@akagilnc/pi-workflow-roles 0.1.4977 → 0.1.4989

package/souls/gate-output-guide.md

@@ -2,8 +2,8 @@
 
 三官共读。产出指引，不因措辞拒收。
 
-- `pass`：正常放行
-- `bounce`：职掌内查出须重写。逐条给理由与证据。重写交卷，不是本局失败。
+- `converged`：正常放行
+- `continue`：职掌内查出须重写。逐条给理由与证据。重写交卷，不是本局失败。
 - 受理御前（受审者提交 `escalate`）：能解决就给出答案放其续写；解决不了就放行上呈；没有打回重叫。
 - 第0条：reason 不评格式；中性记账；原卷随附；下一个 LLM 自己读。
 

package/souls/inspector.md

@@ -14,4 +14,4 @@
 
 ## 结论
 
-结论以三态明示：pass（署）／bounce（封驳）／escalate（上呈）。
+结论以三态明示：converged（署）／continue（封驳）／escalate（上呈）。

package/souls/judge-auditor.md

@@ -6,6 +6,6 @@
 二、错封——封驳或所加约束指不出法源，或超出票面与陛下的话。
 三、事实错——判词所引代码事实、法源引文与源头不符。
 
-三者皆无即 pass，一轮了结。判词少写一句而事实立得住，不是错；施工没做完，是大理寺封驳的理由，不是你打回判词的理由。打回与上一轮相同、对方只换措辞重交，上呈。
+三者皆无即 converged，一轮了结。判词少写一句而事实立得住，不是错；施工没做完，是大理寺封驳的理由，不是你打回判词的理由。打回与上一轮相同、对方只换措辞重交，上呈。
 
-调卷宗与取证、纪律依《审刑院法典》。合规则 `pass`；有错则 `bounce`，逐条指出是哪一种错和你查到的原因；无法判断时 `escalate`。
+调卷宗与取证、纪律依《审刑院法典》。合规则 `converged`；有错则 `continue`，逐条指出是哪一种错和你查到的原因；无法判断时 `escalate`。

package/souls/notary.md

@@ -31,4 +31,4 @@
 
 ## 结论
 
-结论以三态明示：'pass'（署） 'bounce'（封驳） 'escalate'（上呈）。
+结论以三态明示：'converged'（署） 'continue'（封驳） 'escalate'（上呈）。

package/souls/quality-law.md

@@ -47,7 +47,7 @@
 
 unfinished 只认两因：**缺前置**——处置当下仍缺少已声明的前置产物、决定或答复，且该缺失使剩余派工当前无法合法执行；**违宪约束**——继续施工将违反 authority 或既裁法源。两因之外的一切理由（执行窗口、时间、工作量、难度等），不得作为 unfinished 成立依据，审官一律封驳。
 
-据实以两因交卷不构成违规，但不自动 pass；所称阻断须可由卷宗独立核对，声明与引用本身不能证明缺失或因果。
+据实以两因交卷不构成违规，但不自动 converged；所称阻断须可由卷宗独立核对，声明与引用本身不能证明缺失或因果。
 
 ## 预警参考线
 

package/src/analyst-gate-cycles-read.ts

@@ -140,7 +140,7 @@ type GateToolCall = {
 };
 
 function isGateTerminatingToolName(toolName: string): boolean {
-  return DISPATCH_TOOLS.has(toolName) || OFFICER_TOOL_TO_FACE[toolName] !== undefined;
+  return toolName === "ak_submission_output" || DISPATCH_TOOLS.has(toolName) || OFFICER_TOOL_TO_FACE[toolName] !== undefined;
 }
 
 /**
@@ -278,6 +278,7 @@ function projectAcceptedGateCall(
     readonly attemptEntryId?: string;
     readonly parentSessionFile?: string;
   },
+  pointerOfficer?: "inspector" | "notary",
 ): ClassifiedVolume | undefined {
   // Continuous memory volumes carry many summons; span only this binding's interval.
   const span = requireAcceptedGateSpan(intervalRowsForGateCall(rows, call.rowIndex), filePath);
@@ -312,7 +313,9 @@ function projectAcceptedGateCall(
     };
   }
 
