@akagilnc/pi-workflow-roles 0.1.4321 → 0.1.4387

package/src/gatekeeper-pass-envelope.ts

@@ -14,7 +14,7 @@
  */
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { bookDirectOfficerRunPointer } from "./archivist-record-entry.ts";
-import type { HostContext } from "./host-contracts.ts";
+import type { HostContext, RoleTurnHost } from "./host-contracts.ts";
 import {
   GatekeeperDecisionError,
   OFFICER_CONCLUSION_REASK,
@@ -28,6 +28,34 @@ import {
 import type { PublicSummonResult } from "./public-role-summons.ts";
 import { sessionFileFromPublicSummon } from "./session-assistant-usage.ts";
 
+/**
+ * Shared-envelope default officer summon (ADR 0018).
+ * Role modules must not own this drive seam — only project results.
+ */
+export function createDefaultGateOfficerSummon(options: {
+  readonly cwd: string;
+  readonly home?: string;
+  readonly packageRoot?: string;
+  readonly roleTurnHost?: RoleTurnHost;
+  readonly createRunId?: () => string;
+}): GateOfficerSummon {
+  return async (officer, sourceRunDirectory, signal, reask, submission) => {
+    const { summonGateOfficer } = await import("./public-role-summons.ts");
+    return summonGateOfficer({
+      officer,
+      sourceRunDirectory,
+      cwd: options.cwd,
+      ...(signal === undefined ? {} : { signal }),
+      ...(reask === undefined ? {} : { reask }),
+      ...(submission === undefined ? {} : { submission }),
+      ...(options.home === undefined ? {} : { home: options.home }),
+      ...(options.packageRoot === undefined ? {} : { packageRoot: options.packageRoot }),
+      ...(options.roleTurnHost === undefined ? {} : { roleTurnHost: options.roleTurnHost }),
+      ...(options.createRunId === undefined ? {} : { createRunId: options.createRunId }),
+    });
+  };
+}
+
 /**
  * Book a typed pointer under parent session/auditor-roles (archivist-owned write).
  * Offline mocks without a real session leave no nested volume (lawful zero).
@@ -84,12 +112,17 @@ export async function requireGatekeeperPass(options: {
 }): Promise<void> {
   let reask: string | undefined;
   // No round cap — end only on pass, bounce/escalate-to-parent, or real failure.
+  const summonOfficer =
+    options.summonOfficer ??
+    createDefaultGateOfficerSummon({
+      cwd: options.context.cwd ?? process.cwd(),
+    });
   for (;;) {
     const projected = await projectGatekeeperRun({
       context: options.context,
       subject: options.subject,
+      summonOfficer,
       ...(options.signal === undefined ? {} : { signal: options.signal }),
-      ...(options.summonOfficer === undefined ? {} : { summonOfficer: options.summonOfficer }),
       ...(options.submission === undefined ? {} : { submission: options.submission }),
       ...(reask === undefined ? {} : { reask }),
     });

package/src/gatekeeper-role.ts

@@ -111,18 +111,11 @@ export type RunGatekeeperOptions = {
    */
   readonly submission?: unknown;
   /**
-   * Test seam for public-role summons. Production calls the shared public
-   * activation path (#675); inject only in offline tracers.
+   * Officer summon seam. Production default lives on the shared envelope
+   * (`createDefaultGateOfficerSummon` / requireGatekeeperPass — ADR 0018).
+   * Role module only projects; callers must supply the summon.
    */
-  readonly summonOfficer?: GateOfficerSummon;
-  /**
-   * Offline test injects forwarded through the production default summonGateOfficer
-   * path (same faces as public CLI). Production leaves these unset.
-   */
-  readonly home?: string;
-  readonly packageRoot?: string;
-  readonly roleTurnHost?: import("./host-contracts.ts").RoleTurnHost;
-  readonly createRunId?: () => string;
+  readonly summonOfficer: GateOfficerSummon;
 };
 
 export type GatekeeperPassHostActions = {
@@ -323,8 +316,9 @@ export const OFFICER_CONCLUSION_REASK =
   "上次交卷的结论不是 pass、bounce、escalate 三态之一。请重新输出，结论字段写明其一；打回或上呈的话就是给对方看的原文。" as const;
 
