@akagilnc/pi-workflow-roles 0.1.4620 → 0.1.4641

package/src/public-cli/post-admission.ts

@@ -87,6 +87,11 @@ import {
   type TypedProviderHttpObservation,
   type WriterLeaseDiagnosticKind,
 } from "./run-lifecycle.ts";
+import {
+  processCancelDiagnostic,
+  processCancelSignalName,
+  type CatchableProcessSignal,
+} from "./process-cancel.ts";
 import { homeFromRunDirectory } from "../activation-ledger-topology.ts";
 import {
   attemptProducedFreshSubmission,
@@ -119,6 +124,63 @@ import {
   TurnDispatchedFailure,
 } from "./auto-resume.ts";
 
+/** #855: process-cancel settlement never re-enters auto-resume. */
+function withProcessCancelSkipAutoResume<T extends object>(
+  result: T,
+  signal: AbortSignal | undefined,
+): T & { skipAutoResume?: true } {
+  if (processCancelSignalName(signal) === undefined) {
+    return result as T & { skipAutoResume?: true };
+  }
+  return { ...result, skipAutoResume: true as const };
+}
+
+/**
+ * #855: turn already started, then a catchable process signal arrived before
+ * lawful seal — settle as named cancel failure and skip auto-resume.
+ */
+async function settleProcessCancelAfterTurn<A extends AdmittedRoleInvocation, T extends TerminalResult>(input: {
+  admitted: A;
+  cancelName: CatchableProcessSignal;
+  result: RoleTurnResult;
+  adapters: PostAdmissionAdapters<A, T>;
+  env: PostAdmissionEnv;
+  io: CliIo;
+  persistRunState: boolean;
+  deferredPersist: { needsPersist?: true } | Record<string, never>;
+  invocationScopeId: string | undefined;
+}): Promise<{
+  exitCode: number;
+  admitted: A;
+  terminal?: T;
+  skipAutoResume?: true;
+  turnDispatched?: true;
+  needsPersist?: true;
+}> {
+  const failed = await settleAfterTurnStarted(
+    input.admitted,
+    withEngineDetourInvocationScope(
+      {
+        timedOut: input.result.timedOut,
+        code: input.result.code,
+        stderr: input.result.stderr,
+        knownDiagnostic: processCancelDiagnostic(input.cancelName),
+      },
+      input.invocationScopeId,
+    ),
+    input.adapters,
+    input.env.principalAuthority,
+    input.io,
+    input.persistRunState,
+  );
+  return {
+    ...failed,
+    turnDispatched: true as const,
+    skipAutoResume: true as const,
+    ...input.deferredPersist,
+  };
+}
+
 /**
  * Nested station-child role already finished its own call-local loop.
  * Parent records that failure once and must not auto-resume into a re-summon
@@ -587,6 +649,38 @@ export async function dispatchPostAdmissionTurn<
   const finishAfterTurn = async (result: DispatchOutcome): Promise<DispatchOutcome> => {
     if (afterDispatchApplied) return result;
     afterDispatchApplied = true;
+    // #855: re-read cancel before afterDispatch finalization — never present
+    // lawful success after a catchable process signal. skipRunStateWrite: run-state
+    // may already be terminal from a prior lawful persist; do not reopen as resumable.
+    const cancelBeforeFinish = processCancelSignalName(env.signal);
+    if (
+      cancelBeforeFinish !== undefined &&
+      result.terminal !== undefined &&
+      isLawfulTypedTerminalOutcome(result.terminal.roleOutcome)
+    ) {
+      result = {
+        ...(await settleAfterTurnStarted(
+          admitted,
+          withEngineDetourInvocationScope(
+            {
+              timedOut: false,
+              code: null,
+              stderr: "",
+              knownDiagnostic: processCancelDiagnostic(cancelBeforeFinish),
+              skipRunStateWrite: true,
+            },
+            request.invocationScopeId,
+          ),
+          adapters,
+          env.principalAuthority,
+          io,
+          persistRunState,
+        )),
+        turnDispatched: true as const,
+        skipAutoResume: true as const,
+        ...deferredPersist,
+      };
+    }
     try {
       // #858: an unbound seat may assert its ticket on the existing receipt.
       // Read the original accepted payload; do not rewrite it, infer from prose,
@@ -788,20 +882,29 @@ export async function dispatchPostAdmissionTurn<
     try {
       result = await env.roleTurnHost.executeTurn(turnRequest);
     } catch (error) {
+      const processCancelName = processCancelSignalName(env.signal);
       const settled = await settleAfterTurnStarted(
           admitted,
           withEngineDetourInvocationScope({
           timedOut: false,
           code: null,
           stderr: "",
-          thrown: error,
+          thrown:
+            processCancelName === undefined
+              ? error
+              : new Error(processCancelDiagnostic(processCancelName), { cause: error }),
         }, request.invocationScopeId),
         adapters,
         env.principalAuthority,
         io,
         persistRunState,
       );
-      return await finishAfterTurn({ ...settled, turnDispatched: true as const, ...deferredPersist });
+      return await finishAfterTurn(
+        withProcessCancelSkipAutoResume(
+          { ...settled, turnDispatched: true as const, ...deferredPersist },
+          env.signal,
+        ),
+      );
     }
 
