@akagilnc/pi-workflow-roles 0.1.4620 → 0.1.4641

package/dist/public-cli/post-admission.js

@@ -37,10 +37,36 @@ import { mintEngineDetourInvocationScope, readInvocationSelectedHost, withEngine
 import { projectHostTransitionPriorNative } from "../host-transition-prior-native.js";
 import { missingCredentialPreDispatchFailure, postRunMissingCredentialFailure, } from "./public-run-credentials.js";
 import { acquireRunWriterLease, clearCurrentCourt, clearTypedProviderHttpObservation, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, renderResumeCommand, RunWriterLeaseHeldError, } from "./run-lifecycle.js";
+import { processCancelDiagnostic, processCancelSignalName, } from "./process-cancel.js";
 import { homeFromRunDirectory } from "../activation-ledger-topology.js";
 import { attemptProducedFreshSubmission, classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, settleHostEndedNoReceipt, attachRecordedSubmissions, } from "./settlement.js";
 import {} from "./terminal.js";
 import { ensureRealArtifactsDirectory, persistReturnedRunState, runWithAutoResumeLoop, TurnDispatchedFailure, } from "./auto-resume.js";
+/** #855: process-cancel settlement never re-enters auto-resume. */
+function withProcessCancelSkipAutoResume(result, signal) {
+    if (processCancelSignalName(signal) === undefined) {
+        return result;
+    }
+    return { ...result, skipAutoResume: true };
+}
+/**
+ * #855: turn already started, then a catchable process signal arrived before
+ * lawful seal — settle as named cancel failure and skip auto-resume.
+ */
+async function settleProcessCancelAfterTurn(input) {
+    const failed = await settleAfterTurnStarted(input.admitted, withEngineDetourInvocationScope({
+        timedOut: input.result.timedOut,
+        code: input.result.code,
+        stderr: input.result.stderr,
+        knownDiagnostic: processCancelDiagnostic(input.cancelName),
+    }, input.invocationScopeId), input.adapters, input.env.principalAuthority, input.io, input.persistRunState);
+    return {
+        ...failed,
+        turnDispatched: true,
+        skipAutoResume: true,
+        ...input.deferredPersist,
+    };
+}
 /**
  * Nested station-child role already finished its own call-local loop.
  * Parent records that failure once and must not auto-resume into a re-summon
@@ -258,6 +284,26 @@ export async function dispatchPostAdmissionTurn(input) {
         if (afterDispatchApplied)
             return result;
         afterDispatchApplied = true;
+        // #855: re-read cancel before afterDispatch finalization — never present
+        // lawful success after a catchable process signal. skipRunStateWrite: run-state
+        // may already be terminal from a prior lawful persist; do not reopen as resumable.
+        const cancelBeforeFinish = processCancelSignalName(env.signal);
+        if (cancelBeforeFinish !== undefined &&
+            result.terminal !== undefined &&
+            isLawfulTypedTerminalOutcome(result.terminal.roleOutcome)) {
+            result = {
+                ...(await settleAfterTurnStarted(admitted, withEngineDetourInvocationScope({
+                    timedOut: false,
+                    code: null,
+                    stderr: "",
+                    knownDiagnostic: processCancelDiagnostic(cancelBeforeFinish),
+                    skipRunStateWrite: true,
+                }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState)),
+                turnDispatched: true,
+                skipAutoResume: true,
+                ...deferredPersist,
+            };
+        }
         try {
             // #858: an unbound seat may assert its ticket on the existing receipt.
             // Read the original accepted payload; do not rewrite it, infer from prose,
@@ -412,13 +458,16 @@ export async function dispatchPostAdmissionTurn(input) {
             result = await env.roleTurnHost.executeTurn(turnRequest);
         }
         catch (error) {
+            const processCancelName = processCancelSignalName(env.signal);
             const settled = await settleAfterTurnStarted(admitted, withEngineDetourInvocationScope({
                 timedOut: false,
                 code: null,
                 stderr: "",
-                thrown: error,
+                thrown: processCancelName === undefined
+                    ? error
+                    : new Error(processCancelDiagnostic(processCancelName), { cause: error }),
             }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
-            return await finishAfterTurn({ ...settled, turnDispatched: true, ...deferredPersist });
+            return await finishAfterTurn(withProcessCancelSkipAutoResume({ ...settled, turnDispatched: true, ...deferredPersist }, env.signal));
         }
         // `result.stderr` stays live in memory for the real classification below
         // regardless of whether this durable mirror write succeeds. A write
@@ -514,10 +563,12 @@ export async function dispatchPostAdmissionTurn(input) {
             // retroactively invalidate an acceptance that already sealed this turn
             // — a resolved 429 observed earlier in the same session is exactly
             // that.
+            const processCancelName = processCancelSignalName(env.signal);
             const directHostFailureSignal = result.timedOut
                 || result.knownFailure !== undefined
                 || runnerKnownFailure !== undefined
-                || credentialFailure !== undefined;
+                || credentialFailure !== undefined
+                || processCancelName !== undefined;
             hostSignalFailed =
                 directHostFailureSignal
                     || (result.code !== null && result.code !== 0)
@@ -553,11 +604,15 @@ export async function dispatchPostAdmissionTurn(input) {
             // where a bare nonzero exit / resolution failure must not be outranked
             // by someone else's earlier success (#836 r12 class 2).
             const staleAcceptanceOutranksRealFailure = !settledIsFreshThisAttempt && hostSignalFailed;
+            // #855: re-read cancel after trySettle/attach awaits — a signal in this
+            // window must not land as lawful accepted.
+            const cancelAfterSettle = processCancelSignalName(env.signal);
             if (settled !== undefined
                 && shouldPresent(settled)
                 && !directHostFailureSignal
                 && !staleAcceptanceOutranksRealFailure
-                && stderrLogWriteFailure === undefined) {
+                && stderrLogWriteFailure === undefined
+                && cancelAfterSettle === undefined) {