 /**
- * Summon + project only. Lifecycle book and host abort face live on the shared
- * submit envelope (`gatekeeper-pass-envelope.ts`, ADR 0018 / #675).
+ * Summon (via injected seam) + project. Default summonGateOfficer drive lives
+ * on the shared envelope (`gatekeeper-pass-envelope.ts`, ADR 0018 / #675) —
+ * role module keeps projection only.
  */
 export async function projectGatekeeperRun(
   options: RunGatekeeperOptions,
@@ -345,24 +339,7 @@ export async function projectGatekeeperRun(
   // typed payload passed explicitly (never latest-toolCall recovery, A7.1–A7.3).
   let summoned: PublicSummonResult;
   try {
-    const summon =
-      options.summonOfficer
-      ?? (async (nextOfficer, sourceRunDirectory, officerSignal, reask, nextSubmission) => {
-        const { summonGateOfficer } = await import("./public-role-summons.ts");
-        return summonGateOfficer({
-          officer: nextOfficer,
-          sourceRunDirectory,
-          cwd: options.context.cwd ?? process.cwd(),
-          ...(officerSignal === undefined ? {} : { signal: officerSignal }),
-          ...(reask === undefined ? {} : { reask }),
-          ...(nextSubmission === undefined ? {} : { submission: nextSubmission }),
-          ...(options.home === undefined ? {} : { home: options.home }),
-          ...(options.packageRoot === undefined ? {} : { packageRoot: options.packageRoot }),
-          ...(options.roleTurnHost === undefined ? {} : { roleTurnHost: options.roleTurnHost }),
-          ...(options.createRunId === undefined ? {} : { createRunId: options.createRunId }),
-        });
-      });
-    summoned = await summon(
+    summoned = await options.summonOfficer(
       officer,
       runDirectory,
       options.signal,

package/src/gleaner-left-role.ts

@@ -2,7 +2,7 @@ import type { Static } from "typebox";
 import { Type } from "typebox";
 
 import { openToolObject } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 import {
   GLEANER_LEFT_OUTPUT_TOOL_NAME,
   validateRecordedGleanerLeftOutput,
@@ -19,7 +19,7 @@ export { validateRecordedGleanerLeftOutput };
 // #836 r16 class 1: pointer/statement are LLM/human-read narrative content — no
 // code branches on their presence.
 /** 左拾遗弹章交卷形状；形状指引，非 schema 闸。 */
-export const gleanerLeftOutputSchema = withInfrastructureFailureDeclaration(
+export const gleanerLeftOutputSchema = withTerminatingOutputDeclarations(
   openToolObject(
     Type.Object({
       status: Type.Unknown({

package/src/host-contracts.ts

@@ -134,7 +134,8 @@ export type RoleTurnActivation =
   | { readonly role: "gatekeeper" }
   | { readonly role: "navigator" }
   | { readonly role: "auditor" }
-  | { readonly role: "diarist" };
+  | { readonly role: "diarist" }
+  | { readonly role: "secretariat" };
 
 export type RoleTurnContinuation =
   | { readonly kind: "initial"; readonly prompt: string }

package/src/inspector-role.ts

@@ -2,7 +2,7 @@ import type { Static } from "typebox";
 import { Type } from "typebox";
 
 import { openToolObject } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 import {
   INSPECTOR_ACCEPTED_TEXT,
   INSPECTOR_OUTPUT_TOOL_NAME,
@@ -19,7 +19,7 @@ export type { InspectorOutput };
 export { validateRecordedInspectorOutput };
 
 /** 台院事后察举交卷形状；形状指引，非 schema 闸。 */
-export const inspectorOutputSchema = withInfrastructureFailureDeclaration(
+export const inspectorOutputSchema = withTerminatingOutputDeclarations(
   openToolObject(
     Type.Object({
       status: Type.Unknown({

package/src/judge-role.ts

@@ -1,7 +1,7 @@
 import type { RoleHost, HostContext, HostToolResult, HostGatekeeperActions } from "./host-contracts.ts";
 import { Type, type Static } from "typebox";
 