-  const officer = OFFICER_TOOL_TO_FACE[call.toolName];
+  const officer = call.toolName === "ak_submission_output"
+    ? pointerOfficer
+    : OFFICER_TOOL_TO_FACE[call.toolName];
   if (officer === undefined) {
     // isGateTerminatingToolName already screened; keep loud if tables drift.
     throw new Error(
@@ -334,6 +337,7 @@ function projectAcceptedGateCall(
 
 async function classifyAuditorVolume(
   filePath: string,
+  pointerOfficer?: "inspector" | "notary",
 ): Promise<readonly ClassifiedVolume[]> {
   // Canonical JSONL errors propagate — failure honesty (never wash to fewer rounds).
   const rows = await readLedgerSessionJsonl(filePath);
@@ -342,7 +346,9 @@ async function classifyAuditorVolume(
   if (accepted.length === 0) return [];
   const volumes: ClassifiedVolume[] = [];
   for (const call of accepted) {
-    const projected = projectAcceptedGateCall(filePath, rows, call);
+    const projected = call.toolName === "ak_submission_output" && pointerOfficer === undefined
+      ? undefined // Shared tool alone carries no officer identity; a typed pointer does.
+      : projectAcceptedGateCall(filePath, rows, call, pointerOfficer);
     if (projected !== undefined) volumes.push(projected);
   }
   return volumes;
@@ -425,7 +431,7 @@ function pairGateRounds(
 /** Resolve a direct-officer-run-pointer file to the officer session 正本 path. */
 async function resolveOfficerSessionFromPointerFile(
   pointerPath: string,
-): Promise<string | undefined> {
+): Promise<{ sessionFile: string; officer?: "inspector" | "notary" }> {
   const { readFile } = await import("node:fs/promises");
   let raw: unknown;
   try {
@@ -443,7 +449,9 @@ async function resolveOfficerSessionFromPointerFile(
   if (typeof sessionFile !== "string" || sessionFile.trim() === "") {
     throw new Error(`direct officer run pointer missing sessionFile in ${pointerPath}`);
   }
-  return sessionFile;
+  const officer = raw.officer === "inspector" || raw.officer === "notary"
+    ? raw.officer : undefined;
+  return { sessionFile, ...(officer === undefined ? {} : { officer }) };
 }
 
 /**
@@ -488,15 +496,15 @@ export async function readAnalystGateCyclesFromAuditorRoles(
     for (const name of names) {
       const path = join(directory, name);
       const fromPointer = name.endsWith(".pointer.json");
-      const sessionPath = fromPointer
+      const pointer = fromPointer
         ? await resolveOfficerSessionFromPointerFile(path)
-        : path;
-      if (sessionPath === undefined) continue;
+        : undefined;
+      const sessionPath = pointer?.sessionFile ?? path;
       if (fromPointer) {
         if (classifiedOfficerSessions.has(sessionPath)) continue;
         classifiedOfficerSessions.add(sessionPath);
       }
-      const classified = await classifyAuditorVolume(sessionPath);
+      const classified = await classifyAuditorVolume(sessionPath, pointer?.officer);
       for (const volume of classified) {
         if (
           options.parentSessionFile !== undefined &&

package/src/analyst-metric-families/gate-cycles.ts

@@ -93,8 +93,8 @@ function emptyAccum(): OfficerAccum {
 function absorbRound(accum: OfficerAccum, round: AnalystGateCyclesRoundRow): void {
   accum.rounds += 1;
   accum.wallSum += round.officerWallMs;
-  if (round.status === "bounce") accum.bounceCount += 1;
-  if (round.status === "pass") accum.passCount += 1;
+  if (round.status === "bounce" || round.status === "continue") accum.bounceCount += 1;
+  if (round.status === "pass" || round.status === "converged") accum.passCount += 1;
 }
 
 function finishOfficer(

package/src/audit-escalation.ts

@@ -4,6 +4,7 @@ import type {
   ComplianceDecision,
 } from "./compliance-transport.ts";
 import { GatekeeperDecisionError } from "./submission-errors.ts";
+import type { SubmissionGateNonPassResult } from "./gatekeeper-role.ts";
 
 export const AUDIT_ESCALATION_KIND = "audit_escalation" as const;
 
@@ -37,7 +38,7 @@ export type AuditEscalationToolResult = {
 
 export type OfficerAuditEscalationDecision = {
   readonly status: "escalate";
-  readonly officer?: "inspector" | "notary" | "countersign";
+  readonly officer?: "inspector" | "notary" | "auditor" | "countersign";
   readonly reason?: unknown;
   readonly findings?: unknown;
   readonly conflicts?: unknown;
@@ -113,6 +114,25 @@ export function projectAuditEscalation(
   };
 }
 
+/** Preserve the escalating officer's own gate alongside the raw receipt. */
+export function projectGatekeeperEscalation(
+  result: Extract<SubmissionGateNonPassResult, { status: "escalate" }>,
+  deliveredOutput?: unknown,
+): AuditEscalationToolResult {
+  const receipt = result.receipt;
+  const record = receipt !== null && typeof receipt === "object" && !Array.isArray(receipt)
+    ? receipt as Record<string, unknown>
+    : undefined;
+  return projectAuditEscalation({
+    status: "escalate",
+    officer: result.officer,
+    conflicts: receipt,
+    ...(record !== undefined && Object.hasOwn(record, "decisionGate")
+      ? { decisionGate: record.decisionGate }
+      : {}),
+  }, deliveredOutput);
+}
+
 /**
  * Discriminator-only recognition (ADR 0040). Shape of conflicts/options/gate
  * is not a reject gate — element types and cardinality are delivery content.
@@ -127,7 +147,7 @@ export function isAuditEscalationResult(
 }
 
