeoutMs: env.timeoutMs }),
+        ...(env.correlationId === undefined || env.correlationId.trim() === ""
+            ? {}
+            : { correlationId: env.correlationId }),
+        continuation: {
+            kind: "initial",
+            prompt: buildCountersignTransportPrompt(admitted, engineSessionMaterialFromOptions({
+                ...pickEngineAxis(env),
+                packageRoot: env.packageRoot,
+            })),
+        },
+    };
+    // Mutable shell: ticket bind re-projects activation before executeTurn.
+    const turnRequest = buildCountersignTurnRequest(admitted, turnProjection);
+    const result = await runPostAdmissionOneShot({
+        admitted,
+        env,
+        io,
+        request: turnRequest,
+        adapters: countersignAdapters({
+            beforeDispatch: async (admittedSeat, lease) => {
+                // Dossier pointer delivery rides post-admission after this hook (#709).
+                if (!identityDiaristRan) {
+                    // Test seam (or any deferred identity): station owns assert + bind.
+                    await runCountersignCourtDiaristStation(admittedSeat, env, io);
+                }
+                else if (typedTicket !== undefined) {
+                    await runCountersignCourtDiaristStation(admittedSeat, env, io);
+                }
+                await relocateAdmittedRunToTicket(admittedSeat, env.principalAuthority, lease);
+                Object.assign(turnRequest, buildCountersignTurnRequest(admittedSeat, turnProjection));
+            },
+        }),
+        ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
+    });
+    await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+    return result;
+}
+function countersignAdapters(options) {
+    return {
+        trySettle: (admitted, authority, scope) => trySettleCountersignTerminalResult(admitted, authority, scope),
+        // Accepted receipts and failure terminals both present via shared path.
+        shouldPresentSettled: () => true,
+        ...(options?.beforeDispatch === undefined
+            ? {}
+            : { beforeDispatch: options.beforeDispatch }),
+    };
+}
+/**
+ * Resume a previously admitted Countersign run (#599 / DK-3 / #637).
+ * Restores role/ticket/session identity. Bound court re-entry runs the diarist
+ * refresh station first (ADR 0075 每次过庭都跑); unbound skips refresh.
+ * Same-ticket summons deliver this turn's instruction + frozen attachments on
+ * the resume prompt; manual resume keeps package-envelope / caller-message
+ * semantics and birth attachments. 起居录 path delivery remains post-admission's
+ * single mount (#709).
+ */
+export async function runPublicCountersignResume(request, env, io) {
+    return await runPostAdmissionSeatResume({
+        request,
+        env,
+        io,
+        load: (effective) => loadResumableCountersignRun(env.home, effective.runId, env.principalAuthority),
+        buildTurnRequest: async (admitted, effective) => {
+            const summonsPrepared = await prepareSummonsResumeMaterials(admitted.runDirectory, effective.summons);
+            return buildCountersignTurnRequest(admitted, resumeTurnRequestProjectionOptions(admitted, effective, env, summonsPrepared));
+        },
+        adapters: countersignAdapters({
+            beforeDispatch: async (admitted) => {
+                // #871 B7: durable set damage already identified at load — settle as
+                // station-child exhausted → presentControlledFailure (not structural exit 2).
+                if (admitted.courtTicketNumbersDamage !== undefined) {
+                    throw new StationChildExhaustedError(admitted.courtTicketNumbersDamage);
+                }
+                // #871: same-ticket re-summons may hand a fresh typed set from identity.
+                // Whole-set replace onto this run fact; no new set → keep stored set.
+                // Manual resume (no pending) keeps the durable set and never invents one.
+                if (env.pendingCourtTicketNumbers !== undefined) {
+                    await bindCourtTicketNumbersOnAdmitted(admitted, env.pendingCourtTicketNumbers);
+                }
+                await runCountersignCourtDiaristStation(admitted, env, io);
+            },
+        }),
+        ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
+    });
+}

package/dist/public-cli/invocation.js

@@ -445,6 +445,9 @@ export function parseAuditorArgv(args) {
 export function parseDiaristArgv(args) {
     return parseInstructionArgv(args, "diarist");
 }
+export function parseSecretariatArgv(args) {
+    return parseInstructionArgv(args, "secretariat");
+}
 /**
  * Parse Coder-specific argv after the `coder` token.
  * Phase defaults to apply; spellings from PUBLIC_OPTION_TABLE.coder (#342).
@@ -706,6 +709,10 @@ export async function admitAuditorInvocation(options) {
 export async function admitDiaristInvocation(options) {
     return admitStandardMaterialInvocation("diarist", options);
 }
+/** Admit a public Secretariat (中书省) run (#924). */
+export async function admitSecretariatInvocation(options) {
+    return admitStandardMaterialInvocation("secretariat", options);
+}
 /** Shared prompt transport for instruction-seat roles (judge/countersign/inspector). */
 export function buildInstructionTransportPrompt(admitted, engineMaterial) {
     const lines = [admitted.instructionEmpty ? "" : admitted.instruction];
@@ -722,6 +729,9 @@ export function buildInstructionTransportPrompt(admitted, engineMaterial) {
 export function buildJudgeTransportPrompt(admitted, engineMaterial) {
     return buildInstructionTransportPrompt(admitted, engineMaterial);
 }
+export function buildSecretariatTransportPrompt(admitted, engineMaterial) {
+    return buildInstructionTransportPrompt(admitted, engineMaterial);
+}
 export function buildInspectorTransportPrompt(admitted, engineMaterial) {
     return buildInstructionTransportPrompt(admitted, engineMaterial);
 }