                 // This court sealed — drop open-court pointer (bare resume no longer continues it).
                 if (settled.roleOutcome.kind === "accepted" &&
                     request.courtAttemptId !== undefined &&
@@ -597,6 +652,22 @@ export async function dispatchPostAdmissionTurn(input) {
             return await finishAfterTurn({ ...settledFailure, turnDispatched: true, ...deferredPersist });
         }
         if (settledOutcome !== undefined) {
+            // #855: final cancel re-read before lawful seal — settlement window may
+            // have received SIGTERM/SIGINT/SIGHUP after the earlier snapshot.
+            const lateCancel = processCancelSignalName(env.signal);
+            if (lateCancel !== undefined) {
+                return await finishAfterTurn(await settleProcessCancelAfterTurn({
+                    admitted,
+                    cancelName: lateCancel,
+                    result,
+                    adapters,
+                    env,
+                    io,
+                    persistRunState,
+                    deferredPersist,
+                    invocationScopeId: request.invocationScopeId,
+                }));
+            }
             if (persistRunState) {
                 try {
                     await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
@@ -619,16 +690,18 @@ export async function dispatchPostAdmissionTurn(input) {
                         thrown: error,
                         skipRunStateWrite: true,
                     }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
-                    return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
+                    return await finishAfterTurn(withProcessCancelSkipAutoResume({ ...failed, turnDispatched: true, ...deferredPersist }, env.signal));
                 }
             }
             // Lawful persist + present is the caller's stop seam (auto-resume loop /
             // manual resume), not this retried host-turn function.
+            // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
             return await finishAfterTurn({ ...settledOutcome, ...deferredPersist });
         }
         // Host/runner true failure coexists with already-recorded payloads — never wash as accepted.
         if (hostSignalFailed) {
             const resolutionInput = controlledFailureInputFromResolution(resolution);
+            const processCancelName = processCancelSignalName(env.signal);
             const stderrLogWriteDetails = stderrLogWriteFailure === undefined
                 ? undefined
                 : { stderrLogWriteFailure: describeCaughtError(stderrLogWriteFailure) };
@@ -637,6 +710,9 @@ export async function dispatchPostAdmissionTurn(input) {
                 code: result.code,
                 stderr: result.stderr,
                 ...resolutionInput,
+                ...(processCancelName === undefined
+                    ? {}
+                    : { knownDiagnostic: processCancelDiagnostic(processCancelName) }),
                 // Secondary fact only — never the cause. Rides on whichever channel
                 // classification actually reads (knownFailure.details owns it when
                 // a knownFailure exists; the top-level knownDetails otherwise).
@@ -651,7 +727,7 @@ export async function dispatchPostAdmissionTurn(input) {
                         }
                         : { knownDetails: stderrLogWriteDetails }),
             }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
-            return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
+            return await finishAfterTurn(withProcessCancelSkipAutoResume({ ...failed, turnDispatched: true, ...deferredPersist }, env.signal));
         }
         // Nothing else was wrong, but the durable stderr mirror itself failed to
         // write — that is the real (infrastructure) problem in this case, not a
@@ -666,6 +742,21 @@ export async function dispatchPostAdmissionTurn(input) {
             return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
         }
         const noReceipt = await attachRecordedSubmissions(admitted, await settleHostEndedNoReceipt(admitted, env.principalAuthority, courtScope), courtScope);
+        // #855: cancel during no_receipt settlement window is not lawful success.
+        const noReceiptCancel = processCancelSignalName(env.signal);
+        if (noReceiptCancel !== undefined) {
+            return await finishAfterTurn(await settleProcessCancelAfterTurn({
+                admitted,
+                cancelName: noReceiptCancel,
+                result,
+                adapters,
+                env,
+                io,
+                persistRunState,
+                deferredPersist,
+                invocationScopeId: request.invocationScopeId,
+            }));
+        }
         if (persistRunState) {
             try {
                 await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
@@ -683,9 +774,10 @@ export async function dispatchPostAdmissionTurn(input) {
                     thrown: error,
                     skipRunStateWrite: true,
                 }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
-                return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
+                return await finishAfterTurn(withProcessCancelSkipAutoResume({ ...failed, turnDispatched: true, ...deferredPersist }, env.signal));
             }
         }
+        // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
         return await finishAfterTurn({
             exitCode: exitCodeForTerminalOutcome(noReceipt.roleOutcome),
             admitted,
@@ -972,6 +1064,7 @@ export async function runPostAdmissionSeatResume(input) {
                 io: input.io,
                 sessionAppender: env.sessionAppender,
                 autoResumeLimit: env.autoResumeLimit,
+                ...(env.signal === undefined ? {} : { signal: env.signal }),
                 buildInitialPayload: () => ({ resumeTurn: false }),
                 buildResumePayload: () => ({ resumeTurn: true }),
                 // Same as public manual resume: prior-court sealed acceptance is not a
@@ -1095,6 +1188,7 @@ export async function runPostAdmissionResumable(input) {
         io,
         sessionAppender: env.sessionAppender,
         autoResumeLimit: env.autoResumeLimit,
+        ...(env.signal === undefined ? {} : { signal: env.signal }),
         buildInitialPayload: buildScopedInitial,
         buildResumePayload: buildScopedResume,
         dispatch: async (request, lease, _isFirst, attemptIo) => {

