@akagilnc/pi-workflow-roles 0.1.4631 → 0.1.4641

package/src/public-cli/countersign-run.ts

@@ -88,6 +88,22 @@ export type CountersignRunEnv = PostAdmissionEnv & {
    * replace — never union. Production leaves unset outside that handoff.
    */
   pendingCourtTicketNumbers?: readonly number[];
+  /**
+   * #969 gate path: plain-language re-ask when prior 给事中 reply was not three-state.
+   * Wins over gateReviewInstruction when both present (notary/inspector precedent).
+   */
+  reviewReask?: string;
+  /**
+   * #969/#879 Secretariat submission-gate body: verbatim parent payload as dialogue
+   * content when reviewReask is absent. Binding stays ticket / argv instruction.
+   */
+  gateReviewInstruction?: string;
+  /**
+   * #969 gate path: parent run durable board ticket handoff. Same-ticket resume
+   * key and identity 起居郎 bind under this key — never re-derived from receipt
+   * ticketNumber (optional / omit-able payload field).
+   */
+  boundTicketNumber?: number;
 };
 
 /** Project admitted invocation onto the host-neutral turn request. */
@@ -470,6 +486,10 @@ export async function runPublicCountersign(
                 instruction: parsed.instruction,
                 projectRoot: admitted.projectRoot,
                 failureLabel: "unbound summons",
+                // #969: parent durable ticket is the resume/bind key (ADR 0079).
+                ...(env.boundTicketNumber === undefined
+                  ? {}
+                  : { boundTicketNumber: env.boundTicketNumber }),
               },
               env,
               io,
@@ -528,16 +548,30 @@ export async function runPublicCountersign(
           }
 
           // Missing lawful 起居郎 terminal is not countersign body failure: leave
-          // unbound and continue (true-unbound face). Escalate / typed failure above;
-          // bound refresh still fails honest via runCountersignCourtDiaristStation.
+          // unbound and continue (true-unbound face) — unless parent gate handoff
+          // already carries the durable board ticket (#969). Escalate / typed
+          // failure above; bound refresh still fails honest via station.
           if (outcome.identity.kind === "ticket") {
-            const assertedTicket = outcome.identity.ticketNumber;
-            typedTicket = assertedTicket;
+            // #969: parent durable handoff wins over 起居郎 re-assert when both
+            // present (receipt/assert mismatch → parent resume key).
+            typedTicket = isSafePositiveTicketNumber(env.boundTicketNumber)
+              ? env.boundTicketNumber
+              : outcome.identity.ticketNumber;
             // #871: identity may hand a co-review set; absent field defaults to [main].
             typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
+          } else if (isSafePositiveTicketNumber(env.boundTicketNumber)) {
+            // Parent board handoff present; 起居郎 returned true-unbound — still
+            // resume/bind under the parent key (omitted receipt ticketNumber path).
+            typedTicket = env.boundTicketNumber;
+          }
+          if (typedTicket !== undefined) {
+            // #969/#879: gate re-ask / parent submission body share summons.instruction
+            // (reask wins; argv instruction remains the 起居郎 identity face above).
+            const resumeInstruction =
+              env.reviewReask ?? env.gateReviewInstruction ?? parsed.instruction;
             const summons: SameTicketSummonsMaterials = {
-              instruction: parsed.instruction,
-              instructionEmpty: parsed.instruction.trim() === "",
+              instruction: resumeInstruction,
+              instructionEmpty: resumeInstruction.trim() === "",
             };
             const resumed = await tryResumeSameTicketSeatRun({
               home: env.home,
@@ -641,13 +675,16 @@ export async function runPublicCountersign(
             : { correlationId: env.correlationId }),
           continuation: {
             kind: "initial",
-            prompt: buildCountersignTransportPrompt(
-              admitted,
-              engineSessionMaterialFromOptions({
-                ...pickEngineAxis(env),
-                packageRoot: env.packageRoot,
-              }),
-            ),
+            // #969/#879: gate path first mint carries parent payload as dialogue content;
+            // ordinary public entry keeps package transport prompt.
+            prompt: (env.reviewReask ?? env.gateReviewInstruction)
+              ?? buildCountersignTransportPrompt(
+                admitted,
+                engineSessionMaterialFromOptions({
+                  ...pickEngineAxis(env),
+                  packageRoot: env.packageRoot,
+                }),
+              ),
           },
         };
         // Mutable shell: ticket bind re-projects activation before executeTurn.

