@akagilnc/pi-workflow-roles 0.1.4745 → 0.1.4759

package/src/public-cli/cli.ts

@@ -124,7 +124,6 @@ const RESUME_SEAT_DISPATCH: Record<
     ) => Promise<{
       exitCode: number;
       terminal?: TerminalResult;
-      staleWriterLeaseReclaimed?: true;
     }>;
   }
 > = {
@@ -473,19 +472,15 @@ export type CliResult = {
   /** Settled Terminal when an admitted Role run produced one (programmatic/tests). */
   terminal?: TerminalResult;
   hostFailure?: HostSelectionFailure;
-  /** Typed #556 fact from public resume/dispatch when a dead holder lock was unlinked. */
-  staleWriterLeaseReclaimed?: true;
 };
 
 function cliResultFromRoleRun(result: {
   exitCode: number;
   terminal?: TerminalResult;
-  staleWriterLeaseReclaimed?: true;
 }): CliResult {
   return {
     exitCode: result.exitCode,
     ...(result.terminal === undefined ? {} : { terminal: result.terminal }),
-    ...(result.staleWriterLeaseReclaimed === true ? { staleWriterLeaseReclaimed: true as const } : {}),
   };
 }
 

package/src/public-cli/config.ts

@@ -813,7 +813,6 @@ export function listRolesForDisplay(
 
 /**
  * Read configured credential presence from a Pi auth.json document.
- * Presence drives the selected-provider fail-closed seam (public-run-credentials).
  */
 export function credentialProvidersFromAuthData(
   data: unknown,

package/src/public-cli/countersign-run.ts

@@ -785,7 +785,7 @@ export async function runPublicCountersign(
 function countersignAdapters(options?: {
   beforeDispatch?: (
     admitted: AdmittedCountersignInvocation,
-    lease: RunWriterLease,
+    lease?: RunWriterLease,
   ) => void | Promise<void>;
 }) {
   return {

package/src/public-cli/diarist-run.ts

@@ -76,7 +76,7 @@ export function buildDiaristTurnRequest(
 async function bindAndRelocateDiaristIfBoardBound(
   admitted: AdmittedDiaristInvocation,
   authority: DiaristRunEnv["principalAuthority"],
-  lease: RunWriterLease,
+  lease?: RunWriterLease,
 ): Promise<void> {
   const boardTicket = await readBoardTicketNumber(admitted.runDirectory);
   if (boardTicket === undefined) return;

package/src/public-cli/post-admission.ts

@@ -69,11 +69,6 @@ import {
 import { projectHostTransitionPriorNative } from "../host-transition-prior-native.ts";
 import type { CredentialProviders, SeatModelConfig } from "./config.ts";
 import {
-  missingCredentialPreDispatchFailure,
-  postRunMissingCredentialFailure,
-} from "./public-run-credentials.ts";
-import {
-  acquireRunWriterLease,
   clearCurrentCourt,
   clearTypedProviderHttpObservation,
   describeErrorIdentity,
@@ -81,11 +76,9 @@ import {
   readCurrentCourt,
   recordCurrentCourt,
   renderResumeCommand,
-  RunWriterLeaseHeldError,
   type CurrentCourtState,
   type RunWriterLease,
   type TypedProviderHttpObservation,
-  type WriterLeaseDiagnosticKind,
 } from "./run-lifecycle.ts";
 import {
   processCancelDiagnostic,
@@ -234,8 +227,8 @@ async function recordBestEffortPostDispatchDiagnostic<A extends AdmittedRoleInvo
   diagnostic: string,
   io: CliIo,
 ): Promise<void> {
-  io.stderr(formatCliDiagnostic(diagnostic));
   const payload = { diagnostic, recordedAt: new Date().toISOString() };
+  let retentionFailure: string | undefined;
   try {
     await env.sessionAppender(
       env.principalAuthority,
@@ -243,7 +236,6 @@ async function recordBestEffortPostDispatchDiagnostic<A extends AdmittedRoleInvo
       POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE,
       payload,
     );
-    return;
   } catch (appendError) {
     try {
       const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
@@ -253,12 +245,17 @@ async function recordBestEffortPostDispatchDiagnostic<A extends AdmittedRoleInvo
         { encoding: "utf8", flag: "wx" },
       );
     } catch (artifactError) {
-      io.stderr(
-        formatCliDiagnostic(
-          `post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`,
-        ),
-      );
+      retentionFailure =
+        `post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`;
+    }
+  }
+  try {
+    io.stderr(formatCliDiagnostic(diagnostic));
+    if (retentionFailure !== undefined) {
+      io.stderr(formatCliDiagnostic(retentionFailure));
     }
+  } catch {
+    // Presentation is best-effort beside an already-formed host terminal.
   }
 }
 