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 import { ParentQueueReaskError } from "./submission-errors.ts";
 
 import {
@@ -25,7 +25,7 @@ export type { JudgeVerdict };
 // #836 (ADR 0003 Amendment): judgeStatus kept open like countersignStatus
 // (src/countersign-role.ts) — a closed domain here would reject an unknown
 // value before the rawStatus/ParentQueueReaskError check below ever runs.
-export const judgeVerdictSchema = withInfrastructureFailureDeclaration(
+export const judgeVerdictSchema = withTerminatingOutputDeclarations(
   Type.Object(
     {
       judgeStatus: Type.Unknown({ description: "converged | continue | escalate — 形状指引，非 schema 闸" }),

package/src/merger-contracts.ts

@@ -1,7 +1,7 @@
 import { Type, type Static } from "typebox";
 import { exactUtf8 } from "./exact-utf8.ts";
 import { openToolObjectFromUnion } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 
 const materialSchema = Type.Object({ bytesBase64: Type.String(), sha256: Type.String() }, { additionalProperties: false });
 const checkSchema = Type.Object({ name: Type.String({ minLength: 1 }), argv: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }) }, { additionalProperties: false });
@@ -25,7 +25,7 @@ const mergerOutputVariants = Type.Union([
   Type.Object({ status: Type.Unknown({ description: MERGER_STATUS_DESCRIPTION }), attemptId: Type.String({ description: "已受理合并 attempt 身份" }), report: Type.String({ description: "如实结果报告" }), mergeCommitId: Type.String({ description: "完成合并 commit object ID" }) }, { additionalProperties: false }),
   Type.Object({ status: Type.Unknown({ description: MERGER_STATUS_DESCRIPTION }), attemptId: Type.String({ description: "已受理合并 attempt 身份" }), diagnosis: Type.String({ description: "合并无法或不应由本席完成的原因（含无进行中合并、无活可干、需新的产品/权力决定）" }), report: Type.String({ description: "如实结果报告" }) }, { additionalProperties: false }),
 ]);
-export const mergerOutputSchema = withInfrastructureFailureDeclaration(openToolObjectFromUnion(mergerOutputVariants));
+export const mergerOutputSchema = withTerminatingOutputDeclarations(openToolObjectFromUnion(mergerOutputVariants));
 
 export type DeepReadonly<T> = T extends (...args: never[]) => unknown ? T : T extends readonly (infer U)[] ? readonly DeepReadonly<U>[] : T extends object ? { readonly [K in keyof T]: DeepReadonly<T[K]> } : T;
 export type MergerMaterial = DeepReadonly<Static<typeof materialSchema>>;

package/src/notary-contracts.ts

@@ -6,7 +6,7 @@
 import { Type } from "typebox";
 
 import { openToolObject } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 
 export const NOTARY_OUTPUT_TOOL_NAME = "ak_notary_output";
 export const NOTARY_ACCEPTED_TEXT = "符宝郎回执已接受";
@@ -31,7 +31,7 @@ export const NOTARY_TICKET_FLAG = {
 export const NOTARY_FIXED_KICKOFF =
   "符宝郎案卷已受理；来源 run 定位见会话材料。";
 
-export const notaryOutputSchema = withInfrastructureFailureDeclaration(
+export const notaryOutputSchema = withTerminatingOutputDeclarations(
   openToolObject(
     Type.Object({
       status: Type.Unknown({

package/src/package-contracts/auditor-output.ts

@@ -5,12 +5,12 @@
 import { Type } from "typebox";
 
 import { openToolObject } from "../open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./terminating-infrastructure.ts";
 
 export const AUDITOR_OUTPUT_TOOL_NAME = "ak_auditor_output" as const;
 export const AUDITOR_ACCEPTED_TEXT = "审刑院回执已接受";
 