 export type ComplianceDecisionHandlers<T> = {
-  pass: (usage: Usage | undefined) => T | PromiseLike<T>;
+  converged: (usage: Usage | undefined) => T | PromiseLike<T>;
   /** Project the accepted parent candidate beside the typed audit-leg facts. */
   noReceipt?: (
     facts: Extract<ComplianceDecision, { status: "no-receipt" }>,
@@ -141,7 +161,7 @@ export type ComplianceDecisionHandlers<T> = {
     facts: Extract<ComplianceDecision, { status: "received" }>,
     usageProjection: { usage?: Usage },
   ) => T | PromiseLike<T>;
-  bounce: (violations: readonly unknown[]) => T | PromiseLike<T>;
+  continue: (violations: readonly unknown[]) => T | PromiseLike<T>;
   escalate: (result: AuditEscalationToolResult) => T | PromiseLike<T>;
   /** Host failure beside any recorded auditor payloads — parent is not accepted. */
   transportFailure?: (
@@ -159,8 +179,8 @@ export async function disposeComplianceDecision<T>(
   deliveredOutput?: unknown,
 ): Promise<Awaited<T>> {
   switch (decision.status) {
-    case "pass":
-      return await handlers.pass(decision.usage);
+    case "converged":
+      return await handlers.converged(decision.usage);
     case "no-receipt":
       // The parent candidate remains accepted, but its parallel audit leg is a
       // public typed fact and must not be collapsed into an ordinary pass.
@@ -180,8 +200,8 @@ export async function disposeComplianceDecision<T>(
         decision,
         decision.usage === undefined ? {} : { usage: decision.usage },
       );
-    case "bounce":
-      return await handlers.bounce(decision.violations);
+    case "continue":
+      return await handlers.continue(decision.violations);
     case "escalate":
       return await handlers.escalate(
         projectAuditEscalation(decision, deliveredOutput),

package/src/auditor-role.ts

@@ -15,7 +15,7 @@ export type AuditorRuntimeDependencies = {
 export const AUDITOR_TOOL_SPEC = {
   name: AUDITOR_OUTPUT_TOOL_NAME,
   label: "审刑院输出",
-  description: "审刑院终局回执，状态为 pass、bounce 或 escalate。",
+  description: "审刑院终局回执，status 为 converged、continue 或 escalate。",
   promptSnippet: "审刑院终局回执",
   parameters: auditorOutputSchema,
 } as const;

package/src/compliance-transport.ts

@@ -11,7 +11,7 @@ import { readableGateItem } from "./readable-gate-item.ts";
 export type ComplianceNoReceipt = NoReceiptLifecycleFacts & { status: "no-receipt"; usage?: Usage };
 /**
  * #757 / #750: no unreadable/unusable judgment on auditor replies.
- * Known three-state (pass/bounce/escalate) is read for queueing only.
+ * Known three-state (converged/continue/escalate) is read for queueing only.
  * Unknown accepted shape rides as `received` with the raw reply — parent stands,
  * no forged pass, no shape-death label. Resume-speaker for three pairs is #753/#756.
  */
@@ -29,8 +29,8 @@ export type ComplianceTransportFailure = {
   readonly usage?: Usage;
 };
 export type ComplianceDecision =
-  | { status: "pass"; receipt?: unknown; usage?: Usage }
-  | { status: "bounce"; violations: readonly unknown[]; receipt?: unknown; usage?: Usage }
+  | { status: "converged"; receipt?: unknown; usage?: Usage }
+  | { status: "continue"; violations: readonly unknown[]; receipt?: unknown; usage?: Usage }
   | { status: "escalate"; conflicts?: unknown; decisionGate?: unknown; receipt?: unknown; usage?: Usage }
   | ComplianceNoReceipt
   | ComplianceReceived
@@ -60,15 +60,15 @@ export type AuditorParentAttemptBinding = {
 
 function readListField(value: unknown): readonly unknown[] { return Array.isArray(value) ? value : value === undefined ? [] : [value]; }
 