package/src/public-cli/settlement.ts

@@ -94,6 +94,8 @@ import {
   DIARIST_OUTPUT_TOOL_NAME,
 } from "../diarist-contracts.ts";
 import {
+  SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY,
+  SECRETARIAT_GATE_OFFICER_ENTRY_TYPE,
   SECRETARIAT_OUTPUT_TOOL_NAME,
 } from "../secretariat-contracts.ts";
 import {
@@ -3333,15 +3335,129 @@ export async function trySettleDiaristTerminalResult(
   return settleLawfulDiaristTerminalResult(admitted, authority, scope);
 }
 
+/**
+ * #969 seat projection sole authority: 给事中 terminal (署|上呈) booked as a
+ * durable custom entry (envelope-safe) — ledger accepted stays LLM params (#836).
+ * Never scan toolResult rows: those are memory-only on headless/ACP (#617/#959).
+ * Receipt bytes stay original; nested runId rides beside them.
+ * Caller must only apply this when the terminal-defining submission actually
+ * produced the officer entry (gate-bound converged, or 给事中 audit_escalation).
+ */
+function countersignTerminalFromEntries(
+  entries: readonly {
+    type?: string;
+    customType?: string;
+    data?: unknown;
+  }[],
+): import("../secretariat-contracts.ts").SecretariatCountersignTerminalFact | undefined {
+  for (let index = entries.length - 1; index >= 0; index -= 1) {
+    const entry = entries[index];
+    if (entry?.type !== "custom") continue;
+    if (entry.customType !== SECRETARIAT_GATE_OFFICER_ENTRY_TYPE) continue;
+    const data =
+      entry.data !== null && typeof entry.data === "object" && !Array.isArray(entry.data)
+        ? (entry.data as Record<string, unknown>)
+        : undefined;
+    if (data?.officer !== "countersign") continue;
+    if (data.receipt === undefined) continue;
+    const runId =
+      typeof data.runId === "string" && data.runId.trim() !== ""
+        ? data.runId
+        : undefined;
+    return {
+      receipt: data.receipt,
+      ...(runId === undefined ? {} : { runId }),
+    };
+  }
+  return undefined;
+}
+
+function withCountersignTerminalFact(
+  roleOutcome: Extract<
+    import("./terminal.ts").TerminalRoleOutcome,
+    { kind: "accepted" | "audit_escalation" }
+  >,
+  officer: import("../secretariat-contracts.ts").SecretariatCountersignTerminalFact,
+): typeof roleOutcome {
+  const prior =
+    roleOutcome.decisiveFacts !== undefined && isRecord(roleOutcome.decisiveFacts)
+      ? roleOutcome.decisiveFacts
+      : {};
+  return {
+    ...roleOutcome,
+    decisiveFacts: {
+      ...prior,
+      [SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY]: officer,
+    },
+  };
+}
+
+/**
+ * Terminal-defining secretariat submission owns officer projection.
+ * Last readable secretariatStatus on accepted payloads decides: only gate-bound
+ * converged projects a prior durable officer entry. Parent escalate bypasses the
+ * gate and must not inherit a stale pass entry from an earlier turn (#969).
+ */
+function acceptedSecretariatDefinesOfficerProjection(
+  roleOutcome: Extract<
+    import("./terminal.ts").TerminalRoleOutcome,
+    { kind: "accepted" }
+  >,
+): boolean {
+  const payloads = roleOutcome.payloads ?? [];
+  for (let index = payloads.length - 1; index >= 0; index -= 1) {
+    const payload = payloads[index];
+    if (!isRecord(payload)) continue;
+    const status = payload.secretariatStatus;
+    if (typeof status !== "string") continue;
+    return status === "converged";
+  }
+  return false;
+}
+
 async function settleLawfulSecretariatTerminalResult(
   admitted: AdmittedSecretariatInvocation,
   authority: DurablePrincipalAuthority,
   scope?: SettlementCourtScope,
 ): Promise<TerminalResult | undefined> {
-  return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+  const settled = await settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
     role: "secretariat",
     toolName: SECRETARIAT_OUTPUT_TOOL_NAME,
   }, scope);
+  if (settled === undefined) return undefined;
+  const coordinates = coordinatesFromAdmitted(authority, admitted);
+  const entries = await readLawfulSettlementEntries(coordinates.sessionFile) ?? [];
+  const officer = countersignTerminalFromEntries(entries);
+  if (officer === undefined) return settled;
+
+  // 给事中上呈: public payloads = officer receipt; runId + receipt fact beside.
+  // This kind is produced only when beforeAccept booked the officer entry.
+  if (settled.roleOutcome.kind === "audit_escalation") {
+    return {
+      ...settled,
+      roleOutcome: withCountersignTerminalFact(
+        {
+          ...settled.roleOutcome,
+          payloads: [officer.receipt],
+        },
+        officer,
+      ),
+    };
+  }
+
+  // Pass (署): keep 中书省 payloads; present 给事中 判词 + runId via decisiveFacts.
+  // Parent escalate accepted terminal must not project a stale prior pass entry.
+  if (settled.roleOutcome.kind === "accepted") {
+    if (!acceptedSecretariatDefinesOfficerProjection(settled.roleOutcome)) {
+      return settled;
+    }
+    return {
+      ...settled,
+      roleOutcome: withCountersignTerminalFact(settled.roleOutcome, officer),
+    };
+  }
+
+  return settled;
 }
 