-export const auditorOutputSchema = withInfrastructureFailureDeclaration(
+export const auditorOutputSchema = withTerminatingOutputDeclarations(
   openToolObject(
     Type.Object({
       status: Type.Unknown({

package/src/package-contracts/fixer-output.ts

@@ -1,6 +1,6 @@
 import { Type, type Static } from "typebox";
 import { openToolObjectFromUnion } from "../open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./terminating-infrastructure.ts";
 
 export const FIXER_OUTPUT_TOOL_NAME = "ak_fixer_output";
 export const FIXER_ACCEPTED_TEXT = "修内司回执已接受";
@@ -51,7 +51,7 @@ const fixerOutputVariants = Type.Union([
   Type.Object({ status: Type.Unknown({ description: FIXER_STATUS_DESCRIPTION }), report: Type.String({ description: "如实结果报告" }), classResults: Type.Array(classResultSchema, { description: "各类拒绝结算" }) }),
   Type.Object({ status: Type.Unknown({ description: FIXER_STATUS_DESCRIPTION }), report: Type.String({ description: "如实结果报告" }), classResults: Type.Array(classResultSchema, { description: "各类完成或拒绝结算" }), testEvidence: Type.Optional(testEvidenceSchema) }),
 ]);
-export const fixerOutputSchema = withInfrastructureFailureDeclaration(
+export const fixerOutputSchema = withTerminatingOutputDeclarations(
   openToolObjectFromUnion(fixerOutputVariants),
 );
 

package/src/package-contracts/gatekeeper-output.ts

@@ -6,7 +6,7 @@
 import { Type } from "typebox";
 
 import { openToolObject } from "../open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./terminating-infrastructure.ts";
 
 export const GATEKEEPER_OUTPUT_TOOL_NAME = "ak_gatekeeper_output";
 export const GATEKEEPER_ACCEPTED_TEXT = "门下省决议已受理";
@@ -26,7 +26,7 @@ export const gatekeeperDecisionSchema = openToolObject(
   }),
 );
 
-export const gatekeeperOutputSchema = withInfrastructureFailureDeclaration(
+export const gatekeeperOutputSchema = withTerminatingOutputDeclarations(
   gatekeeperDecisionSchema,
 );
 

package/src/package-contracts/navigator-output.ts

@@ -7,12 +7,12 @@
 import { Type } from "typebox";
 
 import { openToolObject } from "../open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./terminating-infrastructure.ts";
 
 export const NAVIGATOR_OUTPUT_TOOL_NAME = "ak_navigator_output";
 export const NAVIGATOR_ACCEPTED_TEXT = "游奕使建议已受理";
 
-export const navigatorOutputSchema = withInfrastructureFailureDeclaration(
+export const navigatorOutputSchema = withTerminatingOutputDeclarations(
   openToolObject(
     Type.Object({
       status: Type.Unknown({

package/src/package-contracts/terminating-infrastructure.ts

@@ -49,19 +49,29 @@ const infrastructureFailureDeclarationSchema = Type.Object(
 );
 
 /**
- * Compose the shared infrastructure-failure declaration into an open output
- * tool-object schema. Returns an open object (additionalProperties: true,
+ * Compose declarations shared by terminating output tools: infrastructure failure
+ * and the optional role-asserted ticket identity. Returns an open object (additionalProperties: true,
  * required: []) with the base schema's properties plus the shared declaration.
  * Static typing is preserved on the base (`as S`), so existing
  * `Static<typeof ...>` derived parameter types are unchanged.
  */
-export function withInfrastructureFailureDeclaration<
+export function withTerminatingOutputDeclarations<
   S extends TSchema & { properties?: Record<string, TSchema> },
 >(schema: S): S {
   const baseProperties = (schema as { properties?: Record<string, TSchema> })
     .properties;
   const properties: Record<string, TSchema> = {
     ...(baseProperties ?? {}),
+    ...(
+      baseProperties?.ticketNumber === undefined
+        ? {
+            ticketNumber: Type.Unknown({
+              description:
+                "可选本票号：尚未绑定时由角色在既有回执中申报；机械层只记录合法正整数，不从散文推导、不验真。缺失或错形不拒收。",
+            }),
+          }
+        : {}
+    ),
     [INFRASTRUCTURE_FAILURE_DECLARATION_KEY]:
       infrastructureFailureDeclarationSchema.properties[
         INFRASTRUCTURE_FAILURE_DECLARATION_KEY