@@ -327,13 +324,14 @@ export type PostAdmissionAdapters<
     result: RoleTurnResult;
     sessionFile: string;
   }) => Promise<RoleTurnKnownFailure | undefined>;
-  beforeDispatch?: (admitted: A, lease: RunWriterLease) => Promise<void> | void;
+  beforeDispatch?: (admitted: A, lease?: RunWriterLease) => Promise<void> | void;
   /**
-   * After the host turn settles and before the writer lease is released.
-   * Post-turn bind/relocate (e.g. Diarist first assert) must run here so the
-   * held lease follows the run directory and failures stay controlled.
+   * After the host turn settles and before any held writer lease is released.
+   * Post-turn bind/relocate (e.g. Diarist first assert) must run here so a
+   * held lease (when present) follows the run directory and failures stay
+   * controlled. Public manual resume (#987) may omit the lease.
    */
-  afterDispatch?: (admitted: A, lease: RunWriterLease) => Promise<void> | void;
+  afterDispatch?: (admitted: A, lease?: RunWriterLease) => Promise<void> | void;
 };
 
 export type ControlledFailureInput = {
@@ -614,7 +612,8 @@ export async function dispatchPostAdmissionTurn<
   env: PostAdmissionEnv;
   io: CliIo;
   request: RoleTurnRequest;
-  lease: RunWriterLease;
+  /** Absent on public manual resume (#987): no package lease gate before host CLI resume. */
+  lease?: RunWriterLease;
   adapters: PostAdmissionAdapters<A, T>;
   effectiveEngine?: string;
   persistRunState?: boolean;
@@ -707,14 +706,11 @@ export async function dispatchPostAdmissionTurn<
       if (adapters.afterDispatch !== undefined) await adapters.afterDispatch(admitted, lease);
       return result;
     } catch (error) {
-      const primaryFailure =
-        result.terminal !== undefined
-        && !isLawfulTypedTerminalOutcome(result.terminal.roleOutcome);
-      if (primaryFailure) {
+      if (result.terminal !== undefined) {
         await recordBestEffortPostDispatchDiagnostic(
           admitted,
           env,
-          `afterDispatch failed beside primary terminal (best-effort continue): ${describeErrorIdentity(error)}`,
+          `afterDispatch failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`,
           io,
         );
         return result;
@@ -740,23 +736,8 @@ export async function dispatchPostAdmissionTurn<
     }
   };
   try {
-    const missingCredential = missingCredentialPreDispatchFailure(
-      env.model,
-      env.credentials,
-    );
-    if (missingCredential !== undefined) {
-      return {
-        ...(await presentControlledFailure(
-          admitted,
-          withEngineDetourInvocationScope(missingCredential, request.invocationScopeId),
-          adapters,
-          env.principalAuthority,
-          io,
-          persistRunState,
-        )) as { exitCode: number; admitted: A; terminal: T },
-        ...deferredPersist,
-      };
-    }
+    // #987: do not pre-block or classify host dispatch from AK credential
+    // catalog facts. Per-invocation runner/host evidence owns provider identity.
     // #617 DK-4: capture previous invocation host before markRunRunning overwrites it.
     // Single authority projectHostTransitionPriorNative classifies the prior native volume.
     // Same-run resume (#637) keeps host identity on the run's invocation page.
@@ -1001,15 +982,10 @@ export async function dispatchPostAdmissionTurn<
         adapters.resolveRunnerKnownFailure !== undefined && sessionFile !== ""
           ? await adapters.resolveRunnerKnownFailure({ result, sessionFile })
           : result.knownFailure;
-      const credentialFailure = postRunMissingCredentialFailure(
-        result,
-        env.model,
-        env.credentials,
-      );
       resolution = await resolveAuditedRunnerFailureResolution({
         runner: runnerKnownFailure,
         sessionFile,
-        credential: credentialFailure,
+        credential: undefined,
         runDirectory: admitted.runDirectory,
       });
       // A direct, current signal from the host/runner itself (timeout / host
@@ -1030,7 +1006,6 @@ export async function dispatchPostAdmissionTurn<
         result.timedOut
         || result.knownFailure !== undefined
         || runnerKnownFailure !== undefined
-        || credentialFailure !== undefined
         || processCancelName !== undefined;
       hostSignalFailed =
         directHostFailureSignal
@@ -1153,35 +1128,11 @@ export async function dispatchPostAdmissionTurn<
         try {
           await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
         } catch (error) {
-          // #836: `settledOutcome.terminal` already carries recorded
-          // submissions (attachRecordedSubmissions above). A real run-state