-/** Try to project a known three-state compliance decision; undefined when not pass/bounce/escalate. */
+/** Try to project a known three-state compliance decision; undefined when not converged/continue/escalate. */
 export function tryReadComplianceCandidate(arguments_: unknown, usage?: Usage): ComplianceDecision | undefined {
   if (typeof arguments_ !== "object" || arguments_ === null || Array.isArray(arguments_)) {
     return undefined;
   }
   const args = arguments_ as Record<string, unknown>;
   const status = args.status;
-  if (status === "pass") return { status, receipt: arguments_, ...(usage === undefined ? {} : { usage }) };
-  if (status === "bounce") return { status, violations: readListField(args.violations), receipt: arguments_, ...(usage === undefined ? {} : { usage }) };
+  if (status === "converged") return { status, receipt: arguments_, ...(usage === undefined ? {} : { usage }) };
+  if (status === "continue") return { status, violations: readListField(args.violations), receipt: arguments_, ...(usage === undefined ? {} : { usage }) };
   if (status === "escalate") {
     return {
       status,
@@ -129,7 +129,7 @@ async function usageFromSummonedSession(summoned: PublicSummonResult): Promise<U
 
 /**
  * Project a public auditor terminal onto the parent compliance decision.
- * Known pass/bounce/escalate/no-receipt flow through for queueing.
+ * Known converged/continue/escalate/no-receipt flow through for queueing.
  * Accepted-but-not-three-state → `received` with raw reply (#757) — no unreadable label,
  * never forged pass, never parent abort. Real provider/engine/disk failures stay loud.
  * Accepted audits always carry real session usage when present (#675 metering).

package/src/countersign-contracts.ts

@@ -5,18 +5,20 @@
  * is defaulted, rewritten, or dropped (ADR 0055).
  */
 
-export const COUNTERSIGN_OUTPUT_TOOL_NAME = "ak_countersign_output";
+import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
+
+export const COUNTERSIGN_OUTPUT_TOOL_NAME = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 
 export type CountersignVerdict =
-  | { countersignStatus: "converged"; note?: string; evidence?: unknown }
+  | { status: "converged"; note?: string; evidence?: unknown }
   | {
-    countersignStatus: "continue";
+    status: "continue";
     fix?: { summary: string };
     note?: string;
     evidence?: unknown;
   }
   | {
-    countersignStatus: "escalate";
+    status: "escalate";
     decisionGate?: { question: string; options: string[] };
     note?: string;
     evidence?: unknown;
@@ -26,16 +28,16 @@ export function validateRecordedCountersignOutput(verdict: unknown): Countersign
   if (verdict === null || typeof verdict !== "object" || Array.isArray(verdict)) {
     throw new Error("Countersign verdict has no execution discriminator");
   }
-  let countersignStatus: unknown;
+  let status: unknown;
   try {
-    countersignStatus = (verdict as Record<string, unknown>).countersignStatus;
+    status = (verdict as Record<string, unknown>).status;
   } catch {
     throw new Error("Countersign verdict has no execution discriminator");
   }
-  if (typeof countersignStatus !== "string") {
+  if (typeof status !== "string") {
     throw new Error("Countersign verdict has no execution discriminator");
   }
-  if (["converged", "continue", "escalate"].includes(countersignStatus)) {
+  if (["converged", "continue", "escalate"].includes(status)) {
     return verdict as CountersignVerdict;
   }
   throw new Error("Countersign verdict has no execution discriminator");

package/src/countersign-role.ts

@@ -1,7 +1,4 @@
-import type { Static } from "typebox";
-import { Type } from "typebox";
-
-import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
+import { reviewSubmissionSchema } from "./review-submission.ts";
 import {
   COUNTERSIGN_OUTPUT_TOOL_NAME,
   validateRecordedCountersignOutput,
@@ -12,44 +9,18 @@ export { COUNTERSIGN_OUTPUT_TOOL_NAME } from "./countersign-contracts.ts";
 export type { CountersignVerdict };
 
 // #836 r16 class 1: fix/note/decisionGate are LLM/human-read narrative content —
-// no code branches on their length or nested presence. `countersignStatus`
-// alone is the machine discriminator the queue reads (src/role-runtime.ts:979-1025).
+// no code branches on their length or nested presence. `status` alone is the
+// machine discriminator the queue reads.
 // #836 (2026-09-11 御批 / ADR 0003 Amendment): registered-to-provider closed
-// value domains reject an unknown countersignStatus before the submission
+// value domains reject an unknown status before the submission
 // ledger ever records it, defeating 读不出三态→resume 说话者本人. Kept open
 // (Type.Unknown) like every other gate-queue status field in this package
 // (notary/auditor/gatekeeper/navigator); src/role-runtime.ts:997-1025 still
 // classifies the recorded value and reasks the countersign itself when it
 // isn't one of the three states — code, not the transport, does that work.
 /** 给事中票庭审读五问的交卷形状（ADR 0074）；形状指引，非 schema 闸。 */
-export const countersignVerdictSchema = withTerminatingOutputDeclarations(
-  Type.Object(
-    {
-      countersignStatus: Type.Unknown({ description: "converged | continue | escalate。非三态时请重读后重交，勿改标。" }),
-      fix: Type.Optional(
-        Type.Object(
-          { summary: Type.Optional(Type.String({ description: "退回摘要" })) },
-          { additionalProperties: true, description: "退回说明" },
-        ),
-      ),
-      note: Type.Optional(Type.String({ description: "附注" })),
-      evidence: Type.Optional(Type.Unknown({ description: "留存证据" })),
-      decisionGate: Type.Optional(
-        Type.Object(
-          {
-            question: Type.Optional(Type.String()),
-            options: Type.Optional(Type.Array(Type.String())),
-          },
-          { additionalProperties: true, description: "需陛下处置的问题与选项" },
-        ),
-      ),
-    },
-    { additionalProperties: true },
-  ),
-);
-(countersignVerdictSchema as unknown as { required: string[] }).required = [];
-
-export type CountersignVerdictParameters = Static<typeof countersignVerdictSchema>;
+export const countersignVerdictSchema = reviewSubmissionSchema;
+export type CountersignVerdictParameters = import("./review-submission.ts").ReviewSubmission;
 