package/src/package-contracts/terminating-tools.ts

@@ -32,6 +32,7 @@ import { COUNTERSIGN_ACCEPTED_TEXT, COUNTERSIGN_OUTPUT_TOOL_NAME, validateRecord
 import { GLEANER_LEFT_ACCEPTED_TEXT, GLEANER_LEFT_OUTPUT_TOOL_NAME, validateRecordedGleanerLeftOutput, type GleanerLeftOutput } from "../gleaner-left-contracts.ts";
 import { INSPECTOR_ACCEPTED_TEXT, INSPECTOR_OUTPUT_TOOL_NAME, validateRecordedInspectorOutput, type InspectorOutput } from "../inspector-contracts.ts";
 import { DIARIST_ACCEPTED_TEXT, DIARIST_OUTPUT_TOOL_NAME, validateRecordedDiaristOutput, type DiaristOutput } from "../diarist-contracts.ts";
+import { SECRETARIAT_ACCEPTED_TEXT, SECRETARIAT_OUTPUT_TOOL_NAME, type SecretariatVerdict } from "../secretariat-contracts.ts";
 import {
   CODER_ACCEPTED_TEXT,
   CODER_OUTPUT_TOOL_NAME,
@@ -86,6 +87,7 @@ export type {
   NavigatorAdvice,
   AuditorOutput,
   DiaristOutput,
+  SecretariatVerdict,
 };
 
 export const TERMINATING_TOOL_NAMES = [
@@ -104,6 +106,7 @@ export const TERMINATING_TOOL_NAMES = [
   NAVIGATOR_OUTPUT_TOOL_NAME,
   AUDITOR_OUTPUT_TOOL_NAME,
   DIARIST_OUTPUT_TOOL_NAME,
+  SECRETARIAT_OUTPUT_TOOL_NAME,
 ] as const;
 
 export type TerminatingToolName = (typeof TERMINATING_TOOL_NAMES)[number];
@@ -122,7 +125,8 @@ export type AcceptedDetails =
   | GatekeeperDirectOutput
   | NavigatorAdvice
   | AuditorOutput
-  | DiaristOutput;
+  | DiaristOutput
+  | SecretariatVerdict;
 
 export function isTerminatingToolName(
   name: string,
@@ -162,6 +166,8 @@ export function acceptedTextFor(toolName: TerminatingToolName): string {
       return AUDITOR_ACCEPTED_TEXT;
     case DIARIST_OUTPUT_TOOL_NAME:
       return DIARIST_ACCEPTED_TEXT;
+    case SECRETARIAT_OUTPUT_TOOL_NAME:
+      return SECRETARIAT_ACCEPTED_TEXT;
   }
 }
 
@@ -214,6 +220,8 @@ export function acceptedFacts(toolName: TerminatingToolName, details: AcceptedDe
       return typeof record.judgeStatus === "string" ? { status: record.judgeStatus } : {};
     case COUNTERSIGN_OUTPUT_TOOL_NAME:
       return typeof record.countersignStatus === "string" ? { status: record.countersignStatus } : {};
+    case SECRETARIAT_OUTPUT_TOOL_NAME:
+      return typeof record.secretariatStatus === "string" ? { status: record.secretariatStatus } : {};
     case MERGER_OUTPUT_TOOL_NAME: {
       const status = typeof record.status === "string" ? record.status : undefined;
       return {

package/src/packaged-role-registry.ts

@@ -13,12 +13,14 @@ import { GLEANER_LEFT_OUTPUT_TOOL_NAME } from "./gleaner-left-contracts.ts";
 import { INSPECTOR_OUTPUT_TOOL_NAME } from "./inspector-contracts.ts";
 import { AUDITOR_OUTPUT_TOOL_NAME } from "./package-contracts/auditor-output.ts";
 import { DIARIST_OUTPUT_TOOL_NAME } from "./diarist-contracts.ts";
+import { SECRETARIAT_OUTPUT_TOOL_NAME } from "./secretariat-contracts.ts";
 