 /** Try to settle a lawful Secretariat Terminal; undefined only for genuine absence. */

package/src/public-role-summons.ts

@@ -1040,9 +1040,9 @@ export async function summonParallelReviewerLenses(options: {
   return results;
 }
 
-/** Gate officer summons: notary/auditor via --source-run; inspector via pointer instruction. */
+/** Gate officer summons: notary/auditor via --source-run; inspector via pointer; countersign via ticket (#969). */
 export async function summonGateOfficer(options: {
-  readonly officer: "inspector" | "notary" | "auditor";
+  readonly officer: "inspector" | "notary" | "auditor" | "countersign";
   readonly sourceRunDirectory: string;
   readonly cwd: string;
   readonly home?: string;
@@ -1052,14 +1052,14 @@ export async function summonGateOfficer(options: {
   readonly signal?: AbortSignal;
   /**
    * Plain-language re-ask when the prior officer reply was not three-state (#753 / #756).
-   * All three officers: reviewReask → same-ticket resume summons.instruction.
+   * Officers: reviewReask → same-ticket resume summons.instruction.
    * Never concatenated into argv (inspector parentRunPath is the pure 卷宗指针).
    */
   readonly reask?: string;
   /**
    * In-flight parent 交卷 body (tool-call arguments). Relayed verbatim as officer
    * dialogue content when reask is absent (#879). Binding pointer stays on
-   * --source-run / 卷宗指针 argv — never a content substitute.
+   * --source-run / 卷宗指针 / ticket argv — never a content substitute.
    */
   readonly submission?: unknown;
   /** Pi-adapter inject — forwarded to summonPublicRole (not a parent-host override). */
@@ -1121,6 +1121,32 @@ export async function summonGateOfficer(options: {
       ...common,
     });
   }
+  if (options.officer === "countersign") {
+    // #969: Secretariat submission gate → 给事中.
+    // Dialogue / identity instruction = parent typed payload 原话 (ADR 0079) or reask;
+    // no code-authored summons prose (#924). Ticket identity = parent run durable
+    // board binding only (readBoardTicketNumber) — receipt ticketNumber is payload
+    // content, never the sole identity source; parent true-unbound stays unbound.
+    // correlationId only on this officer — notary/auditor/inspector stay untouched.
+    const { runIdFromRunDirectory } = await import("./run-terminal-artifacts.ts");
+    const correlationId = runIdFromRunDirectory(options.sourceRunDirectory);
+    if (correlationId === undefined || correlationId.trim() === "") {
+      throw new Error(
+        `countersign gate summon requires parent runId from sourceRunDirectory: ${options.sourceRunDirectory}`,
+      );
+    }
+    const { readBoardTicketNumber } = await import("./run-ticket-number.ts");
+    const parentTicket = await readBoardTicketNumber(options.sourceRunDirectory);
+    // Argv instruction = reask or parent payload bytes only (never a fabricated line).
+    const instruction = options.reask ?? gateReviewInstruction ?? "";
+    return summonPublicRole({
+      role: "countersign",
+      argv: ["--project", options.cwd, "--", instruction],
+      ...common,
+      correlationId,
+      ...(parentTicket === undefined ? {} : { boundTicketNumber: parentTicket }),
+    });
+  }
   // Inspector: argv stays pure 卷宗指针 (#747 parentRunPath lookup key).
   // Content (body/reask) rides env → summons.instruction / first-mint prompt.
   return summonPublicRole({

