@akagilnc/pi-workflow-roles 0.1.4444 → 0.1.4503

package/dist/acp-host/production-host.js

@@ -1521,10 +1521,10 @@ __export(session_assistant_usage_exports, {
 });
 import { join as join8 } from "node:path";
 async function readAssistantUsageFromSessionFile(sessionFile) {
-  const { readFile: readFile24 } = await import("node:fs/promises");
+  const { readFile: readFile23 } = await import("node:fs/promises");
   let text;
   try {
-    text = await readFile24(sessionFile, "utf8");
+    text = await readFile23(sessionFile, "utf8");
   } catch (error) {
     if (error?.code === "ENOENT") return void 0;
     throw error;
@@ -3498,13 +3498,10 @@ function assertRegisteredHostName(host) {
   }
   throw new Error(`unregistered host: ${host}`);
 }
-var PRIVATE_COMPAT_ENV, DEFAULT_ROLE_TURN_HOST, HOST_DESCRIPTIONS, HEADLESS_HOST_DESCRIPTIONS;
+var DEFAULT_ROLE_TURN_HOST, HOST_DESCRIPTIONS, HEADLESS_HOST_DESCRIPTIONS;
 var init_host_descriptions = __esm({
   "src/host-descriptions.ts"() {
     "use strict";
-    PRIVATE_COMPAT_ENV = Object.fromEntries(
-      ["CLAUDE", "CURSOR", "CODEX"].flatMap((vendor) => ["SKILLS", "RULES", "AGENTS", "MCPS", "HOOKS", "SESSIONS"].map((kind) => [`GROK_${vendor}_${kind}_ENABLED`, "false"]))
-    );
     DEFAULT_ROLE_TURN_HOST = "pi";
     HOST_DESCRIPTIONS = Object.freeze({
       /** Operator home `~/.grok`, native session/load resume, `agent [--model X] stdio`. */
@@ -3517,12 +3514,7 @@ var init_host_descriptions = __esm({
         }),
         modelPassing: "argv",
         boundResume: "session/load",
-        sessionBindingFile: "grok-acp-session.json",
-        childEnv: Object.freeze({
-          ...PRIVATE_COMPAT_ENV,
-          GROK_MEMORY: "0",
-          GROK_SUBAGENTS: "0"
-        })
+        sessionBindingFile: "grok-acp-session.json"
       }),
       /**
        * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
@@ -3541,7 +3533,6 @@ var init_host_descriptions = __esm({
         modelPassing: "set_model",
         boundResume: "session/load",
         sessionBindingFile: "hermes-acp-session.json",
-        childEnv: Object.freeze({}),
         seatProfileSoul: Object.freeze({
           flag: "-p",
           namePrefix: "ak-",
@@ -3562,12 +3553,7 @@ var init_host_descriptions = __esm({
           // Intermediate assistant/tool/system events require verbose with stream-json.
           "--verbose",
           "--permission-mode",
-          "bypassPermissions",
-          // Empty sources: no user/project/local operator surface (envelope owns materials).
-          "--setting-sources",
-          "",
-          // With adapter-supplied --mcp-config only (AK relay); drops operator + claude.ai MCP.
-          "--strict-mcp-config"
+          "bypassPermissions"
         ]),
         promptFlag: "-p",
         modelFlag: "--model",
@@ -7680,10 +7666,12 @@ __export(invocation_exports, {
   deriveMergerEnvelopeFromActiveMerge: () => deriveMergerEnvelopeFromActiveMerge,
   ensureRunArtifactsDir: () => ensureRunArtifactsDir,
   freezeAttachmentsIntoRun: () => freezeAttachmentsIntoRun,
+  freezePreparedAttachmentsIntoRun: () => freezePreparedAttachmentsIntoRun,
   homeFromRunDirectory: () => homeFromRunDirectory,
   isReviewerLens: () => isReviewerLens,
   issueAdmissionPlacement: () => issueAdmissionPlacement,
   loadAdmittedJudgeRequest: () => loadAdmittedJudgeRequest,
+  materializeCountersignInvocation: () => materializeCountersignInvocation,
   observeLaunchedRolePackageIdentity: () => observeLaunchedRolePackageIdentity,
   parseAnalystArgv: () => parseAnalystArgv,
   parseAnalystCohortIssueToken: () => parseAnalystCohortIssueToken,
@@ -7707,6 +7695,7 @@ __export(invocation_exports, {
   parseReviewerArgv: () => parseReviewerArgv,
   parseSecretariatArgv: () => parseSecretariatArgv,
   persistAdmittedSourceRunPath: () => persistAdmittedSourceRunPath,
+  recordAdmittedCorrelation: () => recordAdmittedCorrelation,
   recordEffectiveInvocationModel: () => recordEffectiveInvocationModel,
   recordLaunchedPiIdentity: () => recordLaunchedPiIdentity,
   recordLaunchedRolePackageIdentity: () => recordLaunchedRolePackageIdentity,
@@ -7715,17 +7704,21 @@ __export(invocation_exports, {
   requireReviewerBaseRevision: () => requireReviewerBaseRevision,
   requireReviewerLens: () => requireReviewerLens,
   resolveDoctorCaseRunsPath: () => resolveDoctorCaseRunsPath,
-  resolveGitHubRemoteRepository: () => resolveGitHubRemoteRepository
+  resolveGitHubRemoteRepository: () => resolveGitHubRemoteRepository,
+  withPreparedAttachments: () => withPreparedAttachments
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync6 } from "node:fs";
 import {
   lstat as lstat4,
+  mkdtemp as mkdtemp2,
   readFile as readFile10,
   realpath as realpath4,
   rename,
+  rm as rm2,
   writeFile as writeFile5
 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
 import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute7, join as join17, resolve as resolve9, sep as sep4 } from "node:path";
 function issueAdmissionPlacement(authority, request) {
   const ledgerHome = resolveActivationLedgerHome(request.home);
@@ -7736,7 +7729,7 @@ function issueAdmissionPlacement(authority, request) {
     runId: request.runId,
     role: request.role
   });
-  ensureRoleRunPlacement(ledgerHome, placement);
+  if (request.materialize !== false) ensureRoleRunPlacement(ledgerHome, placement);
   return {
     principal: authority.seal(placement),
     ...placement,
@@ -7861,6 +7854,31 @@ async function bindAdmittedTicketNumber(admitted, ticketNumber) {
   await bindTicketNumberOnRunDirectory(admitted.runDirectory, ticketNumber);
   admitted.ticketNumber = ticketNumber;
 }
+async function recordAdmittedCorrelation(admitted, correlationId) {
+  const current = JSON.parse(
+    await readFile10(admitted.admittedRequestPath, "utf8")
+  );
+  const prior = [
+    ...Array.isArray(current.correlationIds) ? current.correlationIds.filter(
+      (value) => typeof value === "string" && value.trim() !== ""
+    ) : [],
+    ...typeof current.correlationId === "string" && current.correlationId.trim() !== "" ? [current.correlationId] : []
+  ];
+  const correlationIds = [.../* @__PURE__ */ new Set([...prior, correlationId])];
+  await writeFile5(
+    admitted.admittedRequestPath,