 export type CountersignRuntimeDependencies = {
   loadSoul(): Promise<string>;

package/src/doctor-evidence.ts

@@ -20,10 +20,11 @@ function deriveSession(content: string, id: string): SessionDerivation {
   let accepted: Record<string, unknown> | undefined, observedCommit: string | undefined, turns = 0, calls = 0, tokens = 0;
   const statuses: DoctorCaseCost["statuses"] = [], commits: DoctorCaseCost["commits"] = [];
   for (const row of rows) {
+    if (row.type === "custom" && row.customType === "ak-role-submission-closure" && record(row.data) && row.data.isError === false && typeof row.data.toolName === "string" && isTerminatingToolName(row.data.toolName)) accepted = row;
     const message = record(row.message) ? row.message : undefined;
     if (message?.role === "assistant") { for (const part of Array.isArray(message.content) ? message.content : []) if (record(part) && part.type === "toolCall") calls++; if (typeof message.responseId === "string") { turns++; const usage = record(message.usage) ? message.usage : undefined; if (usage && typeof usage.output === "number") tokens += usage.output; } }
     if (message?.role === "toolResult" && message.isError !== true && typeof message.toolName === "string" && isTerminatingToolName(message.toolName) && record(message.details)) { let details; try { details = validateAcceptedDetails(message.toolName, message.details); } catch (error) { // Contract: README.md#Doctor — non-accepted terminating receipts are expected-negative evidence and are skipped; all other validation failures propagate with their cause.
-        if (error instanceof AcceptedDetailsContractError) continue; throw error; } accepted = row; const facts = acceptedFacts(message.toolName, details); if (facts.commit && facts.commit !== observedCommit) { commits.push({ source: id, commit: facts.commit }); observedCommit = facts.commit; } /* #836 B10.3: do not wipe earlier statuses or invent a code status sentence */ if (facts.status !== undefined) { statuses.push({ source: id, status: facts.status }); } }
+        if (error instanceof AcceptedDetailsContractError) continue; throw error; } const facts = acceptedFacts(message.toolName, details); if (facts.commit && facts.commit !== observedCommit) { commits.push({ source: id, commit: facts.commit }); observedCommit = facts.commit; } /* #836 B10.3: do not wipe earlier statuses or invent a code status sentence */ if (facts.status !== undefined) { statuses.push({ source: id, status: facts.status }); } }
   }
   const acceptedAt = accepted && timestamp(accepted); const final = acceptedAt ? accepted! : rows.at(-1); const endedAt = final && timestamp(final); const wall = startedAt && endedAt ? Date.parse(endedAt) - Date.parse(startedAt) : undefined;
   if (wall !== undefined && wall < 0) degradationReasons.push(`non-monotonic session timestamps in ${id}`);