package/src/role-envelope.ts

@@ -9,7 +9,10 @@ import {
   ENGINE_MODEL_FLAG_NAME,
   normalizeEngineName,
 } from "./engine-detour.ts";
-import { requireGatekeeperPass } from "./gatekeeper-pass-envelope.ts";
+import {
+  createDefaultGateOfficerSummon,
+  requireGatekeeperPass,
+} from "./gatekeeper-pass-envelope.ts";
 import type {
   HostContext,
   HostEventRegistration,
@@ -229,18 +232,32 @@ export async function prepareRoleEnvelope(options: {
     // seat remains reachable through MCP.
     setActiveTools(names) { preferredTools = [...names]; },
     getActiveTools() { return [...preferredTools]; },
-    async requireGatekeeperPass(options) {
-      await requireGatekeeperPass({
-        context: options.context,
-        subject: options.subject,
-        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    async requireGatekeeperPass(gateOptions) {
+      const packageRoot =
+        typeof options.dependencies.packageRoot === "string"
+          ? options.dependencies.packageRoot
+          : undefined;
+      return requireGatekeeperPass({
+        context: gateOptions.context,
+        subject: gateOptions.subject,
+        ...(gateOptions.signal === undefined ? {} : { signal: gateOptions.signal }),
         hostActions: {
           failInfrastructure: (error, _context, toolCallId) =>
-            options.hostActions.failInfrastructure(error, options.context, toolCallId),
-          bindSubmissionNonPass: options.hostActions.bindSubmissionNonPass,
+            gateOptions.hostActions.failInfrastructure(error, gateOptions.context, toolCallId),
+          bindSubmissionNonPass: gateOptions.hostActions.bindSubmissionNonPass,
         },
-        toolCallId: options.toolCallId,
-        ...(options.submission === undefined ? {} : { submission: options.submission }),
+        toolCallId: gateOptions.toolCallId,
+        ...(gateOptions.submission === undefined ? {} : { submission: gateOptions.submission }),
+        // #969: package root + home reach nested 给事中/符宝郎 summons.
+        // hostAdapters (when set on deps) forward nested seat selection — production unset.
+        summonOfficer: createDefaultGateOfficerSummon({
+          cwd: gateOptions.context.cwd ?? request.cwd,
+          home: request.home,
+          ...(packageRoot === undefined ? {} : { packageRoot }),
+          ...(options.dependencies.hostAdapters === undefined
+            ? {}
+            : { hostAdapters: options.dependencies.hostAdapters }),
+        }),
       });
     },
     on(...registration: HostEventRegistration) {

package/src/role-runtime.ts

@@ -314,15 +314,23 @@ export {
   writeToolExecutionObservationRecord,
 } from "./tool-execution-observation.ts";
 export type { ToolExecutionObservationRecord, ToolExecutionObservationWriter } from "./tool-execution-observation.ts";
-export {
+import {
   NOTARY_OUTPUT_TOOL,
   INSPECTOR_OUTPUT_TOOL,
   GatekeeperDecisionError,
   createGatekeeperOutputTool,
   runGatekeeper,
+  gateOfficerForSubject,
 } from "./gatekeeper-role.ts";
+export {
+  NOTARY_OUTPUT_TOOL,
+  INSPECTOR_OUTPUT_TOOL,
+  GatekeeperDecisionError,
+  createGatekeeperOutputTool,
+  runGatekeeper,
+  gateOfficerForSubject,
+};
 export type { GatekeeperResult, GatekeeperSubject, GatekeeperNonPassResult, GateOfficer, RunGatekeeperOptions } from "./gatekeeper-role.ts";
-export { gateOfficerForSubject } from "./gatekeeper-role.ts";
 import { ParentQueueReaskError } from "./submission-errors.ts";
 
 export {
@@ -546,6 +554,13 @@ type NavigatorAttendanceDependency = Omit<NavigatorAttendance, "knownRoutePlaybo
 export type RoleRuntimeDependencies = {
   /** Package root for packaged engine-note resolution (#879). */
   packageRoot?: string;
+  /**
+   * Composition-root adapter table for nested gate officer summons (#969).
+   * Production leaves unset (default pi + packaged externals). Tests inject
+   * faux nested hosts so prepareRoleEnvelope.requireGatekeeperPass is bitten
+   * without reimplementing the envelope summon closure.
+   */
+  hostAdapters?: readonly import("./public-cli/role-turn-host-resolution.ts").NamedRoleTurnHostAdapter[];
   /** Non-identity opening materials delivered in the ordinary role brief. */
   loadRoleReferenceMaterials?(role: PackagedRole): Promise<string>;
   loadJudgeSoul(): Promise<string>;
@@ -999,18 +1014,137 @@ const COUNTERSIGN_QUEUE_STATUSES = new Set(["converged", "continue", "escalate"]
 const COUNTERSIGN_STATUS_REASK =
   "countersignStatus 不是 converged、continue、escalate 三态之一。请重新交卷，status 写明其一。" as const;
 