+    `${JSON.stringify({ ...current, correlationId, correlationIds }, null, 2)}
+`,
+    "utf8"
+  );
+  await mergeInvocationIdentityPage(admitted.runDirectory, {
+    correlationId,
+    correlationIds
+  });
+  const mutable = admitted;
+  mutable.correlationId = correlationId;
+  mutable.correlationIds = correlationIds;
+}
 async function bindCourtTicketNumbersOnAdmitted(admitted, courtTicketNumbers) {
   if (admitted.ticketNumber === void 0) {
     throw new Error(
@@ -8251,7 +8269,7 @@ function parseFixerArgv(args) {
     ...project === void 0 ? {} : { project }
   };
 }
-async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
+async function readRegularFileAttachment(sourcePath) {
   const absolute = isAbsolute7(sourcePath) ? sourcePath : resolve9(sourcePath);
   let st;
   try {
@@ -8267,18 +8285,72 @@ async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
       `attachment must be a regular file (not a directory or symlink): ${sourcePath}`
     );
   }
-  const bytes = await readFile10(absolute);
-  const name = `${String(index).padStart(2, "0")}-${basename6(absolute)}`;
-  const frozenPath = join17(destinationDir, name);
+  try {
+    return { absolute, bytes: await readFile10(absolute) };
+  } catch (error) {
+    throw new CliUsageError(
+      `attachment is not a readable regular file: ${sourcePath}`,
+      { cause: error }
+    );
+  }
+}
+async function removePreparedAttachmentDirectory(stagingDirectory) {
+  await rm2(stagingDirectory, { recursive: true, force: true });
+}
+async function withPreparedAttachments(attachmentPaths, use) {
+  if (attachmentPaths.length === 0) return await use([]);
+  const stagingDirectory = await mkdtemp2(join17(tmpdir2(), "ak-role-attachments-"));
+  const prepared = [];
+  let result;
+  try {
+    for (let index = 0; index < attachmentPaths.length; index += 1) {
+      const { absolute, bytes } = await readRegularFileAttachment(attachmentPaths[index]);
+      const snapshotPath = join17(stagingDirectory, String(index).padStart(6, "0"));
+      await writeFile5(snapshotPath, bytes);
+      prepared.push({ absolute, snapshotPath });
+    }
+    result = await use(prepared);
+  } catch (primary) {
+    try {
+      await removePreparedAttachmentDirectory(stagingDirectory);
+    } catch (cleanup) {
+      throw new AggregateError(
+        [primary, cleanup],
+        "attachment snapshot operation failed and cleanup also failed",
+        { cause: primary }
+      );
+    }
+    throw primary;
+  }
+  await removePreparedAttachmentDirectory(stagingDirectory);
+  return result;
+}
+async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, index) {
+  const frozenPath = join17(
+    destinationDir,
+    `${String(index).padStart(2, "0")}-${basename6(provenancePath)}`
+  );
   await writeFile5(frozenPath, bytes);
   return {
-    attachment: {
-      provenancePath: absolute,
-      frozenPath,
-      byteLength: bytes.byteLength,
-      sha256: sha256Hex(bytes),
-      mediaKind: "regular-file"
-    },
+    provenancePath,
+    frozenPath,
+    byteLength: bytes.byteLength,
+    sha256: sha256Hex(bytes),
+    mediaKind: "regular-file"
+  };
+}
+async function freezePreparedAttachment(prepared, destinationDir, index) {
+  return freezeAttachmentBytes(
+    prepared.absolute,
+    await readFile10(prepared.snapshotPath),
+    destinationDir,
+    index
+  );
+}
+async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
+  const { absolute, bytes } = await readRegularFileAttachment(sourcePath);
+  return {
+    attachment: await freezeAttachmentBytes(absolute, bytes, destinationDir, index),
     body: bytes
   };
 }
@@ -8301,6 +8373,17 @@ async function freezeAttachmentsIntoRun(attachmentPaths, runDirectory, summonsKe
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   return freezeAttachments(attachmentPaths, attachmentsDirectory);
 }
+async function freezePreparedAttachmentsIntoRun(prepared, runDirectory, summonsKey) {
+  if (prepared.length === 0) return [];
+  const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
+  const attachmentsDirectory = summonsKey === void 0 ? join17(runDirectory, "attachments") : join17(runDirectory, "attachments", summonsKey);
+  ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
+  const attachments = [];
+  for (let index = 0; index < prepared.length; index += 1) {
+    attachments.push(await freezePreparedAttachment(prepared[index], attachmentsDirectory, index));
+  }
+  return attachments;
+}
 function ticketAdmissionFields(ticketNumber) {
   if (ticketNumber === void 0) return {};
   return {
@@ -8440,9 +8523,10 @@ async function admitCountersignInvocation(options) {
     runId,
     role: "countersign",
     subject: { unbound: true },
-    home: options.home
+    home: options.home,
+    materialize: options.deferPersistence !== true
   });
-  const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
+  const attachments = options.deferPersistence === true ? [] : await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
   const instruction = options.instruction;
   const instructionEmpty = instruction.trim() === "";
   const admitted = {
@@ -8464,11 +8548,13 @@ async function admitCountersignInvocation(options) {
     }))
   };
   const admittedRequestPath = join17(runDirectory, "admitted-request.json");
-  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-    sessionDirectory,
-    sessionFile
-  });
-  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
+  if (options.deferPersistence !== true) {
+    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+      sessionDirectory,
+      sessionFile
+    });
+    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
+  }
   return {
     role: "countersign",
     runId,
@@ -8483,6 +8569,29 @@ async function admitCountersignInvocation(options) {
     ...options.correlationId === void 0 ? {} : { correlationId: options.correlationId }
   };
 }
+async function materializeCountersignInvocation(admitted, options) {
+  const placement = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: admitted.projectRoot,
+    runId: admitted.runId,
+    role: "countersign",
+    subject: { unbound: true },
+    home: options.home
+  });
+  const attachments = await freezePreparedAttachmentsIntoRun(