     // `result.stderr` stays live in memory for the real classification below
@@ -917,11 +1020,13 @@ export async function dispatchPostAdmissionTurn<
       // retroactively invalidate an acceptance that already sealed this turn
       // — a resolved 429 observed earlier in the same session is exactly
       // that.
+      const processCancelName = processCancelSignalName(env.signal);
       const directHostFailureSignal =
         result.timedOut
         || result.knownFailure !== undefined
         || runnerKnownFailure !== undefined
-        || credentialFailure !== undefined;
+        || credentialFailure !== undefined
+        || processCancelName !== undefined;
       hostSignalFailed =
         directHostFailureSignal
         || (result.code !== null && result.code !== 0)
@@ -959,12 +1064,16 @@ export async function dispatchPostAdmissionTurn<
       // where a bare nonzero exit / resolution failure must not be outranked
       // by someone else's earlier success (#836 r12 class 2).
       const staleAcceptanceOutranksRealFailure = !settledIsFreshThisAttempt && hostSignalFailed;
+      // #855: re-read cancel after trySettle/attach awaits — a signal in this
+      // window must not land as lawful accepted.
+      const cancelAfterSettle = processCancelSignalName(env.signal);
       if (
         settled !== undefined
         && shouldPresent(settled)
         && !directHostFailureSignal
         && !staleAcceptanceOutranksRealFailure
         && stderrLogWriteFailure === undefined
+        && cancelAfterSettle === undefined
       ) {
         // This court sealed — drop open-court pointer (bare resume no longer continues it).
         if (
@@ -1017,6 +1126,24 @@ export async function dispatchPostAdmissionTurn<
       return await finishAfterTurn({ ...settledFailure, turnDispatched: true as const, ...deferredPersist });
     }
     if (settledOutcome !== undefined) {
+      // #855: final cancel re-read before lawful seal — settlement window may
+      // have received SIGTERM/SIGINT/SIGHUP after the earlier snapshot.
+      const lateCancel = processCancelSignalName(env.signal);
+      if (lateCancel !== undefined) {
+        return await finishAfterTurn(
+          await settleProcessCancelAfterTurn({
+            admitted,
+            cancelName: lateCancel,
+            result,
+            adapters,
+            env,
+            io,
+            persistRunState,
+            deferredPersist,
+            invocationScopeId: request.invocationScopeId,
+          }),
+        );
+      }
       if (persistRunState) {
         try {
           await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
@@ -1045,17 +1172,24 @@ export async function dispatchPostAdmissionTurn<
             io,
             persistRunState,
           );
-          return await finishAfterTurn({ ...failed, turnDispatched: true as const, ...deferredPersist });
+          return await finishAfterTurn(
+            withProcessCancelSkipAutoResume(
+              { ...failed, turnDispatched: true as const, ...deferredPersist },
+              env.signal,
+            ),
+          );
         }
       }
       // Lawful persist + present is the caller's stop seam (auto-resume loop /
       // manual resume), not this retried host-turn function.
+      // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
       return await finishAfterTurn({ ...settledOutcome, ...deferredPersist });
     }
 