 /** Shared by public notary and gatekeeper-province notary. */
 export const NOTARY_SESSION_MATERIALS = [
   "CLAUDE.md",
   "souls/notary.md",
   "souls/audit-law.md",
+  "souls/ticket-law.md",
   "souls/gate-output-guide.md",
 ] as const;
 
@@ -154,7 +156,24 @@ export const PUBLIC_ROLE_RECORDS = [
     inputFlag: undefined,
     phaseFlag: undefined,
     activationStage: "load-and-install",
-    sessionMaterials: ["CLAUDE.md", "souls/countersign.md"],
+    // #924: 公用《票面法》三席同装
+    sessionMaterials: ["CLAUDE.md", "souls/countersign.md", "souls/ticket-law.md"],
+  },
+  {
+    role: "secretariat",
+    phases: [null],
+    outputTool: SECRETARIAT_OUTPUT_TOOL_NAME,
+    inputFlag: undefined,
+    phaseFlag: undefined,
+    activationStage: "load-and-install",
+    // #924: owner-finalized Soul + 票面法 + 给事中/符宝郎行为指南
+    sessionMaterials: [
+      "CLAUDE.md",
+      "souls/secretariat.md",
+      "souls/ticket-law.md",
+      "souls/countersign.md",
+      "souls/notary.md",
+    ],
   },
   {
     role: "gleaner-left",

package/src/public-cli/case-dossier-delivery.ts

@@ -1,52 +1,66 @@
 /**
- * 系统随案递送本票起居录的中立指针段（ADR 0081：公共入口直接挂案卷，Soul 只说明用途不负责派送；
- * #709 公共入口通用递送与 #742 给事中受理链路同源；
- * 指针输入沿 ADR 0079（指针是绑定材料由代码精准递送），不把卷宗正文塞进提示词）。
- * 只读已有案卷：不刷新、不生成、不校验内容、不新增拒收或停工条件。
+ * 系统随案递送起居录路径的中立指针段（ADR 0081：公共入口直接挂案卷，Soul 只说明用途不负责派送；
+ * #709 公共入口通用递送与 #742 给事中受理链路同源；#858 告诉 LLM 路径，不另建取号/lookup）。
+ * 指针输入沿 ADR 0079（指针是绑定材料由代码精准递送），不把卷宗正文塞进提示词。
+ * 只告诉路径：不刷新、不生成、不校验内容、不新增拒收或停工条件、不从 instruction 抽票号。
  * 机器文本仅中立标识材料（ADR 0073），用途说明归角色材料所有。
  *
  * 递送挂载点唯一：`post-admission` 在 beforeDispatch 之后为每个公共入口挂载。
- * 普通入口把本段追加进 continuation；station-child 审核轮次走 attachments
- * 冻结 + role-runtime `loadCaseDossierReadingMaterial` → readingMaterial →
- * systemPrompt.materials fold（#879：对话 instruction 保持父腿 payload 原文；
- * 起居录作独立附件面，不新造 RoleTurnRequest.materials）。
+ * 全部公共入口（ordinary 已绑定／未绑定与 station-child）统一走 attachments 冻结 +
+ * role-runtime `loadCaseDossierReadingMaterial` → readingMaterial →
+ * systemPrompt.materials fold（#879 / #858：对话 instruction、空请求、resume
+ * message 保持调用者原文；起居录作独立附件面，不新造 RoleTurnRequest.materials，
+ * 不拼进 user-dialogue continuation）。
+ *
+ * #858: deliver returns typed FrozenAttachment[]; load currently re-derives the
+ * freeze leaf under runDirectory because agent-start only has HostContext.runDirectory.
+ * Consuming the typed frozenPath across that process boundary needs a design
+ * revision of the existing envelope/persistence seam — not a local replica of
+ * freezeAttachments' `00-` naming, not a drift throw, not readdir guessing.
  */
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
+import { projectTicketRecordsPathShape } from "../sitian-facade.ts";
 import { resolveTicketProvenanceVolume } from "../ticket-provenance.ts";
 import {
   freezeAttachmentsIntoRun,
   type FrozenAttachment,
 } from "./invocation.ts";
 