+    options.preparedAttachments,
+    admitted.runDirectory
+  );
+  admitted.attachments = attachments;
+  await writeAdmittedRequestPersistence(admitted.admittedRequestPath, admitted, {
+    sessionDirectory: placement.sessionDirectory,
+    sessionFile: placement.sessionFile
+  });
+  await writeRoleInvocationLedger(
+    { ...admitted, sessionDirectory: placement.sessionDirectory, sessionFile: placement.sessionFile },
+    admitted.role,
+    options.model
+  );
+}
 function buildCountersignTransportPrompt(admitted, engineMaterial) {
   return buildInstructionTransportPrompt(admitted, engineMaterial);
 }
@@ -11273,10 +11382,10 @@ function pairGateRounds(volumes) {
   return rounds.sort((a, b) => a.officerStartedAt.localeCompare(b.officerStartedAt)).map((round, index) => ({ ...round, roundIndex: index + 1 }));
 }
 async function resolveOfficerSessionFromPointerFile(pointerPath) {
-  const { readFile: readFile24 } = await import("node:fs/promises");
+  const { readFile: readFile23 } = await import("node:fs/promises");
   let raw;
   try {
-    raw = JSON.parse(await readFile24(pointerPath, "utf8"));
+    raw = JSON.parse(await readFile23(pointerPath, "utf8"));
   } catch (error) {
     throw new Error(
       `direct officer run pointer unreadable in ${pointerPath}: ${error instanceof Error ? error.message : String(error)}`,
@@ -11877,16 +11986,27 @@ async function readPackageMaterial(relativePath) {
 }
 async function joinPackageMaterials(relativePaths) {
   const chunks = [];
-  for (const relativePath of relativePaths) {
-    chunks.push(await readPackageMaterial(relativePath));
-  }
+  for (const relativePath of relativePaths) chunks.push(await readPackageMaterial(relativePath));
   return chunks.join("\n\n");
 }
+function roleSoulPath(role, materials) {
+  const suffix = `/souls/${role}.md`;
+  const path = materials.find((candidate) => `/${candidate}`.endsWith(suffix));
+  if (path === void 0) throw new Error(`session materials omit the ${role} Soul`);
+  return path;
+}
+async function loadSeparatedSessionPart(role, materials, part) {
+  const soul = roleSoulPath(role, materials);
+  return part === "soul" ? readPackageMaterial(soul) : joinPackageMaterials(materials.filter((path) => path !== soul));
+}
 function loadMainRoleSessionMaterials(role) {
-  return joinPackageMaterials(MAIN_ROLE_SESSION_MATERIALS[role]);
+  return loadSeparatedSessionPart(role, MAIN_ROLE_SESSION_MATERIALS[role], "soul");
+}
+function loadMainRoleReferenceMaterials(role) {
+  return loadSeparatedSessionPart(role, MAIN_ROLE_SESSION_MATERIALS[role], "references");
 }
 function loadGatekeeperSessionMaterials(role) {
-  return joinPackageMaterials(GATEKEEPER_SESSION_MATERIALS[role]);
+  return loadSeparatedSessionPart(role, GATEKEEPER_SESSION_MATERIALS[role], "soul");
 }
 var packageRootUrl, MAIN_ROLE_SESSION_MATERIALS, GATEKEEPER_SESSION_MATERIALS;
 var init_session_opening_materials = __esm({
@@ -11916,6 +12036,8 @@ __export(auditor_soul_exports, {
   AUDITOR_SESSION_MATERIALS: () => AUDITOR_SESSION_MATERIALS,
   AUDITOR_SOUL_ROLES: () => AUDITOR_SOUL_ROLES,
   isAuditorSoulRole: () => isAuditorSoulRole,
+  loadAuditorReferenceMaterials: () => loadAuditorReferenceMaterials,
+  loadAuditorReferenceMaterialsFromSubjectInput: () => loadAuditorReferenceMaterialsFromSubjectInput,
   loadAuditorSoul: () => loadAuditorSoul,
   loadAuditorSoulFromSubjectInput: () => loadAuditorSoulFromSubjectInput,
   resolveAuditorSubject: () => resolveAuditorSubject
@@ -11942,11 +12064,18 @@ async function loadAuditorSoul(role) {
   if (soul.trim().length === 0) {
     throw new Error(`The ${role} auditor Soul is blank`);
   }
-  return joinPackageMaterials(materials);
+  return soul;
+}
+function loadAuditorReferenceMaterials(role) {
+  const soulPath = auditorSoulRelativePath(role);
+  return joinPackageMaterials(AUDITOR_SESSION_MATERIALS[role].filter((path) => path !== soulPath));
 }
 async function loadAuditorSoulFromSubjectInput(raw) {
   return loadAuditorSoul(resolveAuditorSubject(raw));
 }
+function loadAuditorReferenceMaterialsFromSubjectInput(raw) {
+  return loadAuditorReferenceMaterials(resolveAuditorSubject(raw));
+}
 var AUDITOR_SOUL_ROLES, AK_ROLE_AUDITOR_SUBJECT_ENV, AK_ROLE_AUDITOR_SOURCE_RUN_ENV, AUDITOR_SESSION_MATERIALS;
 var init_auditor_soul = __esm({
   "src/auditor-soul.ts"() {
@@ -17460,8 +17589,8 @@ __export(case_dossier_delivery_exports, {
   loadCaseDossierReadingMaterial: () => loadCaseDossierReadingMaterial,
   projectCaseDossierPointerSection: () => projectCaseDossierPointerSection
 });
-import { mkdtemp as mkdtemp2, readFile as readFile18, rm as rm2, writeFile as writeFile9 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
+import { mkdtemp as mkdtemp3, readFile as readFile18, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
 import { join as join31 } from "node:path";
 async function projectCaseDossierPointerSection(input) {
   if (input.ticketNumber === void 0) {
@@ -17489,7 +17618,7 @@ async function deliverCaseDossierAsAttachment(input) {
     projectRoot: input.projectRoot,
     home: input.home
   });
-  const stagingDir = await mkdtemp2(join31(tmpdir2(), "ak-case-dossier-"));
+  const stagingDir = await mkdtemp3(join31(tmpdir3(), "ak-case-dossier-"));
   try {
     const stagingPath = join31(stagingDir, CASE_DOSSIER_ATTACH_FILE);
     await writeFile9(stagingPath, `${section}
@@ -17500,7 +17629,7 @@ async function deliverCaseDossierAsAttachment(input) {
       CASE_DOSSIER_ATTACH_KEY
     );
   } finally {
-    await rm2(stagingDir, { recursive: true, force: true });
+    await rm3(stagingDir, { recursive: true, force: true });
   }
 }
 async function loadCaseDossierReadingMaterial(runDirectory) {
@@ -19802,6 +19931,9 @@ function diaristAdapters(env) {
     shouldPresentSettled: () => true,
     // Resume interrupted state: board ticket already on pages, run still under unbound/.
     beforeDispatch: async (admitted, lease) => {
+      if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
+        await recordAdmittedCorrelation(admitted, env.correlationId);
+      }
       await bindAndRelocateDiaristIfBoardBound(admitted, env.principalAuthority, lease);
     },
     // First post-turn assert: accept hook wrote board pages; relocate before lease release.