-          // persistence failure here must surface loudly through the same
-          // controlled-failure seam every other dispatch-time failure in
-          // this function uses (ADR 0080: one settlement disposition owner)
-          // — not escape uncaught to auto-resume's dispatch-retry path,
-          // whose exhausted-budget terminal carries no recorded submissions
-          // at all. skipRunStateWrite: the write that just threw is the same
-          // write presentControlledFailure would otherwise retry — don't
-          // call a known-failing operation twice.
-          const failed = await settleAfterTurnStarted(
-          admitted,
-          withEngineDetourInvocationScope({
-              timedOut: false,
-              code: null,
-              stderr: "",
-              thrown: error,
-              skipRunStateWrite: true,
-            }, request.invocationScopeId),
-            adapters,
-            env.principalAuthority,
+          await recordBestEffortPostDispatchDiagnostic(
+            admitted,
+            env,
+            `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`,
             io,
-            persistRunState,
-          );
-          return await finishAfterTurn(
-            withProcessCancelSkipAutoResume(
-              { ...failed, turnDispatched: true as const, ...deferredPersist },
-              env.signal,
-            ),
           );
         }
       }
@@ -1282,30 +1233,11 @@ export async function dispatchPostAdmissionTurn<
       try {
         await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
       } catch (error) {
-        // #836: same run-state persistence hazard as the settled/accepted
-        // branch above — route through the shared controlled-failure seam so
-        // the real failure surfaces loudly instead of escaping uncaught to
-        // auto-resume's dispatch-retry path with no recorded submissions.
-        // skipRunStateWrite: don't retry the write that just threw.
-        const failed = await settleAfterTurnStarted(
+        await recordBestEffortPostDispatchDiagnostic(
           admitted,
-          withEngineDetourInvocationScope({
-            timedOut: false,
-            code: null,
-            stderr: "",
-            thrown: error,
-            skipRunStateWrite: true,
-          }, request.invocationScopeId),
-          adapters,
-          env.principalAuthority,
+          env,
+          `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`,
           io,
-          persistRunState,
-        );
-        return await finishAfterTurn(
-          withProcessCancelSkipAutoResume(
-            { ...failed, turnDispatched: true as const, ...deferredPersist },
-            env.signal,
-          ),
         );
       }
     }
@@ -1318,20 +1250,23 @@ export async function dispatchPostAdmissionTurn<
       ...deferredPersist,
     });
   } finally {
-    try {
-      await lease.release();
-    } catch (error) {
-      // lease.release() is documented best-effort and never rejects in the
-      // production acquireRunWriterLease implementation (createWriterLease
-      // reports cleanup failures via callback, never throws) — this guard is
-      // structural only: an uncaught throw from a finally block silently
-      // replaces whatever the try already returned, including a properly
-      // tagged turnDispatched:true result (#840 r9 判词 class 1 boundary).
-      io.stderr(
-        formatCliDiagnostic(
-          `writer lease release failed unexpectedly (best-effort continue): ${describeErrorIdentity(error)}`,
-        ),
-      );
+    // Public manual resume (#987) holds no package writer lease.
+    if (lease !== undefined) {
+      try {
+        await lease.release();
+      } catch (error) {
+        // lease.release() is documented best-effort and never rejects in the
+        // production acquireRunWriterLease implementation (createWriterLease
+        // reports cleanup failures via callback, never throws) — this guard is
+        // structural only: an uncaught throw from a finally block silently
+        // replaces whatever the try already returned, including a properly
+        // tagged turnDispatched:true result (#840 r9 判词 class 1 boundary).
+        io.stderr(
+          formatCliDiagnostic(
+            `writer lease release failed unexpectedly (best-effort continue): ${describeErrorIdentity(error)}`,
+          ),
+        );
+      }
     }
   }
 }
@@ -1543,8 +1478,10 @@ export async function runPostAdmissionSeatResume<
 }): Promise<{ exitCode: number; admitted?: A; terminal?: T }> {
   let request = input.request;
 