-/** Section heading of the system-delivered dossier pointer (presentation only). */
+/** Bound-ticket section heading (presentation only). */
 const CASE_DOSSIER_SECTION_HEADING = "## 本票起居录（系统随案提供）" as const;
 
+/** Unbound path-only heading — no 本票 claim when no typed ticket is on the run. */
+const UNBOUND_DOSSIER_PATH_HEADING = "## 起居录路径（系统随案提供）" as const;
+
 /** Stable freeze key under run/attachments/ for station-child 0081 delivery. */
 const CASE_DOSSIER_ATTACH_KEY = "case-dossier" as const;
 
 /** Leaf name of the frozen pointer section (content = purpose + paths). */
 const CASE_DOSSIER_ATTACH_FILE = "case-dossier-pointer.md" as const;
 
-/** Pointer only — presence/absence is for the role to observe at the path. */
-function describeDossierFile(path: string): string {
-  return path;
-}
-
 /**
- * Pointer section for a bound ticket's existing 起居录, or undefined when the
- * run carries no ticket identity (unbound calls stay legal and get no dossier).
- * A bound ticket whose volume is missing or unreadable is stated as such —
- * the section never claims a dossier that is not there.
+ * Neutral 起居录 path pointer for every public entry (ADR 0081 delivery seam).
+ * Always tells the canonical path shape so the seat LLM can read the diary
+ * itself (陛下 2026-09-15: 只需要告诉llm这个路径). When a typed ticket identity is
+ * already on the run, also project the concrete resolved file. Never claims a
+ * volume or「本票」exists when unbound; never extracts a ticket from instruction.
+ * Under-book shape comes only from sitian writer joins — no local replica.
  */
 export async function projectCaseDossierPointerSection(input: {
   readonly ticketNumber: number | undefined;
   readonly projectRoot: string;
   readonly home: string;
-}): Promise<string | undefined> {
-  if (input.ticketNumber === undefined) return undefined;
+}): Promise<string> {
+  if (input.ticketNumber === undefined) {
+    return [
+      UNBOUND_DOSSIER_PATH_HEADING,
+      "",
+      `记录卷宗：${projectTicketRecordsPathShape()}`,
+    ].join("\n");
+  }
   const volume = resolveTicketProvenanceVolume(
     input.ticketNumber,
     input.projectRoot,
@@ -56,30 +70,30 @@ export async function projectCaseDossierPointerSection(input: {
     CASE_DOSSIER_SECTION_HEADING,
     "",
     `票号：#${input.ticketNumber}`,
-    `记录卷宗：${describeDossierFile(volume.recordFile)}`,
+    `记录卷宗：${volume.recordFile}`,
   ].join("\n");
 }
 
 /**
- * ADR 0081 delivery for station-child officer turns (#879): freeze the same
- * pointer section through the existing attachments seam. Role-runtime loads
- * that freeze via loadCaseDossierReadingMaterial onto readingMaterial; the
- * envelope then folds it into systemPrompt.materials. Peer dialogue instruction
- * stays the parent payload; never RoleTurnRequest.materials.
- * Returns frozen attachments, or undefined when unbound (no dossier).
+ * ADR 0081 delivery for every public entry (#879 / #858): freeze the pointer
+ * section through the existing attachments seam. Role-runtime loads that freeze
+ * via loadCaseDossierReadingMaterial onto readingMaterial; the envelope then
+ * folds it into systemPrompt.materials. Caller / peer dialogue instruction stays
+ * opaque; never RoleTurnRequest.materials, never user-dialogue continuation.
+ * Always freezes the path pointer (canonical shape, or concrete file when a
+ * typed ticket is already bound).
  */
 export async function deliverCaseDossierAsAttachment(input: {
   readonly ticketNumber: number | undefined;
   readonly projectRoot: string;
   readonly home: string;
   readonly runDirectory: string;
-}): Promise<readonly FrozenAttachment[] | undefined> {
+}): Promise<readonly FrozenAttachment[]> {
   const section = await projectCaseDossierPointerSection({
     ticketNumber: input.ticketNumber,
     projectRoot: input.projectRoot,
     home: input.home,
   });
-  if (section === undefined) return undefined;
   // Stage in OS temp only — never leave a run-local .case-dossier-stage copy.
   const stagingDir = await mkdtemp(join(tmpdir(), "ak-case-dossier-"));
   try {
@@ -106,6 +120,11 @@ export type CaseDossierReadingMaterial = {
  * Load a previously frozen case-dossier attachment as reading material
  * (existing agent-start / systemPrompt.materials fold — not dialogue prompt,
  * not RoleTurnRequest.materials). Undefined when the run has no such freeze.
+ *
+ * #858: this join re-derives freezeAttachments' leaf naming because the
+ * agent-start handler only receives runDirectory. Replacing it requires
+ * threading deliver's typed frozenPath across the existing envelope seam
+ * (design revision) — do not copy freeze's `00-` algorithm here again.
  */
 export async function loadCaseDossierReadingMaterial(
   runDirectory: string,