@@ -19986,7 +20118,8 @@ function courtDiaristEscalated(roleOutcome) {
   if (roleOutcome.kind === "audit_escalation") return true;
   if (roleOutcome.kind !== "accepted") return false;
   return (roleOutcome.payloads ?? []).some((payload) => {
-    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return false;
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload))
+      return false;
     const record4 = payload;
     return record4.status === "escalate" || record4.countersignStatus === "escalate";
   });
@@ -20039,7 +20172,10 @@ async function invokeCourtDiarist(input, env, io) {
   }
   const asserted = result.admitted?.ticketNumber;
   if (isSafePositiveTicketNumber(asserted)) {
-    const courtTicketNumbers = courtTicketNumbersFromOutcome(roleOutcome, asserted);
+    const courtTicketNumbers = courtTicketNumbersFromOutcome(
+      roleOutcome,
+      asserted
+    );
     return {
       identity: {
         kind: "ticket",
@@ -20088,7 +20224,9 @@ async function runCountersignCourtDiaristStation(admitted, env, io) {
       );
     }
     if (outcome.failedWithoutEscalate !== void 0) {
-      throw new StationChildExhaustedError(outcome.failedWithoutEscalate.diagnostic);
+      throw new StationChildExhaustedError(
+        outcome.failedWithoutEscalate.diagnostic
+      );
     }
   }
 }
@@ -20114,7 +20252,8 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
       ...parsed.project === void 0 ? {} : { project: parsed.project },
       ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
       ...env.model === void 0 ? {} : { model: env.model },
-      ...env.correlationId === void 0 ? {} : { correlationId: env.correlationId }
+      ...env.correlationId === void 0 ? {} : { correlationId: env.correlationId },
+      deferPersistence: true
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -20123,160 +20262,216 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
     }
     throw error;
   }
-  await markRunAdmitted(admitted, env.principalAuthority);
-  let typedTicket;
-  let typedCourtTicketNumbers;
-  let identityDiaristRan = false;
-  if (env.runCourtDiaristStation === void 0) {
-    const outcome = await invokeCourtDiarist(
-      {
-        instruction: parsed.instruction,
-        projectRoot: admitted.projectRoot,
-        failureLabel: "unbound summons",
-        correlationId: admitted.runId
-      },
-      env,
-      io
-    );
-    identityDiaristRan = true;
-    if (outcome.identity.kind === "escalate") {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: new Error(
-            "court diarist station escalated (cannot identify court target)"
-          )
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-    if (outcome.failedWithoutEscalate !== void 0) {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: new Error(outcome.failedWithoutEscalate.diagnostic)
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-    if (outcome.identity.kind === "ticket") {
-      const assertedTicket = outcome.identity.ticketNumber;
-      typedTicket = assertedTicket;
-      typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
-      const summons = {
-        instruction: parsed.instruction,
-        instructionEmpty: parsed.instruction.trim() === "",
-        attachmentPaths: parsed.attachmentPaths
-      };
-      const resumed = await tryResumeSameTicketSeatRun({
-        home: env.home,
-        projectRoot: admitted.projectRoot,
-        role: "countersign",
-        ticketNumber: typedTicket,
-        freshSummons: env.freshSummons,
-        summons,
-        resume: async (runId, materials) => {
-          await bindAdmittedTicketNumber(admitted, assertedTicket);
-          await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-          await markRunTerminal(admitted.runDirectory);
-          return await runPublicCountersignResume(
-            {
-              runId,
-              ...materials === void 0 ? {} : { summons: materials }
-            },
-            {
-              ...env,
-              ...typedCourtTicketNumbers === void 0 ? {} : { pendingCourtTicketNumbers: typedCourtTicketNumbers }
-            },
-            io
-          );
+  try {
+    return await withPreparedAttachments(
+      parsed.attachmentPaths,
+      async (preparedAttachments) => {
+        const materializeAdmission = async () => {
+          await materializeCountersignInvocation(admitted, {
+            home: env.home,
+            principalAuthority: env.principalAuthority,
+            preparedAttachments,
+            ...env.model === void 0 ? {} : { model: env.model }
+          });
+        };
+        let typedTicket;
+        let typedCourtTicketNumbers;
+        let identityDiaristRan = false;
+        if (env.runCourtDiaristStation === void 0) {
+          let outcome;
+          try {
+            outcome = await invokeCourtDiarist(
+              {
+                instruction: parsed.instruction,
+                projectRoot: admitted.projectRoot,
+                failureLabel: "unbound summons"
+              },
+              env,
+              io
+            );
+          } catch (error) {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              { timedOut: false, code: null, stderr: "", thrown: error },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          identityDiaristRan = true;
+          if (outcome.identity.kind === "escalate") {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: new Error(
+                  "court diarist station escalated (cannot identify court target)"
+                )
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          if (outcome.failedWithoutEscalate !== void 0) {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: new Error(outcome.failedWithoutEscalate.diagnostic)
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          if (outcome.identity.kind === "ticket") {
+            const assertedTicket = outcome.identity.ticketNumber;
+            typedTicket = assertedTicket;
+            typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
+            const summons = {
+              instruction: parsed.instruction,
+              instructionEmpty: parsed.instruction.trim() === ""
+            };
+            const resumed = await tryResumeSameTicketSeatRun({
+              home: env.home,
+              projectRoot: admitted.projectRoot,
+              role: "countersign",
+              ticketNumber: typedTicket,
+              freshSummons: env.freshSummons,
+              summons,
+              resume: async (runId, materials) => {
+                const retained = await loadResumableCountersignRun(
+                  env.home,
+                  runId,
+                  env.principalAuthority
+                );
+                if (retained.admitted === void 0) {
+                  throw new Error(
+                    `retained countersign run disappeared before resume: ${runId}`
+                  );
+                }
+                const frozenPaths = (await freezePreparedAttachmentsIntoRun(
+                  preparedAttachments,
+                  retained.admitted.runDirectory,
+                  `s-${Date.now().toString(36)}`
+                )).map((attachment) => attachment.frozenPath);
+                const preparedMaterials = {
+                  ...materials ?? {},
+                  ...frozenPaths.length === 0 ? {} : { attachmentPaths: frozenPaths }
+                };
+                return await runPublicCountersignResume(
+                  {
+                    runId,
+                    summons: preparedMaterials
+                  },
+                  {
+                    ...env,
+                    ...typedCourtTicketNumbers === void 0 ? {} : { pendingCourtTicketNumbers: typedCourtTicketNumbers }
+                  },
+                  io
+                );
+              }
+            });
+            if (resumed !== void 0) {
+              return resumed;
+            }
+          }
         }
-      });
-      if (resumed !== void 0) {
-        return resumed;
-      }
-    }
-  }
-  if (identityDiaristRan && typedTicket !== void 0) {
-    try {