package/src/doctor-role.ts

@@ -1,7 +1,6 @@
 import type { RoleHost, HostContext, HostToolResult } from "./host-contracts.ts";
 import { disposeComplianceDecision } from "./audit-escalation.ts";
 import { ComplianceResponseRetentionError, type ComplianceDecision } from "./compliance-transport.ts";
-import { GatekeeperDecisionError } from "./submission-errors.ts";
 import { DOCTOR_CANDIDATE_ENTRY_TYPE } from "./dossier-resolution.ts";
 import { readableGateItem } from "./readable-gate-item.ts";
 import { DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_DESCRIPTION, DOCTOR_OUTPUT_TOOL_NAME, DoctorEvidenceStore, doctorEvidenceReadSchema, doctorSubmissionSchema, validateDoctorOutput, type DoctorCase } from "./doctor-contracts.ts";
@@ -37,7 +36,7 @@ export function createDoctorRoleRuntime(pi: RoleHost, dependencies: DoctorRoleDe
   let activation: { soul: string; patient: DoctorCase; store: DoctorEvidenceStore } | undefined; let registered = false; pi.registerFlag(DOCTOR_CASE_FLAG.name, DOCTOR_CASE_FLAG.definition);
   return { async activate() { const path = pi.getFlag(DOCTOR_CASE_FLAG.name); if (typeof path !== "string" || !path.trim()) throw new Error("Doctor requires --ak-doctor-case"); const soul = (await dependencies.loadSoul()).trim(); if (!soul) throw new Error("Doctor soul is empty"); const patient = await dependencies.loadCase(path); activation = { soul, patient, store: new DoctorEvidenceStore(patient) };
     if (!registered) { registered = true; pi.registerTool({ name: DOCTOR_EVIDENCE_TOOL_NAME, label: "太医署证据", description: "分页读取留存的 Pi session 字节。", parameters: doctorEvidenceReadSchema, async execute(_id: string, params: { evidenceId: string; offset?: number; limit?: number }) { if (!activation) throw new Error("太医署未激活"); const details = activation.store.read(params.evidenceId, params.offset, params.limit); return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details }; } });
-      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "太医署输出", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id: string, params: unknown, signal: AbortSignal | undefined, _update: unknown, ctx: HostContext): Promise<HostToolResult<unknown>> { if (!activation) throw new Error("太医署未激活"); const active = activation; const testimony = validateDoctorOutput(params, active.patient, active.store); try { appendCandidate(ctx, { version: 1, testimony, cost: active.patient.cost, readRecord: active.store.readRecord(), patientIdentity: active.patient.identity }); } catch (error) { host.failInfrastructure(error, ctx, id); } let audit: ComplianceDecision; try { audit = await dependencies.auditCompliance(signal === undefined ? { context: ctx, submission: testimony } : { context: ctx, signal, submission: testimony }); } catch (error) { host.failInfrastructure(error, ctx, id); } const acceptedDetails = testimony; return disposeComplianceDecision<HostToolResult<unknown>>(audit, { pass: (usage) => ({ content: audit.status === "pass" && audit.receipt !== undefined ? [{ type: "text" as const, text: readableGateItem(audit.receipt) }] : [], details: acceptedDetails, terminate: true as const, ...(usage === undefined ? {} : { usage }) }), noReceipt: (auditNoReceipt, usageProjection) => { try { appendCandidate(ctx, { version: 1, testimony, cost: active.patient.cost, auditNoReceipt, readRecord: active.store.readRecord(), patientIdentity: active.patient.identity }); } catch (error) { host.failInfrastructure(error, ctx, id); } return { content: [], details: acceptedDetails, terminate: true as const, ...usageProjection }; }, received: () => { throw new Error("审刑院非三态应交 runComplianceAudit 重问说话者"); }, bounce: (violations) => { throw new GatekeeperDecisionError({ status: "bounce", officer: "auditor", receipt: audit.status === "bounce" ? audit.receipt ?? violations : violations }); }, escalate: (result) => result, transportFailure: (facts) => { host.failInfrastructure(Object.assign(new Error(facts.diagnostic), { name: "ComplianceTransportFailure", ...(facts.submissions === undefined && facts.terminal === undefined ? {} : { submission: facts.submissions ?? facts.terminal }) }), ctx, id); } }, acceptedDetails); } });
+      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "太医署输出", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id: string, params: unknown, signal: AbortSignal | undefined, _update: unknown, ctx: HostContext): Promise<HostToolResult<unknown>> { if (!activation) throw new Error("太医署未激活"); const active = activation; const testimony = validateDoctorOutput(params, active.patient, active.store); try { appendCandidate(ctx, { version: 1, testimony, cost: active.patient.cost, readRecord: active.store.readRecord(), patientIdentity: active.patient.identity }); } catch (error) { host.failInfrastructure(error, ctx, id); } let audit: ComplianceDecision; try { audit = await dependencies.auditCompliance(signal === undefined ? { context: ctx, submission: testimony } : { context: ctx, signal, submission: testimony }); } catch (error) { host.failInfrastructure(error, ctx, id); } const acceptedDetails = testimony; return disposeComplianceDecision<HostToolResult<unknown>>(audit, { converged: (usage) => ({ content: audit.status === "converged" && audit.receipt !== undefined ? [{ type: "text" as const, text: readableGateItem(audit.receipt) }] : [], details: acceptedDetails, terminate: true as const, ...(usage === undefined ? {} : { usage }) }), noReceipt: (auditNoReceipt, usageProjection) => { try { appendCandidate(ctx, { version: 1, testimony, cost: active.patient.cost, auditNoReceipt, readRecord: active.store.readRecord(), patientIdentity: active.patient.identity }); } catch (error) { host.failInfrastructure(error, ctx, id); } return { content: [], details: acceptedDetails, terminate: true as const, ...usageProjection }; }, received: () => { throw new Error("审刑院非三态应交 runComplianceAudit 重问说话者"); }, continue: (violations) => ({ content: [{ type: "text" as const, text: readableGateItem(audit.status === "continue" ? audit.receipt ?? violations : violations) }], details: acceptedDetails, terminate: false as const }), escalate: (result) => result, transportFailure: (facts) => { host.failInfrastructure(Object.assign(new Error(facts.diagnostic), { name: "ComplianceTransportFailure", ...(facts.submissions === undefined && facts.terminal === undefined ? {} : { submission: facts.submissions ?? facts.terminal }) }), ctx, id); } }, acceptedDetails); } });
       pi.on("before_agent_start", (event) => { if (!activation) throw new Error("太医署未激活"); const catalog = { version: activation.patient.version, identity: activation.patient.identity, admittedMetrics: { cost: activation.patient.cost }, lawfulTargetKeys: ["case", ...activation.patient.cost.invocations.sources], evidence: activation.patient.evidence.map(({ id, kind, sha256, byteLength, contentLength }) => ({ id, kind, sha256, byteLength, contentLength })) }; return { systemPrompt: `${event.systemPrompt}\n\n<doctor_soul>\n${activation.soul}\n</doctor_soul>\n\n<doctor_case>\n${JSON.stringify(catalog)}\n</doctor_case>` }; }); }
     const required = [DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_NAME]; const names = pi.getAllTools().map((tool) => tool.name); for (const name of required) if (names.filter((item) => item === name).length !== 1) throw new Error(`Doctor required tool collision or missing: ${name}`); pi.setActiveTools(required); const active = pi.getActiveTools?.() ?? required; if (active.length !== 2 || !required.every((name) => active.includes(name))) throw new Error("Doctor active tool narrowing failed"); } };
 }