     // Host/runner true failure coexists with already-recorded payloads — never wash as accepted.
     if (hostSignalFailed) {
       const resolutionInput = controlledFailureInputFromResolution(resolution!);
+      const processCancelName = processCancelSignalName(env.signal);
       const stderrLogWriteDetails =
         stderrLogWriteFailure === undefined
           ? undefined
@@ -1067,6 +1201,9 @@ export async function dispatchPostAdmissionTurn<
           code: result.code,
           stderr: result.stderr,
           ...resolutionInput,
+          ...(processCancelName === undefined
+            ? {}
+            : { knownDiagnostic: processCancelDiagnostic(processCancelName) }),
           // Secondary fact only — never the cause. Rides on whichever channel
           // classification actually reads (knownFailure.details owns it when
           // a knownFailure exists; the top-level knownDetails otherwise).
@@ -1086,7 +1223,12 @@ export async function dispatchPostAdmissionTurn<
         io,
         persistRunState,
       );
-      return await finishAfterTurn({ ...failed, turnDispatched: true as const, ...deferredPersist });
+      return await finishAfterTurn(
+        withProcessCancelSkipAutoResume(
+          { ...failed, turnDispatched: true as const, ...deferredPersist },
+          env.signal,
+        ),
+      );
     }
 
     // Nothing else was wrong, but the durable stderr mirror itself failed to
@@ -1114,6 +1256,23 @@ export async function dispatchPostAdmissionTurn<
       await settleHostEndedNoReceipt(admitted, env.principalAuthority, courtScope) as T,
       courtScope,
     );
+    // #855: cancel during no_receipt settlement window is not lawful success.
+    const noReceiptCancel = processCancelSignalName(env.signal);
+    if (noReceiptCancel !== undefined) {
+      return await finishAfterTurn(
+        await settleProcessCancelAfterTurn({
+          admitted,
+          cancelName: noReceiptCancel,
+          result,
+          adapters,
+          env,
+          io,
+          persistRunState,
+          deferredPersist,
+          invocationScopeId: request.invocationScopeId,
+        }),
+      );
+    }
     if (persistRunState) {
       try {
         await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
@@ -1137,9 +1296,15 @@ export async function dispatchPostAdmissionTurn<
           io,
           persistRunState,
         );
-        return await finishAfterTurn({ ...failed, turnDispatched: true as const, ...deferredPersist });
+        return await finishAfterTurn(
+          withProcessCancelSkipAutoResume(
+            { ...failed, turnDispatched: true as const, ...deferredPersist },
+            env.signal,
+          ),
+        );
       }
     }
+    // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
     return await finishAfterTurn({
       exitCode: exitCodeForTerminalOutcome(noReceipt.roleOutcome),
       admitted,
@@ -1512,6 +1677,7 @@ export async function runPostAdmissionSeatResume<
         io: input.io,
         sessionAppender: env.sessionAppender,
         autoResumeLimit: env.autoResumeLimit,
+        ...(env.signal === undefined ? {} : { signal: env.signal }),
         buildInitialPayload: (): StationChildAttempt => ({ resumeTurn: false }),
         buildResumePayload: (): StationChildAttempt => ({ resumeTurn: true }),
         // Same as public manual resume: prior-court sealed acceptance is not a
@@ -1678,6 +1844,7 @@ export async function runPostAdmissionResumable<
     io,
     sessionAppender: env.sessionAppender,
     autoResumeLimit: env.autoResumeLimit,
+    ...(env.signal === undefined ? {} : { signal: env.signal }),
     buildInitialPayload: buildScopedInitial,
     buildResumePayload: buildScopedResume,
     dispatch: async (request, lease, _isFirst, attemptIo) => {