package/dist/public-cli/process-cancel.js

@@ -0,0 +1,57 @@
+/**
+ * #855: catchable process signals for ak-role public entry.
+ * SIGTERM / SIGINT / SIGHUP abort the shared controller so hosts can gracefully
+ * terminate children (SIGTERM only, never SIGKILL). Uncatchable death (SIGKILL,
+ * crash, power loss) is reported via run-state + writer lease on analyst.
+ */
+const CATCHABLE_PROCESS_SIGNALS = ["SIGTERM", "SIGINT", "SIGHUP"];
+/**
+ * Install once per process entry. First catchable signal wins; later signals
+ * are ignored so settlement can finish without re-entry storms.
+ */
+export function installProcessCancelHandlers(processRef = process) {
+    const controller = new AbortController();
+    let received;
+    const listeners = new Map();
+    for (const sig of CATCHABLE_PROCESS_SIGNALS) {
+        const onSignal = () => {
+            if (received !== undefined)
+                return;
+            received = sig;
+            try {
+                controller.abort(sig);
+            }
+            catch {
+                // already aborted
+            }
+        };
+        listeners.set(sig, onSignal);
+        processRef.on(sig, onSignal);
+    }
+    return {
+        signal: controller.signal,
+        receivedSignal: () => received,
+        dispose() {
+            for (const [sig, onSignal] of listeners) {
+                processRef.off(sig, onSignal);
+            }
+            listeners.clear();
+        },
+    };
+}
+/** Signal name when this AbortSignal was aborted by installProcessCancelHandlers. */
+export function processCancelSignalName(signal) {
+    if (signal === undefined || signal.aborted !== true)
+        return undefined;
+    const reason = signal.reason;
+    if (reason === "SIGTERM" ||
+        reason === "SIGINT" ||
+        reason === "SIGHUP") {
+        return reason;
+    }
+    return undefined;
+}
+/** Diagnostic line for a catchable process-signal termination (failure honesty). */
+export function processCancelDiagnostic(signalName) {
+    return `ak-role terminated by ${signalName}`;
+}