-      await bindAdmittedTicketNumber(admitted, typedTicket);
-      await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-      await bindCourtTicketNumbersOnAdmitted(
-        admitted,
-        typedCourtTicketNumbers ?? [typedTicket]
-      );
-    } catch (error) {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: error
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-  }
-  const turnProjection = {
-    packageRoot: env.packageRoot,
-    home: env.home,
-    agentDir: env.agentDir,
-    ...env.model === void 0 ? {} : { model: env.model },
-    ...pickEngineAxis(env),
-    ...env.timeoutMs === void 0 ? {} : { timeoutMs: env.timeoutMs },
-    ...env.correlationId === void 0 || env.correlationId.trim() === "" ? {} : { correlationId: env.correlationId },
-    continuation: {
-      kind: "initial",
-      prompt: buildCountersignTransportPrompt(
-        admitted,
-        engineSessionMaterialFromOptions({
-          ...pickEngineAxis(env),
-          packageRoot: env.packageRoot
-        })
-      )
-    }
-  };
-  const turnRequest = buildCountersignTurnRequest(admitted, turnProjection);
-  const result = await runPostAdmissionOneShot({
-    admitted,
-    env,
-    io,
-    request: turnRequest,
-    adapters: countersignAdapters({
-      beforeDispatch: async (admittedSeat, lease) => {
-        if (!identityDiaristRan) {
-          await runCountersignCourtDiaristStation(admittedSeat, env, io);
-        } else if (typedTicket !== void 0) {
-          await runCountersignCourtDiaristStation(admittedSeat, env, io);
+        await materializeAdmission();
+        await markRunAdmitted(admitted, env.principalAuthority);
+        if (identityDiaristRan && typedTicket !== void 0) {
+          try {
+            await bindAdmittedTicketNumber(admitted, typedTicket);
+            await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+            await bindCourtTicketNumbersOnAdmitted(
+              admitted,
+              typedCourtTicketNumbers ?? [typedTicket]
+            );
+          } catch (error) {
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: error
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
         }
-        await relocateAdmittedRunToTicket(
-          admittedSeat,
-          env.principalAuthority,
-          lease
-        );
-        Object.assign(
-          turnRequest,
-          buildCountersignTurnRequest(admittedSeat, turnProjection)
+        const turnProjection = {
+          packageRoot: env.packageRoot,
+          home: env.home,
+          agentDir: env.agentDir,
+          ...env.model === void 0 ? {} : { model: env.model },
+          ...pickEngineAxis(env),
+          ...env.timeoutMs === void 0 ? {} : { timeoutMs: env.timeoutMs },
+          ...env.correlationId === void 0 || env.correlationId.trim() === "" ? {} : { correlationId: env.correlationId },
+          continuation: {
+            kind: "initial",
+            prompt: buildCountersignTransportPrompt(
+              admitted,
+              engineSessionMaterialFromOptions({
+                ...pickEngineAxis(env),
+                packageRoot: env.packageRoot
+              })
+            )
+          }
+        };
+        const turnRequest = buildCountersignTurnRequest(
+          admitted,
+          turnProjection
         );
+        const result = await runPostAdmissionOneShot({
+          admitted,
+          env,
+          io,
+          request: turnRequest,
+          adapters: countersignAdapters({
+            beforeDispatch: async (admittedSeat, lease) => {
+              if (!identityDiaristRan) {
+                await runCountersignCourtDiaristStation(admittedSeat, env, io);
+              } else if (typedTicket !== void 0) {
+                await runCountersignCourtDiaristStation(admittedSeat, env, io);
+              }
+              await relocateAdmittedRunToTicket(
+                admittedSeat,
+                env.principalAuthority,
+                lease
+              );
+              Object.assign(
+                turnRequest,
+                buildCountersignTurnRequest(admittedSeat, turnProjection)
+              );
+            }
+          }),
+          ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
+        });
+        await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+        return result;
       }
-    }),
-    ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
-  });
-  await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-  return result;
+    );
+  } catch (error) {
+    if (error instanceof CliUsageError) {
+      presentStructuralRejection(error, io);
+      return { exitCode: 2 };
+    }
+    throw error;
+  }
 }
 function countersignAdapters(options) {
   return {
@@ -20314,7 +20509,9 @@ async function runPublicCountersignResume(request, env, io) {
     adapters: countersignAdapters({
       beforeDispatch: async (admitted) => {
         if (admitted.courtTicketNumbersDamage !== void 0) {
-          throw new StationChildExhaustedError(admitted.courtTicketNumbersDamage);
+          throw new StationChildExhaustedError(
+            admitted.courtTicketNumbersDamage
+          );
         }
         if (env.pendingCourtTicketNumbers !== void 0) {
           await bindCourtTicketNumbersOnAdmitted(
@@ -20717,9 +20914,9 @@ import { randomUUID as randomUUID9 } from "node:crypto";
 // src/role-envelope.ts
 init_engine_detour();
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { mkdir as mkdir5, readFile as readFile20, writeFile as writeFile12 } from "node:fs/promises";
+import { mkdir as mkdir6, writeFile as writeFile12 } from "node:fs/promises";
 import { createServer } from "node:net";
-import { basename as basename9, dirname as dirname21, join as join40 } from "node:path";
+import { dirname as dirname22, join as join41 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/gatekeeper-pass-envelope.ts
@@ -20804,9 +21001,43 @@ async function requireGatekeeperPass(options) {
   }
 }
 
+// src/host-native-method.ts
+import { lstat as lstat7, mkdir as mkdir5, readlink, realpath as realpath6, symlink } from "node:fs/promises";
+import { basename as basename9, dirname as dirname18, join as join36 } from "node:path";
+var packagedMethodsDir = (root) => join36(root, "resources", "methods");
+function hostMethodSkills(methods) {
+  return Object.freeze(methods.flatMap((method) => {
+    if (method.kind !== "skill") return [];
+    const name = basename9(dirname18(method.path));
+    return name ? [Object.freeze({ name })] : [];
+  }));
+}
+async function installWorkspaceMethodSkills(cwd, packageRoot) {
+  const target = await realpath6(packagedMethodsDir(packageRoot));
+  const link = join36(cwd, ".agents", "skills");
+  try {
+    const stat2 = await lstat7(link);
+    if (!stat2.isSymbolicLink() || await realpath6(link) !== target) {
+      const detail = stat2.isSymbolicLink() ? `symlink to ${await readlink(link)}` : "non-symlink entry";
+      throw new Error(`workspace method catalog conflict at ${link}: ${detail}`);
+    }
+    return;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  await mkdir5(dirname18(link), { recursive: true });
+  try {
+    await symlink(target, link);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    if (await realpath6(link).catch(() => "") !== target) {
+      throw new Error(`workspace method catalog conflict at ${link}`);
+    }
+  }
+}
+
 // src/role-envelope.ts
 init_packaged_role_registry();
-init_method_skill();
 
 // src/role-runtime.ts
 init_host_contracts();
@@ -20814,7 +21045,7 @@ init_sitian_facade();
 init_submission_ledger();
 init_collector_ledger();
 import { readFileSync as readFileSync6, writeSync as writeSync4 } from "node:fs";
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 import { Value as Value4 } from "typebox/value";
 
 // src/activation-trace.ts
@@ -20864,7 +21095,7 @@ import {
   openSync as openSync2,
   writeSync
 } from "node:fs";
-import { dirname as dirname18, isAbsolute as isAbsolute10, resolve as resolve15 } from "node:path";
+import { dirname as dirname19, isAbsolute as isAbsolute10, resolve as resolve15 } from "node:path";
 
 // src/activation-ledger-session.ts