package/src/public-cli/process-cancel.ts

@@ -0,0 +1,75 @@
+/**
+ * #855: catchable process signals for ak-role public entry.
+ * SIGTERM / SIGINT / SIGHUP abort the shared controller so hosts can gracefully
+ * terminate children (SIGTERM only, never SIGKILL). Uncatchable death (SIGKILL,
+ * crash, power loss) is reported via run-state + writer lease on analyst.
+ */
+
+const CATCHABLE_PROCESS_SIGNALS = ["SIGTERM", "SIGINT", "SIGHUP"] as const;
+
+export type CatchableProcessSignal = (typeof CATCHABLE_PROCESS_SIGNALS)[number];
+
+export type ProcessCancelHandle = {
+  readonly signal: AbortSignal;
+  /** Signal name once a catchable signal has been received; else undefined. */
+  readonly receivedSignal: () => CatchableProcessSignal | undefined;
+  dispose(): void;
+};
+
+/**
+ * Install once per process entry. First catchable signal wins; later signals
+ * are ignored so settlement can finish without re-entry storms.
+ */
+export function installProcessCancelHandlers(
+  processRef: NodeJS.Process = process,
+): ProcessCancelHandle {
+  const controller = new AbortController();
+  let received: CatchableProcessSignal | undefined;
+  const listeners = new Map<CatchableProcessSignal, () => void>();
+
+  for (const sig of CATCHABLE_PROCESS_SIGNALS) {
+    const onSignal = (): void => {
+      if (received !== undefined) return;
+      received = sig;
+      try {
+        controller.abort(sig);
+      } catch {
+        // already aborted
+      }
+    };
+    listeners.set(sig, onSignal);
+    processRef.on(sig, onSignal);
+  }
+
+  return {
+    signal: controller.signal,
+    receivedSignal: () => received,
+    dispose(): void {
+      for (const [sig, onSignal] of listeners) {
+        processRef.off(sig, onSignal);
+      }
+      listeners.clear();
+    },
+  };
+}
+
+/** Signal name when this AbortSignal was aborted by installProcessCancelHandlers. */
+export function processCancelSignalName(
+  signal: AbortSignal | undefined,
+): CatchableProcessSignal | undefined {
+  if (signal === undefined || signal.aborted !== true) return undefined;
+  const reason = signal.reason;
+  if (
+    reason === "SIGTERM" ||
+    reason === "SIGINT" ||
+    reason === "SIGHUP"
+  ) {
+    return reason;
+  }
+  return undefined;
+}
+
+/** Diagnostic line for a catchable process-signal termination (failure honesty). */
+export function processCancelDiagnostic(signalName: CatchableProcessSignal): string {
+  return `ak-role terminated by ${signalName}`;
+}

package/src/public-cli/settlement.ts

@@ -94,6 +94,8 @@ import {
   DIARIST_OUTPUT_TOOL_NAME,
 } from "../diarist-contracts.ts";
 import {
+  SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY,
+  SECRETARIAT_GATE_OFFICER_ENTRY_TYPE,
   SECRETARIAT_OUTPUT_TOOL_NAME,
 } from "../secretariat-contracts.ts";
 import {
@@ -3333,15 +3335,129 @@ export async function trySettleDiaristTerminalResult(
   return settleLawfulDiaristTerminalResult(admitted, authority, scope);
 }
 