package/dist/public-cli/settlement.js

@@ -32,7 +32,7 @@ import { NOTARY_OUTPUT_TOOL_NAME, } from "../notary-contracts.js";
 import { COUNTERSIGN_OUTPUT_TOOL_NAME, } from "../countersign-contracts.js";
 import { GLEANER_LEFT_OUTPUT_TOOL_NAME, } from "../gleaner-left-contracts.js";
 import { DIARIST_OUTPUT_TOOL_NAME, } from "../diarist-contracts.js";
-import { SECRETARIAT_OUTPUT_TOOL_NAME, } from "../secretariat-contracts.js";
+import { SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY, SECRETARIAT_GATE_OFFICER_ENTRY_TYPE, SECRETARIAT_OUTPUT_TOOL_NAME, } from "../secretariat-contracts.js";
 import { INSPECTOR_OUTPUT_TOOL_NAME, } from "../inspector-contracts.js";
 import { GATEKEEPER_OUTPUT_TOOL_NAME, } from "../package-contracts/gatekeeper-output.js";
 import { NAVIGATOR_OUTPUT_TOOL_NAME, } from "../package-contracts/navigator-output.js";
@@ -2254,11 +2254,104 @@ async function settleLawfulDiaristTerminalResult(admitted, authority, scope) {
 export async function trySettleDiaristTerminalResult(admitted, authority, scope) {
     return settleLawfulDiaristTerminalResult(admitted, authority, scope);
 }
+/**
+ * #969 seat projection sole authority: 给事中 terminal (署|上呈) booked as a
+ * durable custom entry (envelope-safe) — ledger accepted stays LLM params (#836).
+ * Never scan toolResult rows: those are memory-only on headless/ACP (#617/#959).
+ * Receipt bytes stay original; nested runId rides beside them.
+ * Caller must only apply this when the terminal-defining submission actually
+ * produced the officer entry (gate-bound converged, or 给事中 audit_escalation).
+ */
+function countersignTerminalFromEntries(entries) {
+    for (let index = entries.length - 1; index >= 0; index -= 1) {
+        const entry = entries[index];
+        if (entry?.type !== "custom")
+            continue;
+        if (entry.customType !== SECRETARIAT_GATE_OFFICER_ENTRY_TYPE)
+            continue;
+        const data = entry.data !== null && typeof entry.data === "object" && !Array.isArray(entry.data)
+            ? entry.data
+            : undefined;
+        if (data?.officer !== "countersign")
+            continue;
+        if (data.receipt === undefined)
+            continue;
+        const runId = typeof data.runId === "string" && data.runId.trim() !== ""
+            ? data.runId
+            : undefined;
+        return {
+            receipt: data.receipt,
+            ...(runId === undefined ? {} : { runId }),
+        };
+    }
+    return undefined;
+}
+function withCountersignTerminalFact(roleOutcome, officer) {
+    const prior = roleOutcome.decisiveFacts !== undefined && isRecord(roleOutcome.decisiveFacts)
+        ? roleOutcome.decisiveFacts
+        : {};
+    return {
+        ...roleOutcome,
+        decisiveFacts: {
+            ...prior,
+            [SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY]: officer,
+        },
+    };
+}
+/**
+ * Terminal-defining secretariat submission owns officer projection.
+ * Last readable secretariatStatus on accepted payloads decides: only gate-bound
+ * converged projects a prior durable officer entry. Parent escalate bypasses the
+ * gate and must not inherit a stale pass entry from an earlier turn (#969).
+ */
+function acceptedSecretariatDefinesOfficerProjection(roleOutcome) {
+    const payloads = roleOutcome.payloads ?? [];
+    for (let index = payloads.length - 1; index >= 0; index -= 1) {
+        const payload = payloads[index];
+        if (!isRecord(payload))
+            continue;
+        const status = payload.secretariatStatus;
+        if (typeof status !== "string")
+            continue;
+        return status === "converged";
+    }
+    return false;
+}
 async function settleLawfulSecretariatTerminalResult(admitted, authority, scope) {
-    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+    const settled = await settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
         role: "secretariat",
         toolName: SECRETARIAT_OUTPUT_TOOL_NAME,
     }, scope);
+    if (settled === undefined)
+        return undefined;
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const entries = await readLawfulSettlementEntries(coordinates.sessionFile) ?? [];
+    const officer = countersignTerminalFromEntries(entries);
+    if (officer === undefined)
+        return settled;
+    // 给事中上呈: public payloads = officer receipt; runId + receipt fact beside.
+    // This kind is produced only when beforeAccept booked the officer entry.
+    if (settled.roleOutcome.kind === "audit_escalation") {
+        return {
+            ...settled,
+            roleOutcome: withCountersignTerminalFact({
+                ...settled.roleOutcome,
+                payloads: [officer.receipt],
+            }, officer),
+        };
+    }
+    // Pass (署): keep 中书省 payloads; present 给事中 判词 + runId via decisiveFacts.
+    // Parent escalate accepted terminal must not project a stale prior pass entry.
+    if (settled.roleOutcome.kind === "accepted") {
+        if (!acceptedSecretariatDefinesOfficerProjection(settled.roleOutcome)) {
+            return settled;
+        }
+        return {
+            ...settled,
+            roleOutcome: withCountersignTerminalFact(settled.roleOutcome, officer),
+        };
+    }
+    return settled;
 }
 /** Try to settle a lawful Secretariat Terminal; undefined only for genuine absence. */
 export async function trySettleSecretariatTerminalResult(admitted, authority, scope) {