 init_activation_ledger_topology();
@@ -21013,7 +21244,7 @@ function appendActivationLedgerLine(ledgerPath, line2, options) {
   }
   const resolvedLedger = resolve15(ledgerPath);
   const resolvedHome = resolve15(options.ledgerHome);
-  const parent = dirname18(resolvedLedger);
+  const parent = dirname19(resolvedLedger);
   ensureRealDirectoryTree(resolvedHome, parent);
   assertLedgerFileInsideHome(resolvedLedger, resolvedHome);
   if (typeof constants2.O_NOFOLLOW !== "number") {
@@ -21373,20 +21604,20 @@ init_collector_github();
 
 // src/collector-handbook.ts
 import { readFile as readFile19 } from "node:fs/promises";
-import { join as join37, sep as sep5 } from "node:path";
+import { join as join38, sep as sep5 } from "node:path";
 
 // src/atomic-write.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { rename as rename3, rm as rm3, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname19, join as join36 } from "node:path";
+import { rename as rename3, rm as rm4, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname20, join as join37 } from "node:path";
 async function writeFileAtomically(destination, contents) {
-  const parent = dirname19(destination);
-  const temporary = join36(parent, `.atomic-write-${randomUUID7()}.tmp`);
+  const parent = dirname20(destination);
+  const temporary = join37(parent, `.atomic-write-${randomUUID7()}.tmp`);
   try {
     await writeFile11(temporary, contents);
     await rename3(temporary, destination);
   } catch (error) {
-    await rm3(temporary, { force: true }).catch(() => void 0);
+    await rm4(temporary, { force: true }).catch(() => void 0);
     throw error;
   }
 }
@@ -21507,7 +21738,7 @@ function resolveCollectorHandbookRoot(sessionPath) {
     throw new Error(`\u901A\u8FDB\u53F8\u624B\u518C\u62D2\u7EDD\u4E0D\u5B89\u5168 bookKey ${JSON.stringify(bookKey)}`);
   }
   const ledgerHome = resolveActivationLedgerHomeForPath(sessionPath);
-  const root = join37(activationBookDirectory(ledgerHome, bookKey), "collector-handbook");
+  const root = join38(activationBookDirectory(ledgerHome, bookKey), "collector-handbook");
   return { ledgerHome, bookKey, root };
 }
 function collectorHandbookRepoFileName(repositoryCanonical) {
@@ -21519,9 +21750,9 @@ function collectorHandbookRepoFileName(repositoryCanonical) {
   return `${repositoryCanonical.replaceAll("/", "__")}.md`;
 }
 function createCollectorHandbookStore(input) {
-  const generalPath = join37(input.handbookRoot, "general.md");
-  const repoDir = join37(input.handbookRoot, "repos");
-  const repoPath = join37(repoDir, collectorHandbookRepoFileName(input.repositoryCanonical));
+  const generalPath = join38(input.handbookRoot, "general.md");
+  const repoDir = join38(input.handbookRoot, "repos");
+  const repoPath = join38(repoDir, collectorHandbookRepoFileName(input.repositoryCanonical));
   const assertHandbookBudget = (body, label) => {
     const byteLength = Buffer.byteLength(body, "utf8");
     if (byteLength > COLLECTOR_HANDBOOK_MAX_BYTES) {
@@ -24929,7 +25160,7 @@ function readDiaristTicketAssertion(submitted) {
 function readRoleRunCoordinates(ctx, label) {
   const runDirectory = runDirectoryFromHostContext(ctx);
   if (runDirectory === void 0) throw new Error(`${label} requires AK_ROLE_RUN_DIR`);
-  const admittedPath = join39(runDirectory, "admitted-request.json");
+  const admittedPath = join40(runDirectory, "admitted-request.json");
   const admitted = JSON.parse(readFileSync6(admittedPath, "utf8"));
   if (typeof admitted.projectRoot !== "string" || admitted.projectRoot.trim() === "") {
     throw new Error(`${label} admitted-request missing projectRoot (${admittedPath})`);
@@ -25162,6 +25393,7 @@ function createRoleRuntimeExtension(dependencies) {
     });
     let admitted = false;
     let selectedRole;
+    let roleReferenceMaterials = "";
     let activeReviewerParent;
     let reviewerOriginalRequest;
     let reviewerExpansionCaptured = false;
@@ -25255,10 +25487,10 @@ function createRoleRuntimeExtension(dependencies) {
           activeReviewerParent.skillBinding.name,
           text
         ) ?? text;
-        return text === event.text ? { action: "continue" } : { action: "transform", text };
       }
-      return text === event.text ? { action: "continue" } : { action: "transform", text };
+      return { action: "continue" };
     });
+    roleHost.on("before_agent_start", () => roleReferenceMaterials === "" ? void 0 : { readingMaterial: { kind: "role-reference-materials", content: roleReferenceMaterials } });
     roleHost.on("before_agent_start", async (event, ctx) => {
       const role = roleHost.getFlag(ROLE_FLAG.name);
       const prompt = event.prompt;
@@ -25824,6 +26056,7 @@ function createRoleRuntimeExtension(dependencies) {
       }
       admitted = false;
       selectedRole = void 0;
+      roleReferenceMaterials = "";
       activeReviewerParent = void 0;
       reviewerOriginalRequest = void 0;
       reviewerExpansionCaptured = false;
@@ -25958,6 +26191,7 @@ function createRoleRuntimeExtension(dependencies) {
           }
         }
         await executeActivationStage(entry.role, activationStage(entry.role, runtime), { clock, writeTrace });
+        roleReferenceMaterials = await dependencies.loadRoleReferenceMaterials?.(entry.role) ?? "";
         if (!engineDetourRegistered) {
           engineDetourRegistered = registerEngineDetourTool(roleHost, hostActions);
         }
@@ -25992,19 +26226,6 @@ function createRoleRuntimeExtension(dependencies) {
 init_role_activation_flags();
 init_submission_correctable_error();
 init_navigator_invocation_identity();
-function buildSkillExpansion(methodSkills, prompt) {
-  if (methodSkills.size !== 1) return void 0;
-  const entry = methodSkills.entries().next().value;
-  if (entry === void 0) return void 0;
-  const [name, method] = entry;
-  return Object.freeze({
-    name,
-    location: method.path,
-    content: method.body,
-    // Non-pi typed chain keeps original task bytes (ticket #822 r3); no consumer trim.
-    userMessage: prompt
-  });
-}
 async function listen(server, path) {
   await new Promise((resolve21, reject) => {
     server.once("error", reject);
@@ -26039,21 +26260,14 @@ async function prepareRoleEnvelope(options) {
   const calls = [];
   const customEntries = [];
   const sessionEntries = [];
-  const methodSkills = /* @__PURE__ */ new Map();
   let preferredTools = [];
   let rejection;
   let infrastructureRoundFailure;
   const hostAbort = new AbortController();
   const runId = request.runDirectory.split("/").filter(Boolean).at(-1) ?? randomUUID8();
-  await mkdir5(request.runDirectory, { recursive: true });
-  for (const method of request.methods) {
-    if (method.kind !== "skill") continue;
-    const name = basename9(dirname21(method.path));
-    const raw = await readFile20(method.path, "utf8");
-    methodSkills.set(name, { path: method.path, body: stripSkillFrontmatter(raw).trim() });
-  }
-  let sessionFile = options.sessionFile ?? join40(request.runDirectory, "session", "session.jsonl");
-  await mkdir5(dirname21(sessionFile), { recursive: true });
+  await mkdir6(request.runDirectory, { recursive: true });
+  let sessionFile = options.sessionFile ?? join41(request.runDirectory, "session", "session.jsonl");
+  await mkdir6(dirname22(sessionFile), { recursive: true });
   if (request.continuation.kind !== "resume") {
     try {
       await writeFile12(
@@ -26084,7 +26298,7 @@ async function prepareRoleEnvelope(options) {
       getLeafEntry: () => sessionEntries.at(-1),
       getLeafId: () => runId,
       getEntries: () => sessionEntries,
-      getSessionDir: () => dirname21(sessionFile),
+      getSessionDir: () => dirname22(sessionFile),
       getSessionFile: () => sessionFile,
       getHeader: () => ({ type: "session", id: runId }),
       setSessionFile(path) {
@@ -26119,8 +26333,9 @@ async function prepareRoleEnvelope(options) {
     deliverSubmissionRejection(_value) {
     },
     capabilities: {
-      skillExpansion(prompt) {
-        return buildSkillExpansion(methodSkills, prompt);
+      // #922: native loaders own expansion; package does not pre-read bodies (ADR 0032).