+/**
+ * #969 seat projection sole authority: 给事中 terminal (署|上呈) booked as a
+ * durable custom entry (envelope-safe) — ledger accepted stays LLM params (#836).
+ * Never scan toolResult rows: those are memory-only on headless/ACP (#617/#959).
+ * Receipt bytes stay original; nested runId rides beside them.
+ * Caller must only apply this when the terminal-defining submission actually
+ * produced the officer entry (gate-bound converged, or 给事中 audit_escalation).
+ */
+function countersignTerminalFromEntries(
+  entries: readonly {
+    type?: string;
+    customType?: string;
+    data?: unknown;
+  }[],
+): import("../secretariat-contracts.ts").SecretariatCountersignTerminalFact | undefined {
+  for (let index = entries.length - 1; index >= 0; index -= 1) {
+    const entry = entries[index];
+    if (entry?.type !== "custom") continue;
+    if (entry.customType !== SECRETARIAT_GATE_OFFICER_ENTRY_TYPE) continue;
+    const data =
+      entry.data !== null && typeof entry.data === "object" && !Array.isArray(entry.data)
+        ? (entry.data as Record<string, unknown>)
+        : undefined;
+    if (data?.officer !== "countersign") continue;
+    if (data.receipt === undefined) continue;
+    const runId =
+      typeof data.runId === "string" && data.runId.trim() !== ""
+        ? data.runId
+        : undefined;
+    return {
+      receipt: data.receipt,
+      ...(runId === undefined ? {} : { runId }),
+    };
+  }
+  return undefined;
+}
+
+function withCountersignTerminalFact(
+  roleOutcome: Extract<
+    import("./terminal.ts").TerminalRoleOutcome,
+    { kind: "accepted" | "audit_escalation" }
+  >,
+  officer: import("../secretariat-contracts.ts").SecretariatCountersignTerminalFact,
+): typeof roleOutcome {
+  const prior =
+    roleOutcome.decisiveFacts !== undefined && isRecord(roleOutcome.decisiveFacts)
+      ? roleOutcome.decisiveFacts
+      : {};
+  return {
+    ...roleOutcome,
+    decisiveFacts: {
+      ...prior,
+      [SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY]: officer,
+    },
+  };
+}
+
+/**
+ * Terminal-defining secretariat submission owns officer projection.
+ * Last readable secretariatStatus on accepted payloads decides: only gate-bound
+ * converged projects a prior durable officer entry. Parent escalate bypasses the
+ * gate and must not inherit a stale pass entry from an earlier turn (#969).
+ */
+function acceptedSecretariatDefinesOfficerProjection(
+  roleOutcome: Extract<
+    import("./terminal.ts").TerminalRoleOutcome,
+    { kind: "accepted" }
+  >,
+): boolean {
+  const payloads = roleOutcome.payloads ?? [];
+  for (let index = payloads.length - 1; index >= 0; index -= 1) {
+    const payload = payloads[index];
+    if (!isRecord(payload)) continue;
+    const status = payload.secretariatStatus;
+    if (typeof status !== "string") continue;
+    return status === "converged";
+  }
+  return false;
+}
+
 async function settleLawfulSecretariatTerminalResult(
   admitted: AdmittedSecretariatInvocation,
   authority: DurablePrincipalAuthority,
   scope?: SettlementCourtScope,
 ): Promise<TerminalResult | undefined> {
-  return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+  const settled = await settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
     role: "secretariat",
     toolName: SECRETARIAT_OUTPUT_TOOL_NAME,
   }, scope);
+  if (settled === undefined) return undefined;
+  const coordinates = coordinatesFromAdmitted(authority, admitted);
+  const entries = await readLawfulSettlementEntries(coordinates.sessionFile) ?? [];
+  const officer = countersignTerminalFromEntries(entries);
+  if (officer === undefined) return settled;
+
+  // 给事中上呈: public payloads = officer receipt; runId + receipt fact beside.
+  // This kind is produced only when beforeAccept booked the officer entry.
+  if (settled.roleOutcome.kind === "audit_escalation") {
+    return {
+      ...settled,
+      roleOutcome: withCountersignTerminalFact(
+        {
+          ...settled.roleOutcome,
+          payloads: [officer.receipt],
+        },
+        officer,
+      ),
+    };
+  }
+
+  // Pass (署): keep 中书省 payloads; present 给事中 判词 + runId via decisiveFacts.
+  // Parent escalate accepted terminal must not project a stale prior pass entry.
+  if (settled.roleOutcome.kind === "accepted") {
+    if (!acceptedSecretariatDefinesOfficerProjection(settled.roleOutcome)) {
+      return settled;
+    }
+    return {
+      ...settled,
+      roleOutcome: withCountersignTerminalFact(settled.roleOutcome, officer),
+    };
+  }
+
+  return settled;
 }
 
 /** Try to settle a lawful Secretariat Terminal; undefined only for genuine absence. */

package/src/public-role-summons.ts

@@ -1040,9 +1040,9 @@ export async function summonParallelReviewerLenses(options: {
   return results;
 }
 