package/dist/public-role-summons.js

@@ -691,6 +691,25 @@ async function summonGateOfficer(options) {
       ...common
     });
   }
+  if (options.officer === "countersign") {
+    const { runIdFromRunDirectory } = await import("./run-terminal-artifacts.js");
+    const correlationId = runIdFromRunDirectory(options.sourceRunDirectory);
+    if (correlationId === void 0 || correlationId.trim() === "") {
+      throw new Error(
+        `countersign gate summon requires parent runId from sourceRunDirectory: ${options.sourceRunDirectory}`
+      );
+    }
+    const { readBoardTicketNumber } = await import("./run-ticket-number.js");
+    const parentTicket = await readBoardTicketNumber(options.sourceRunDirectory);
+    const instruction = options.reask ?? gateReviewInstruction ?? "";
+    return summonPublicRole({
+      role: "countersign",
+      argv: ["--project", options.cwd, "--", instruction],
+      ...common,
+      correlationId,
+      ...parentTicket === void 0 ? {} : { boundTicketNumber: parentTicket }
+    });
+  }
   return summonPublicRole({
     role: "inspector",
     argv: [`\u5377\u5B97\u6307\u9488\uFF1A${options.sourceRunDirectory}`],

package/dist/secretariat-contracts.js

@@ -1,8 +1,12 @@
 const SECRETARIAT_OUTPUT_TOOL_NAME = "ak_secretariat_output";
 const SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME = "ak_secretariat_summon_countersign";
 const SECRETARIAT_ACCEPTED_TEXT = "\u4E2D\u4E66\u7701\u56DE\u6267\u5DF2\u63A5\u53D7";
+const SECRETARIAT_GATE_OFFICER_ENTRY_TYPE = "ak-secretariat-gate-officer";
+const SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY = "countersignTerminal";
 export {
   SECRETARIAT_ACCEPTED_TEXT,
+  SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY,
+  SECRETARIAT_GATE_OFFICER_ENTRY_TYPE,
   SECRETARIAT_OUTPUT_TOOL_NAME,
   SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.4620",
+  "version": "0.1.4641",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/scripts/build-package.mjs

@@ -19,7 +19,6 @@ const entries = [
   "pi/in-process-session",
   "activation-ledger-git",
   "activation-ledger-topology",
-  "activation-reconciliation",
   "archivist-record-entry",
   // Pure subject nest topology — static import of archivist-record-entry;
   // cold discovery without SessionManager (#636). Keep listed while that

package/src/activation-ledger-topology.ts

@@ -91,11 +91,6 @@ export function activationBookDirectory(ledgerHome: string, bookKey: string): st
   return join(ledgerHome, "books", bookKey);
 }
 
-/** Append-only waiting ledger path for one book. */
-export function activationWaitingLedgerPath(ledgerHome: string, bookKey: string): string {
-  return join(activationBookDirectory(ledgerHome, bookKey), "waiting.jsonl");
-}
-
 /** True when candidate resolves strictly inside root (boundary-safe; not a string-prefix check). */
 export function pathContainedIn(root: string, candidate: string): boolean {
   const rel = relative(root, candidate);
@@ -323,7 +318,7 @@ export function ensureRealDirectoryTree(root: string, targetDir: string): string
 
 /**
  * Reject a pre-existing ledger-file symlink before open/write follows it.
- * A computed book may only append to its own regular waiting.jsonl — any symlink,
+ * A computed book path may only write its own regular file — any symlink,
  * including a target still inside the machine ledger home (cross-book redirect),
  * violates ADR 0048 partition identity. Missing paths are admitted (O_CREAT).
  */