+      skillExpansion() {
+        return void 0;
       }
     },
     registerFlag(name, definition) {
@@ -26459,10 +26674,9 @@ async function prepareRoleEnvelope(options) {
         message: { role: "user", content: prompt }
       });
     }
-    const methodPrompt = (await Promise.all(request.methods.map(({ path }) => readFile20(path, "utf8")))).join("\n\n");
     const promptResults = await emit("before_agent_start", {
       prompt,
-      systemPrompt: methodPrompt,
+      systemPrompt: "",
       systemPromptOptions: {}
     });
     const systemPromptParts = promptResults.flatMap((value) => {
@@ -26470,7 +26684,7 @@ async function prepareRoleEnvelope(options) {
       if (!("systemPrompt" in value) || typeof value.systemPrompt !== "string") return [];
       return [value.systemPrompt];
     });
-    const systemPromptBody = systemPromptParts.length > 0 ? systemPromptParts.join("\n\n") : methodPrompt;
+    const systemPromptBody = systemPromptParts.join("\n\n");
     const readingMaterials = [];
     for (const value of promptResults) {
       if (typeof value !== "object" || value === null) continue;
@@ -26483,6 +26697,13 @@ async function prepareRoleEnvelope(options) {
       throw new Error(`terminating tool not registered after activation: ${terminatingToolName}`);
     }
     const jsonSchema = terminatingToolJsonSchema(terminating.parameters);
+    if (request.host === "codex" && hostMethodSkills(request.methods).length > 0) {
+      const packageRoot = options.dependencies.packageRoot;
+      if (typeof packageRoot !== "string" || packageRoot === "") {
+        throw new Error("codex project Skill catalog requires packageRoot");
+      }
+      await installWorkspaceMethodSkills(request.cwd, packageRoot);
+    }
     return {
       mcpServers: [{
         name: `ak-${request.activation.role}`,
@@ -26517,18 +26738,18 @@ async function prepareRoleEnvelope(options) {
 }
 
 // src/role-runtime-dependencies.ts
-import { readFile as readFile23 } from "node:fs/promises";
+import { readFile as readFile22 } from "node:fs/promises";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/canonical-skill-binding.ts
-import { readFile as readFile21, realpath as realpath6 } from "node:fs/promises";
+import { readFile as readFile20, realpath as realpath7 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname as dirname22, resolve as resolve18 } from "node:path";
+import { dirname as dirname23, resolve as resolve18 } from "node:path";
 import { stripFrontmatter } from "@earendil-works/pi-coding-agent";
 function captureCanonicalSkillExpansion(name, snapshot, configuredPath, evidence, originalRequest) {
   const matchedPath = evidence?.location === configuredPath ? configuredPath : evidence?.location === snapshot.path ? snapshot.path : void 0;
   const expectedContent = matchedPath === void 0 ? void 0 : snapshot.body;
-  const prefixedContent = matchedPath === void 0 ? void 0 : `References are relative to ${dirname22(matchedPath)}.
+  const prefixedContent = matchedPath === void 0 ? void 0 : `References are relative to ${dirname23(matchedPath)}.
 
 ${snapshot.body}`;
   if (evidence?.name !== name || matchedPath === void 0 || evidence.content !== expectedContent && evidence.content !== prefixedContent || evidence.userMessage !== originalRequest) {
@@ -26553,8 +26774,8 @@ async function loadCanonicalSkillBinding(name) {
   let path;
   let raw;
   try {
-    path = await realpath6(configuredPath);
-    raw = await readFile21(path, "utf8");
+    path = await realpath7(configuredPath);
+    raw = await readFile20(path, "utf8");
   } catch (error) {
     throw new CanonicalSkillUnavailableError(name, configuredPath, error);
   }
@@ -26565,7 +26786,7 @@ async function loadCanonicalSkillBinding(name) {
   const snapshot = Object.freeze({
     raw,
     path,
-    baseDir: dirname22(path),
+    baseDir: dirname23(path),
     body,
     snapshotIdentity: Object.freeze({ text: raw })
   });
@@ -26593,7 +26814,7 @@ init_doctor_evidence();
 // src/navigator-work-context.ts
 init_doctor_evidence();
 init_host_contracts();
-import { readFile as readFile22 } from "node:fs/promises";
+import { readFile as readFile21 } from "node:fs/promises";
 import { resolve as resolve19 } from "node:path";
 init_notary_source_run();
 init_packaged_role_registry();
@@ -26606,7 +26827,7 @@ function navigatorInputReference(getFlag, role) {
 }
 async function loadNavigatorWorkContext(options) {
   const reference = navigatorInputReference(options.getFlag, options.role);
-  const input = reference === void 0 || options.role === "doctor" || options.role === "notary" ? void 0 : await readFile22(reference, "utf8");
+  const input = reference === void 0 || options.role === "doctor" || options.role === "notary" ? void 0 : await readFile21(reference, "utf8");
   const subjectRoot = subjectPath(reference ?? options.context.sessionManager.getSessionDir(), options.context.cwd);
   let subjectKey = reference === void 0 ? subjectRoot : navigatorSubjectKeyForInput(subjectRoot, reference, options.context.cwd);
   let subject = input ?? `work subject: ${subjectKey}`;
@@ -26663,7 +26884,7 @@ async function loadNavigatorWorkContext(options) {
   let authorityMaterial;
   for (const path of authorityFiles) {
     try {
-      const content = await readFile22(path, "utf8");
+      const content = await readFile21(path, "utf8");
       if (content.trim() !== "") {
         authorityMaterial = content;
         break;
@@ -26688,7 +26909,7 @@ async function loadNavigatorWorkContext(options) {
 init_notary_source_run();
 
 // src/package-resources/method-skill-binding.ts
-import { dirname as dirname23 } from "node:path";
+import { dirname as dirname24 } from "node:path";
 init_method_skill();
 async function loadPackagedCanonicalSkillBinding(packageRoot, name) {
   const material = await loadPackagedMethodSkillMaterial(packageRoot, name);
@@ -26696,7 +26917,7 @@ async function loadPackagedCanonicalSkillBinding(packageRoot, name) {
   const snapshot = Object.freeze({
     raw: material.raw,
     path: material.skillPath,
-    baseDir: dirname23(material.skillPath),
+    baseDir: dirname24(material.skillPath),
     body: material.body,
     snapshotIdentity: Object.freeze({ text: material.raw })
   });