-  // Load once for runDirectory / structural rejection / afterAdmittedLoad;
-  // court identity is judged only after the writer lease is held (below).
+  // Load once for runDirectory / structural rejection / afterAdmittedLoad.
+  // Court identity for public manual resume is judged in the turn builder
+  // (#987: no package writer-lease gate before host CLI resume). Station-child
+  // auto-resume still acquires the shared lease in runWithAutoResumeLoop.
   let loaded;
   try {
     loaded = await input.load(request);
@@ -1575,8 +1512,9 @@ export async function runPostAdmissionSeatResume<
 
   const buildRequestAfterLease = async (): Promise<RoleTurnRequest> => {
         let openCourtAttemptId: string | undefined;
-        // Build uses the admitted judged under this lease (rehydrated when open
-        // court materials ride). Settlement identity stays on the outer admitted.
+        // Build uses the admitted for this resume (rehydrated when open court
+        // materials ride). Settlement identity stays on the outer admitted.
+        // Name kept for station-child callers that still build under lease.
         let admittedForBuild = loaded.admitted;
 
         // Bare resume: open-court pointer is the continue signal (not ledger seal).
@@ -1652,9 +1590,10 @@ export async function runPostAdmissionSeatResume<
     return turnRequest;
   };
 
-  // Court recovery / open under lease, then dispatch.
+  // Court recovery / open, then dispatch. Public manual resume does not take a
+  // package writer lease before the host CLI (#987 / ADR 0080 one-shot).
   // Station-child same-ticket/same-parent resume is call-local auto-resume
-  // (#840 / #416). Public `ak-role resume` stays one-shot (ADR 0080).
+  // (#840 / #416) and still acquires the shared lease in its loop.
   // afterAdmittedPrepare runs inside this try so mint failure and cleanup share one finally.
   try {
     if (input.afterAdmittedPrepare !== undefined) {
@@ -1873,10 +1812,11 @@ export async function runPostAdmissionResumable<
 }
 
 /**
- * Manual resume: lease + dispatch. Pass-through to the host — no sealed-accepted
- * short-circuit (#833 / #416). Court open (summons / message / open court) is
- * built under lease when using buildRequestAfterLease; sole-final stays per-attempt.
- * After-lease build shares dispatchAfterWriterLease with station-child auto-resume.
+ * Manual resume: pass-through to the host CLI resume — no package writer-lease
+ * pre-gate (#987), no sealed-accepted short-circuit (#833 / #416). Court open
+ * (summons / message / open court) is built when using buildRequestAfterLease;
+ * sole-final stays per-attempt. Station-child auto-resume keeps shared lease
+ * acquire in runWithAutoResumeLoop + dispatchAfterWriterLease.
  */
 export async function runPostAdmissionManualResume<
   A extends AdmittedRoleInvocation,
@@ -1885,9 +1825,9 @@ export async function runPostAdmissionManualResume<
   admitted: A;
   env: PostAdmissionEnv;
   io: CliIo;
-  /** Eager turn request (non-court path / seats that build before lease). */
+  /** Eager turn request (non-court path / seats that build before dispatch). */
   request?: RoleTurnRequest;
-  /** After-lease builder (#637). Mutually exclusive with a prebuilt request. */
+  /** Turn builder (#637). Mutually exclusive with a prebuilt request. */
   buildRequestAfterLease?: () => Promise<RoleTurnRequest>;
   adapters: PostAdmissionAdapters<A, T>;
   /** Seat-table engine axis on resume (#600). */
@@ -1896,7 +1836,6 @@ export async function runPostAdmissionManualResume<
   exitCode: number;
   admitted?: A;
   terminal?: T;
-  staleWriterLeaseReclaimed?: true;
 }> {
   const {
     admitted,
@@ -1910,67 +1849,34 @@ export async function runPostAdmissionManualResume<
   // #617 DK-3: manual resume writes the live seat/env model (same as new legs).
   const effectiveModel = env.model;
 