package/src/gatekeeper-role.ts

@@ -2,10 +2,11 @@ import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { HostContext } from "./host-contracts.ts";
 
 import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
-import { packagedGateDecision, packagedGateStageLabel } from "./packaged-role-registry.ts";
+import { packagedGateStageLabel } from "./packaged-role-registry.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 import { GatekeeperDecisionError } from "./submission-errors.ts";
 import { INSPECTOR_OUTPUT_TOOL_NAME } from "./inspector-contracts.ts";
+import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
 import {
   GATEKEEPER_OUTPUT_TOOL_NAME,
   gatekeeperDecisionSchema,
@@ -15,7 +16,7 @@ import type { PublicSummonResult } from "./public-role-summons.ts";
 import type { TerminalResult } from "./public-cli/terminal.ts";
 import { runIdFromRunDirectory } from "./run-terminal-artifacts.ts";
 export const INSPECTOR_OUTPUT_TOOL = INSPECTOR_OUTPUT_TOOL_NAME;
-export const NOTARY_OUTPUT_TOOL = "ak_notary_output";
+export const NOTARY_OUTPUT_TOOL = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 
 /** Gate review officers — 台院 / 符宝郎 / 审刑院 / 给事中 (#753 / #756 / #969). */
 export type GateOfficer = "inspector" | "notary" | "auditor" | "countersign";
@@ -38,14 +39,14 @@ export type GatekeeperSubject =
  */
 export type GatekeeperResult =
   | {
-      readonly status: "pass";
+      readonly status: "converged";
       readonly officer: GateOfficer;
       readonly receipt: unknown;
       readonly runId?: string;
     }
-  /** bounce | escalate: both return the officer receipt to the parent (#753 / #756). */
+  /** continue | escalate: both return the officer receipt to the parent (#753 / #756). */
   | {
-      readonly status: "bounce";
+      readonly status: "continue";
       readonly officer: GateOfficer;
       readonly receipt: unknown;
       readonly runId?: string;
@@ -58,9 +59,9 @@ export type GatekeeperResult =
     }
   | {
       /**
-       * Accepted reply whose conclusion is not pass|bounce|escalate.
+       * Accepted reply whose conclusion is not converged|continue|escalate.
        * Envelope resumes the officer with plain-language re-ask — never parent-stands,
-       * never forges bounce (#753 / unreadable-conclusion-resume-speaker).
+       * never forges continue (#753 / unreadable-conclusion-resume-speaker).
        */
       readonly status: "needs_reask";
       readonly officer: GateOfficer;
@@ -77,9 +78,9 @@ export type GatekeeperResult =
     };
 
 /** Non-pass faces returned to the parent session (correctable; #836 never kill leg). */
-export type GatekeeperNonPassResult = Extract<
+export type SubmissionGateNonPassResult = Extract<
   GatekeeperResult,
-  { status: "bounce" | "escalate" | "no_receipt" | "transport_failure" }
+  { status: "continue" | "escalate" | "no_receipt" | "transport_failure" }
 >;
 
 function gateSeatLabel(stage: GateOfficer): string {
@@ -138,16 +139,16 @@ export type RunGatekeeperOptions = {
   readonly submission?: unknown;
   /**
    * Officer summon seam. Production default lives on the shared envelope
-   * (`createDefaultGateOfficerSummon` / requireGatekeeperPass — ADR 0018).
+   * (`createDefaultGateOfficerSummon` / requireSubmissionGate — ADR 0018).
    * Role module only projects; callers must supply the summon.
    */
   readonly summonOfficer: GateOfficerSummon;
 };
 