-/** Gate officer summons: notary/auditor via --source-run; inspector via pointer instruction. */
+/** Gate officer summons: notary/auditor via --source-run; inspector via pointer; countersign via ticket (#969). */
 export async function summonGateOfficer(options: {
-  readonly officer: "inspector" | "notary" | "auditor";
+  readonly officer: "inspector" | "notary" | "auditor" | "countersign";
   readonly sourceRunDirectory: string;
   readonly cwd: string;
   readonly home?: string;
@@ -1052,14 +1052,14 @@ export async function summonGateOfficer(options: {
   readonly signal?: AbortSignal;
   /**
    * Plain-language re-ask when the prior officer reply was not three-state (#753 / #756).
-   * All three officers: reviewReask → same-ticket resume summons.instruction.
+   * Officers: reviewReask → same-ticket resume summons.instruction.
    * Never concatenated into argv (inspector parentRunPath is the pure 卷宗指针).
    */
   readonly reask?: string;
   /**
    * In-flight parent 交卷 body (tool-call arguments). Relayed verbatim as officer
    * dialogue content when reask is absent (#879). Binding pointer stays on
-   * --source-run / 卷宗指针 argv — never a content substitute.
+   * --source-run / 卷宗指针 / ticket argv — never a content substitute.
    */
   readonly submission?: unknown;
   /** Pi-adapter inject — forwarded to summonPublicRole (not a parent-host override). */
@@ -1121,6 +1121,32 @@ export async function summonGateOfficer(options: {
       ...common,
     });
   }
+  if (options.officer === "countersign") {
+    // #969: Secretariat submission gate → 给事中.
+    // Dialogue / identity instruction = parent typed payload 原话 (ADR 0079) or reask;
+    // no code-authored summons prose (#924). Ticket identity = parent run durable
+    // board binding only (readBoardTicketNumber) — receipt ticketNumber is payload
+    // content, never the sole identity source; parent true-unbound stays unbound.
+    // correlationId only on this officer — notary/auditor/inspector stay untouched.
+    const { runIdFromRunDirectory } = await import("./run-terminal-artifacts.ts");
+    const correlationId = runIdFromRunDirectory(options.sourceRunDirectory);
+    if (correlationId === undefined || correlationId.trim() === "") {
+      throw new Error(
+        `countersign gate summon requires parent runId from sourceRunDirectory: ${options.sourceRunDirectory}`,
+      );
+    }
+    const { readBoardTicketNumber } = await import("./run-ticket-number.ts");
+    const parentTicket = await readBoardTicketNumber(options.sourceRunDirectory);
+    // Argv instruction = reask or parent payload bytes only (never a fabricated line).
+    const instruction = options.reask ?? gateReviewInstruction ?? "";
+    return summonPublicRole({
+      role: "countersign",
+      argv: ["--project", options.cwd, "--", instruction],
+      ...common,
+      correlationId,
+      ...(parentTicket === undefined ? {} : { boundTicketNumber: parentTicket }),
+    });
+  }
   // Inspector: argv stays pure 卷宗指针 (#747 parentRunPath lookup key).
   // Content (body/reask) rides env → summons.instruction / first-mint prompt.
   return summonPublicRole({

package/src/role-envelope.ts

@@ -9,7 +9,10 @@ import {
   ENGINE_MODEL_FLAG_NAME,
   normalizeEngineName,
 } from "./engine-detour.ts";
-import { requireGatekeeperPass } from "./gatekeeper-pass-envelope.ts";
+import {
+  createDefaultGateOfficerSummon,
+  requireGatekeeperPass,
+} from "./gatekeeper-pass-envelope.ts";
 import type {
   HostContext,
   HostEventRegistration,
@@ -229,18 +232,32 @@ export async function prepareRoleEnvelope(options: {
     // seat remains reachable through MCP.
     setActiveTools(names) { preferredTools = [...names]; },
     getActiveTools() { return [...preferredTools]; },
-    async requireGatekeeperPass(options) {
-      await requireGatekeeperPass({
-        context: options.context,
-        subject: options.subject,
-        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    async requireGatekeeperPass(gateOptions) {
+      const packageRoot =
+        typeof options.dependencies.packageRoot === "string"
+          ? options.dependencies.packageRoot
+          : undefined;
+      return requireGatekeeperPass({
+        context: gateOptions.context,
+        subject: gateOptions.subject,
+        ...(gateOptions.signal === undefined ? {} : { signal: gateOptions.signal }),
         hostActions: {
           failInfrastructure: (error, _context, toolCallId) =>
-            options.hostActions.failInfrastructure(error, options.context, toolCallId),
-          bindSubmissionNonPass: options.hostActions.bindSubmissionNonPass,
+            gateOptions.hostActions.failInfrastructure(error, gateOptions.context, toolCallId),
+          bindSubmissionNonPass: gateOptions.hostActions.bindSubmissionNonPass,
         },
-        toolCallId: options.toolCallId,
-        ...(options.submission === undefined ? {} : { submission: options.submission }),
+        toolCallId: gateOptions.toolCallId,
+        ...(gateOptions.submission === undefined ? {} : { submission: gateOptions.submission }),
+        // #969: package root + home reach nested 给事中/符宝郎 summons.
+        // hostAdapters (when set on deps) forward nested seat selection — production unset.
+        summonOfficer: createDefaultGateOfficerSummon({
+          cwd: gateOptions.context.cwd ?? request.cwd,
+          home: request.home,
+          ...(packageRoot === undefined ? {} : { packageRoot }),
+          ...(options.dependencies.hostAdapters === undefined
+            ? {}
+            : { hostAdapters: options.dependencies.hostAdapters }),
+        }),
       });
     },
     on(...registration: HostEventRegistration) {