-  let lease: RunWriterLease;
-  let staleWriterLeaseReclaimed: true | undefined;
-  try {
-    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic, kind?: WriterLeaseDiagnosticKind) => {
-      // Record the typed fact before the fallible sink: if io.stderr throws
-      // (acquire deliberately swallows diagnostic-sink failures), the reclaim
-      // still happened and must stay observable.
-      if (kind === "stale-reclaimed") staleWriterLeaseReclaimed = true;
-      io.stderr(diagnostic);
-    });
-  } catch (error) {
-    if (error instanceof RunWriterLeaseHeldError) {
-      io.stderr(formatCliDiagnostic(error.message));
-      // A held rejection after our own reclaim must still carry the fact that
-      // this caller reclaimed the stale lock — e.g. another resumer re-locked
-      // before our retry create (#629).
-      return {
-        exitCode: 1,
-        ...(staleWriterLeaseReclaimed === true
-          ? { staleWriterLeaseReclaimed: true as const }
-          : {}),
-      };
-    }
-    throw error;
-  }
-
   // Explicit public resume is a new counting unit — mint once for this call.
   const invocationScopeId = mintEngineDetourInvocationScope({
     ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
   });
 
-  const result = await dispatchAfterWriterLease({
-    lease,
-    build: async () => {
-      if (request === undefined) {
-        if (buildRequestAfterLease === undefined) {
-          throw new Error(
-            "runPostAdmissionManualResume requires request or buildRequestAfterLease",
-          );
-        }
-        request = await buildRequestAfterLease();
-      }
-      request = withEngineDetourInvocationScope(request, invocationScopeId);
-      return request;
+  if (request === undefined) {
+    if (buildRequestAfterLease === undefined) {
+      throw new Error(
+        "runPostAdmissionManualResume requires request or buildRequestAfterLease",
+      );
+    }
+    request = await buildRequestAfterLease();
+  }
+  request = withEngineDetourInvocationScope(request, invocationScopeId);
+
+  const result = await dispatchPostAdmissionTurn({
+    admitted,
+    env: {
+      ...env,
+      ...(effectiveModel === undefined ? {} : { model: effectiveModel }),
+      ...(admitted.correlationId === undefined
+        ? {}
+        : { correlationId: admitted.correlationId }),
     },
-    dispatch: (turnRequest) =>
-      dispatchPostAdmissionTurn({
-        admitted,
-        env: {
-          ...env,
-          ...(effectiveModel === undefined ? {} : { model: effectiveModel }),
-          ...(admitted.correlationId === undefined
-            ? {}
-            : { correlationId: admitted.correlationId }),
-        },
-        io,
-        request: turnRequest,
-        lease,
-        adapters,
-        ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
-      }),
+    io,
+    request,
+    adapters,
+    ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
   });
   if (
     result.terminal !== undefined &&
@@ -1986,10 +1892,5 @@ export async function runPostAdmissionManualResume<
   if (result.terminal !== undefined) {
     (result.terminal as { autoResumeCount?: number }).autoResumeCount = 0;
   }
-  return {
-    ...result,
-    ...(staleWriterLeaseReclaimed === true
-      ? { staleWriterLeaseReclaimed: true as const }
-      : {}),
-  };
+  return result;
 }