+/**
+ * #969 authorized non-pi hosts: Secretariat converged is a candidate ticket —
+ * AK-side submission gate summons 给事中. pi keeps mid-turn summon tool only.
+ */
+const SECRETARIAT_SUBMISSION_GATE_HOSTS = new Set(["codex", "claude", "grok-build"]);
+
+/** Secretariat status words the non-pi submission gate reads (#969). */
+const SECRETARIAT_QUEUE_STATUSES = new Set(["converged", "escalate"]);
+
+/**
+ * Plain-language re-ask when non-pi secretariatStatus is not a known queue word.
+ * Back to secretariat itself — 给事中 is not summoned (#969 / ADR 0055).
+ */
+const SECRETARIAT_STATUS_REASK =
+  "secretariatStatus 不是 converged、escalate 之一。请重新交卷，status 写明其一。" as const;
+
 /**
  * #924 Secretariat on the shared filed-officer envelope + non-terminating
  * summon-countersign tool (auditor dossier extension pattern).
  * Nested countersign lifecycle stays on summonPublicRole (ADR 0018).
- * #924 / 第 0 条: output tool records the receipt as submitted — no status
+ * #924 / 第 0 条 (pi): output tool records the receipt as submitted — no status
  * shape/value reject or reask; legality is content-layer / downstream.
+ * #969 (codex/claude/grok-build): converged arms 既有交卷闸 → 给事中; escalate
+ * skips the gate; other values reask secretariat (ADR 0055).
  */
 export function createSecretariatRoleRuntime(
   roleHost: RoleHost,
   dependencies: SecretariatRuntimeDependencies,
+  hostActions?: import("./host-contracts.ts").HostGatekeeperActions,
 ) {
   let parentInstruction = "";
+  // #969: non-pi submission gate only — pi mid-turn summon path stays untouched.
+  const beforeAccept: FiledOfficerBeforeAccept | undefined =
+    hostActions !== undefined && roleHost.requireGatekeeperPass !== undefined
+      ? async ({ toolCallId, parameters, signal, ctx }) => {
+          const host =
+            typeof ctx.host === "string" && ctx.host.trim() !== ""
+              ? ctx.host.trim()
+              : undefined;
+          if (host === undefined || !SECRETARIAT_SUBMISSION_GATE_HOSTS.has(host)) {
+            return undefined;
+          }
+          const record =
+            parameters !== null && typeof parameters === "object" && !Array.isArray(parameters)
+              ? (parameters as Record<string, unknown>)
+              : undefined;
+          const status =
+            record !== undefined && typeof record.secretariatStatus === "string"
+              ? record.secretariatStatus
+              : undefined;
+          if (status === undefined || !SECRETARIAT_QUEUE_STATUSES.has(status)) {
+            throw new ParentQueueReaskError(SECRETARIAT_STATUS_REASK);
+          }
+          if (status === "escalate") {
+            // Parent escalate → throw to caller as-is; 给事中 does not attend (#969).
+            return undefined;
+          }
+          try {
+            const pass = await roleHost.requireGatekeeperPass!({
+              context: ctx,
+              subject: { kind: "secretariat_verdict" },
+              ...(signal === undefined ? {} : { signal }),
+              hostActions,
+              toolCallId,
+              // #879: this-turn typed payload — identity-bound at submit site.
+              submission: parameters,
+            });
+            // #969: book 给事中 署 snapshot for seat settlement projection (receipt + runId).
+            // Ledger accepted stays LLM params (#836); public terminal reads this entry.
+            if (
+              pass !== undefined
+              && pass !== null
+              && typeof pass === "object"
+              && "receipt" in pass
+            ) {
+              const {
+                SECRETARIAT_GATE_OFFICER_ENTRY_TYPE,
+              } = await import("./secretariat-contracts.ts");
+              const runId =
+                typeof pass.runId === "string" && pass.runId.trim() !== ""
+                  ? pass.runId
+                  : undefined;
+              ctx.sessionManager.appendCustomEntry?.(SECRETARIAT_GATE_OFFICER_ENTRY_TYPE, {
+                officer: "countersign",
+                receipt: pass.receipt,
+                ...(runId === undefined ? {} : { runId }),
+              });
+            }