package/src/public-cli/cli.ts

@@ -64,6 +64,7 @@ import {
   parseCollectorArgv,
   parseCountersignArgv,
   parseDiaristArgv,
+  parseSecretariatArgv,
   parseGleanerLeftArgv,
   parseDoctorArgv,
   parseFixerArgv,
@@ -91,6 +92,7 @@ import { runPublicInstructionSeat, runPublicInstructionSeatResume } from "./inst
 import { runPublicCollector, runPublicCollectorResume } from "./collector-run.ts";
 import { runPublicCountersign, runPublicCountersignResume } from "./countersign-run.ts";
 import { runPublicDiarist, runPublicDiaristResume } from "./diarist-run.ts";
+import { runPublicSecretariat, runPublicSecretariatResume } from "./secretariat-run.ts";
 import { runPublicGleanerLeft, runPublicGleanerLeftResume } from "./gleaner-left-run.ts";
 import { runPublicDoctor, runPublicDoctorResume } from "./doctor-run.ts";
 import { runPublicFixer, runPublicFixerResume } from "./fixer-run.ts";
@@ -141,6 +143,7 @@ const RESUME_SEAT_DISPATCH: Record<
   navigator: { seat: "navigator", run: runPublicInstructionSeatResume },
   auditor: { seat: "auditor", run: runPublicInstructionSeatResume },
   diarist: { seat: "diarist", run: runPublicDiaristResume },
+  secretariat: { seat: "secretariat", run: runPublicSecretariatResume },
 };
 import {
   INTERNAL_ROLE_ENTRYPOINT_RELATIVE,
@@ -186,6 +189,7 @@ export const PUBLIC_ROLE_ARGV = {
   navigator: { parse: parseNavigatorArgv, options: optionsForOwner("navigator") },
   auditor: { parse: parseAuditorArgv, options: optionsForOwner("auditor") },
   diarist: { parse: parseDiaristArgv, options: optionsForOwner("diarist") },
+  secretariat: { parse: parseSecretariatArgv, options: optionsForOwner("secretariat") },
   /** Deterministic analysis seat (#336) — argv parse only; no LLM admission. */
   analyst: { parse: parseAnalystArgv, options: optionsForOwner("analyst") },
 } as const;
@@ -1349,6 +1353,12 @@ export async function runAkRole(
         (args, roleEnv, once) => runPublicDiarist(args, roleEnv, io, once),
       );
     }
+    if (parsed.command === "secretariat") {
+      return await dispatchPublicRoleCommand(
+        env, home, io, parsed, "secretariat", PUBLIC_ROLE_ARGV.secretariat.parse,
+        (args, roleEnv, once) => runPublicSecretariat(args, roleEnv, io, once),
+      );
+    }
     if (parsed.command === "coder") {
       return await dispatchPublicRoleCommand(
         env, home, io, parsed, "coder", PUBLIC_ROLE_ARGV.coder.parse,