package/dist/public-cli/public-run-credentials.js

@@ -1,49 +0,0 @@
-/**
- * Shared public-run credential seam: one owner for missing selected-provider
- * detection, typed failure construction, pre-dispatch fail-closed payload, and
- * post-run credential annotation. Role runners supply model/credential facts only.
- */
-import { missingPublicProviderCredential, } from "./config.js";
-/**
- * Production-owned provider failure when the selected public seat provider has
- * no configured credential. Cause/identity come from CredentialProviders, not
- * stderr wording. Runner-supplied knownFailure still wins over this annotation.
- */
-export function knownFailureForMissingProviderCredential(model, credentials) {
-    if (model === undefined || credentials === undefined)
-        return undefined;
-    // Only the public credential catalog is fail-closed here; offline/test providers
-    // are not represented in auth.json shape and must not be washed into MissingProviderCredential.
-    if (model.provider !== "openai-codex" && model.provider !== "xai")
-        return undefined;
-    if (!missingPublicProviderCredential(model.provider, credentials)) {
-        return undefined;
-    }
-    return {
-        cause: "provider",
-        identity: {
-            name: "MissingProviderCredential",
-            code: model.provider,
-        },
-    };
-}
-export function missingCredentialPreDispatchFailure(model, credentials) {
-    const knownFailure = knownFailureForMissingProviderCredential(model, credentials);
-    if (knownFailure === undefined)
-        return undefined;
-    return {
-        timedOut: false,
-        code: 1,
-        stderr: `Missing credential for provider ${String(knownFailure.identity?.code ?? "unknown")}`,
-        knownFailure,
-    };
-}
-/**
- * Post-run credential annotation for the shared evidence-priority chain.
- * Only annotates nonzero/timeout exits; never invents a credential failure on success.
- */
-export function postRunMissingCredentialFailure(result, model, credentials) {
-    if (!(result.timedOut || result.code !== 0))
-        return undefined;
-    return knownFailureForMissingProviderCredential(model, credentials);
-}

package/src/public-cli/public-run-credentials.ts

@@ -1,71 +0,0 @@
-/**
- * Shared public-run credential seam: one owner for missing selected-provider
- * detection, typed failure construction, pre-dispatch fail-closed payload, and
- * post-run credential annotation. Role runners supply model/credential facts only.
- */
-import {
-  missingPublicProviderCredential,
-  type CredentialProviders,
-  type SeatModelConfig,
-} from "./config.ts";
-import type { RoleTurnKnownFailure } from "../host-contracts.ts";
-
-/**
- * Production-owned provider failure when the selected public seat provider has
- * no configured credential. Cause/identity come from CredentialProviders, not
- * stderr wording. Runner-supplied knownFailure still wins over this annotation.
- */
-export function knownFailureForMissingProviderCredential(
-  model: SeatModelConfig | undefined,
-  credentials: CredentialProviders | undefined,
-): RoleTurnKnownFailure | undefined {
-  if (model === undefined || credentials === undefined) return undefined;
-  // Only the public credential catalog is fail-closed here; offline/test providers
-  // are not represented in auth.json shape and must not be washed into MissingProviderCredential.
-  if (model.provider !== "openai-codex" && model.provider !== "xai") return undefined;
-  if (!missingPublicProviderCredential(model.provider, credentials)) {
-    return undefined;
-  }
-  return {
-    cause: "provider",
-    identity: {
-      name: "MissingProviderCredential",
-      code: model.provider,
-    },
-  };
-}
-
-/** Pre-dispatch fail-closed payload when selected public provider lacks credentials. */
-export type MissingCredentialPreDispatchFailure = Readonly<{
-  timedOut: false;
-  code: 1;
-  stderr: string;
-  knownFailure: RoleTurnKnownFailure;
-}>;
-
-export function missingCredentialPreDispatchFailure(
-  model: SeatModelConfig | undefined,
-  credentials: CredentialProviders | undefined,
-): MissingCredentialPreDispatchFailure | undefined {
-  const knownFailure = knownFailureForMissingProviderCredential(model, credentials);
-  if (knownFailure === undefined) return undefined;
-  return {
-    timedOut: false,
-    code: 1,
-    stderr: `Missing credential for provider ${String(knownFailure.identity?.code ?? "unknown")}`,
-    knownFailure,
-  };
-}
-
-/**
- * Post-run credential annotation for the shared evidence-priority chain.
- * Only annotates nonzero/timeout exits; never invents a credential failure on success.
- */
-export function postRunMissingCredentialFailure(
-  result: Readonly<{ timedOut: boolean; code: number | null }>,
-  model: SeatModelConfig | undefined,
-  credentials: CredentialProviders | undefined,
-): RoleTurnKnownFailure | undefined {
-  if (!(result.timedOut || result.code !== 0)) return undefined;
-  return knownFailureForMissingProviderCredential(model, credentials);
-}