@@ -26725,19 +26946,23 @@ var navigatorRoutePlaybookPath = fileURLToPath3(
 var collectorHandbookSeedPath = fileURLToPath3(
   new URL("../resources/collector-bot-handbook.md", import.meta.url)
 );
+function loadPackagedRoleReferenceMaterials(role) {
+  return role === "auditor" ? loadAuditorReferenceMaterialsFromSubjectInput() : loadMainRoleReferenceMaterials(role);
+}
 function createRoleRuntimeDependencies(packageRoot) {
   const doctorAuditor = createPiDoctorAuditor();
   const navigatorSessionFactory = createNativeNavigatorSessionFactory();
   return {
     packageRoot,
+    loadRoleReferenceMaterials: loadPackagedRoleReferenceMaterials,
     loadJudgeSoul: () => loadMainRoleSessionMaterials("judge"),
     loadFixerSoul: () => loadMainRoleSessionMaterials("fixer"),
-    loadFixPacket: (path) => readFile23(path, "utf8"),
+    loadFixPacket: (path) => readFile22(path, "utf8"),
     loadCoderSoul: () => loadMainRoleSessionMaterials("coder"),
-    loadCoderTask: (path) => readFile23(path, "utf8"),
+    loadCoderTask: (path) => readFile22(path, "utf8"),
     loadReviewerSoul: () => loadMainRoleSessionMaterials("reviewer"),
     loadCollectorSoul: () => loadMainRoleSessionMaterials("collector"),
-    loadCollectorHandbookSeed: () => readFile23(collectorHandbookSeedPath, "utf8"),
+    loadCollectorHandbookSeed: () => readFile22(collectorHandbookSeedPath, "utf8"),
     createCollectorTransport: () => createGhCollectorGitHubTransport(),
     loadDoctorSoul: () => loadMainRoleSessionMaterials("doctor"),
     loadDoctorCase,
@@ -26752,7 +26977,7 @@ function createRoleRuntimeDependencies(packageRoot) {
     loadSecretariatSoul: () => loadMainRoleSessionMaterials("secretariat"),
     loadNotarySourceRun: loadNotarySourceRunLocator,
     loadMergerSoul: () => loadMainRoleSessionMaterials("merger"),
-    loadMergerInput: async (path) => JSON.parse(await readFile23(path, "utf8")),
+    loadMergerInput: async (path) => JSON.parse(await readFile22(path, "utf8")),
     async loadCanonicalSkillBinding(name) {
       if (name === "tdd") {
         return loadPackagedCanonicalSkillBinding(packageRoot, "tdd");
@@ -26778,7 +27003,7 @@ function createRoleRuntimeDependencies(packageRoot) {
       authority: options.authority,
       invocationId: options.invocationId,
       loadSoul: () => loadMainRoleSessionMaterials("navigator"),
-      loadRoutePlaybook: () => readFile23(navigatorRoutePlaybookPath, "utf8"),
+      loadRoutePlaybook: () => readFile22(navigatorRoutePlaybookPath, "utf8"),
       loadRoleHelp: async (role) => formatNavigatorRoleHelp(role),
       createSession: navigatorSessionFactory,
       ...options.contextError === void 0 ? {} : { contextError: options.contextError },
@@ -26791,9 +27016,9 @@ function createRoleRuntimeDependencies(packageRoot) {
 init_session_identity();
 
 // src/acp-host/description.ts
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 function resolveAcpBinary(description, operatorHome) {
-  return join41(operatorHome, ...description.binaryFromHome);
+  return join42(operatorHome, ...description.binaryFromHome);
 }
 function acpStdioArgs(description, model, seat) {
   const { prefix, suffix, modelFlag, thinkingFlag } = description.argv;
@@ -27239,13 +27464,13 @@ function createAcpRoleTurnHost(config) {
 
 // src/acp-host/seat-profile-soul.ts
 import { constants as constants3 } from "node:fs";
-import { access as access4, copyFile, lstat as lstat7, mkdir as mkdir6, readlink, symlink, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname24, join as join42, relative as relative3, resolve as resolve20 } from "node:path";
+import { access as access4, copyFile, lstat as lstat8, mkdir as mkdir7, readlink as readlink2, symlink as symlink2, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname25, join as join43, relative as relative3, resolve as resolve20 } from "node:path";
 function seatProfileName(spec, role) {
   return `${spec.namePrefix}${role}`;
 }
 function packageRoleSoulPath(packageRoot, role) {
-  return join42(packageRoot, "souls", `${role}.md`);
+  return join43(packageRoot, "souls", `${role}.md`);
 }
 async function pathExists2(path) {
   try {
@@ -27262,26 +27487,26 @@ async function ensureSeatProfileSoul(options) {
   if (!await pathExists2(soulTarget)) {
     throw new Error(`packaged role soul missing: ${soulTarget}`);
   }
-  const profilesRoot = join42(operatorHome, ...spec.profilesRootFromHome);
-  const profileDir = join42(profilesRoot, profileName);
-  const hostRoot = dirname24(profilesRoot);
-  const soulPath = join42(profileDir, spec.soulFileName);
+  const profilesRoot = join43(operatorHome, ...spec.profilesRootFromHome);
+  const profileDir = join43(profilesRoot, profileName);
+  const hostRoot = dirname25(profilesRoot);
+  const soulPath = join43(profileDir, spec.soulFileName);
   if (!await pathExists2(profileDir)) {
-    await mkdir6(profileDir, { recursive: true });
+    await mkdir7(profileDir, { recursive: true });
     for (const name of ["auth.json", ".env", "config.yaml"]) {
-      const source = join42(hostRoot, name);
+      const source = join43(hostRoot, name);
       if (!await pathExists2(source)) continue;
-      await copyFile(source, join42(profileDir, name));
+      await copyFile(source, join43(profileDir, name));
     }
   } else {
-    await mkdir6(profileDir, { recursive: true });
+    await mkdir7(profileDir, { recursive: true });
   }
   const desiredLink = relative3(profileDir, soulTarget);
   let current;
   try {
-    const st = await lstat7(soulPath);
+    const st = await lstat8(soulPath);
     if (st.isSymbolicLink()) {
-      current = await readlink(soulPath);
+      current = await readlink2(soulPath);
     }
   } catch {
     current = void 0;
@@ -27292,7 +27517,7 @@ async function ensureSeatProfileSoul(options) {
   if (await pathExists2(soulPath) || current !== void 0) {
     await unlink3(soulPath);
   }
-  await symlink(desiredLink, soulPath);
+  await symlink2(desiredLink, soulPath);
   return profileName;
 }
 
@@ -27312,7 +27537,6 @@ function createProductionAcpRoleTurnHost(options) {
   const { packageRoot, principalAuthority, description, hostName } = options;
   const env = {
     ...process.env,
-    ...description.childEnv,
     AK_PACKAGE_ROOT: packageRoot
   };
   return createComposedAcpRoleTurnHost({