+            return undefined;
+          } catch (error) {
+            // #969: 给事中上呈 ends parent with officer receipt (no retry / 不擅改).
+            if (
+              error instanceof GatekeeperDecisionError
+              && error.result.status === "escalate"
+            ) {
+              const receipt = error.result.receipt;
+              const receiptRecord =
+                receipt !== null && typeof receipt === "object" && !Array.isArray(receipt)
+                  ? (receipt as Record<string, unknown>)
+                  : undefined;
+              const runId =
+                typeof error.result.runId === "string" && error.result.runId.trim() !== ""
+                  ? error.result.runId
+                  : undefined;
+              // Durable on every host: envelope persists custom entries only
+              // (toolResult rows are memory-only on headless/ACP — #617/#959).
+              const {
+                SECRETARIAT_GATE_OFFICER_ENTRY_TYPE,
+              } = await import("./secretariat-contracts.ts");
+              ctx.sessionManager.appendCustomEntry?.(SECRETARIAT_GATE_OFFICER_ENTRY_TYPE, {
+                officer: "countersign",
+                receipt,
+                ...(runId === undefined ? {} : { runId }),
+              });
+              const { buildAuditEscalationResult } = await import("./audit-escalation.ts");
+              return buildAuditEscalationResult(
+                {
+                  status: "escalate",
+                  officer: "countersign",
+                  ...(receiptRecord !== undefined
+                    && Object.prototype.hasOwnProperty.call(receiptRecord, "decisionGate")
+                    ? { decisionGate: receiptRecord.decisionGate }
+                    : {}),
+                },
+                receipt,
+              );
+            }
+            throw error;
+          }
+        }
+      : undefined;
   const base = createFiledOfficerRuntime(
     roleHost,
     {
@@ -1018,6 +1152,7 @@ export function createSecretariatRoleRuntime(
       tool: SECRETARIAT_OUTPUT_TOOL_SPEC,
       acceptedText: SECRETARIAT_ACCEPTED_TEXT,
       soulTag: "secretariat",
+      ...(beforeAccept === undefined ? {} : { beforeAccept }),
     },
     dependencies,
   );
@@ -1858,7 +1993,10 @@ export function createRoleRuntimeExtension(
       ...(dependencies.packageRoot === undefined
         ? {}
         : { packageRoot: dependencies.packageRoot }),
-    });
+      ...(dependencies.hostAdapters === undefined
+        ? {}
+        : { hostAdapters: dependencies.hostAdapters }),
+    }, hostActions);
     const merger = createMergerRoleRuntime(roleHost, {
       async loadSoul() { if (!dependencies.loadMergerSoul) throw new Error("Merger runtime dependencies are not configured"); return dependencies.loadMergerSoul(); },
       async loadInput(path) { if (!dependencies.loadMergerInput) throw new Error("Merger runtime dependencies are not configured"); return dependencies.loadMergerInput(path); },

package/src/secretariat-contracts.ts

@@ -11,6 +11,24 @@ export const SECRETARIAT_OUTPUT_TOOL_NAME = "ak_secretariat_output";
 export const SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME =
   "ak_secretariat_summon_countersign";
 export const SECRETARIAT_ACCEPTED_TEXT = "中书省回执已接受";
+/**
+ * #969 durable custom entry: 给事中 terminal (署|上呈) for seat settlement projection.
+ * Carries original receipt bytes + nested runId. Envelope persists custom entries
+ * (not toolResult rows) — headless/ACP safe. Single authority for public terminal
+ * officer projection (pass and escalate share this entry).
+ */
+export const SECRETARIAT_GATE_OFFICER_ENTRY_TYPE =
+  "ak-secretariat-gate-officer" as const;
+
+/** Decisive-facts key for nested 给事中 terminal on public Secretariat settlement. */
+export const SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY = "countersignTerminal" as const;
+
+export type SecretariatCountersignTerminalFact = {
+  /** Officer receipt original bytes — never rewritten. */
+  readonly receipt: unknown;
+  /** Nested 给事中 runId when known. */
+  readonly runId?: string;
+};
 
 export type SecretariatVerdict =
   | {