-export type GatekeeperPassHostActions = {
+export type SubmissionGateHostActions = {
   failInfrastructure(error: unknown, ctx: ExtensionContext | HostContext, toolCallId?: string): never;
   /** Envelope-owned execute→tool_result bridge (role-runtime); role module only throws typed error. */
-  bindSubmissionNonPass(toolCallId: string, result: GatekeeperNonPassResult): void;
+  bindSubmissionNonPass(toolCallId: string, result: SubmissionGateNonPassResult): void;
 };
 
 /**
@@ -204,15 +205,15 @@ function readRecord(value: unknown): Record<string, unknown> | undefined {
 
 /**
  * Read only the conclusion field for queueing (#753).
- * pass | bounce | escalate → queue signal + raw receipt.
+ * converged | continue | escalate → queue signal + raw receipt.
  * Anything else accepted → needs_reask (resume speaker), never unreadable/parent-stand.
  * `fallbackStatus` is the terminal outcome.status when the receipt body has no status key
  * (keeps missing-args sentinel intact as the receipt).
  */
-/** Map 给事中 countersignStatus onto the shared gate queue words (#969). */
-function gateStatusFromCountersign(status: string): string | undefined {
-  if (status === "converged") return "pass";
-  if (status === "continue") return "bounce";
+/** Map the shared review verdict onto the gate queue words (#1028). */
+function reviewQueueStatus(status: string): string | undefined {
+  if (status === "converged") return "converged";
+  if (status === "continue") return "continue";
   if (status === "escalate") return "escalate";
   return undefined;
 }
@@ -224,34 +225,15 @@ function projectOfficerDecision(
 ): GatekeeperResult {
   const receipt = retainedReceipt(decision);
   const record = readRecord(decision);
-  // 给事中: only countersignStatus, strict three-word map; never generic status,
-  // never unmapped raw word, never fallbackStatus (#969 / ADR 0040/0055).
-  if (packagedGateDecision(officer) === "countersign-status") {
-    const countersignStatus =
-      record !== undefined && typeof record.countersignStatus === "string"
-        ? record.countersignStatus
-        : undefined;
-    const status =
-      typeof countersignStatus === "string"
-        ? gateStatusFromCountersign(countersignStatus)
-        : undefined;
-    if (status === "pass") {
-      return { status: "pass", officer, receipt };
-    }
-    if (status === "bounce" || status === "escalate") {
-      return { status, officer, receipt };
-    }
-    return { status: "needs_reask", officer, receipt };
-  }
-  // inspector / notary / auditor: shared gate words on generic status.
   const status =
     (record !== undefined && typeof record.status === "string" ? record.status : undefined)
     ?? fallbackStatus;
-  if (status === "pass") {
-    return { status: "pass", officer, receipt };
+  const queueStatus = typeof status === "string" ? reviewQueueStatus(status) : undefined;
+  if (queueStatus === "converged") {
+    return { status: "converged", officer, receipt };
   }
-  if (status === "bounce" || status === "escalate") {
-    return { status, officer, receipt };
+  if (queueStatus === "continue" || queueStatus === "escalate") {
+    return { status: queueStatus, officer, receipt };
   }
   return { status: "needs_reask", officer, receipt };
 }
@@ -316,8 +298,8 @@ function withOfficerRunId(
   summoned: PublicSummonResult,
 ): GatekeeperResult {
   if (
-    result.status !== "pass"
-    && result.status !== "bounce"
+    result.status !== "converged"
+    && result.status !== "continue"
     && result.status !== "escalate"
     && result.status !== "needs_reask"
   ) {
@@ -382,8 +364,8 @@ function projectOfficerTerminal(
   }
   if (outcome.kind === "accepted") {
     // outcome.status is the fixture/compat leaf: production settlement leaves
-    // it undefined once payloads are recorded, so this only matters when a
-    // caller still supplies status without any recorded payload (#836 hang).
+    // it undefined once payloads are recorded. It may interpret a receipt
+    // lacking its own status, never substitute for a missing receipt.
     return withOfficerRunId(
       projectOfficerPayloads(officer, thisCourt, outcome.status),
       summoned,
@@ -409,28 +391,21 @@ export type GatekeeperProjection = {
 };
 
 /**
- * Plain-language re-ask when the officer conclusion is not pass|bounce|escalate.
+ * Plain-language re-ask when the officer conclusion is not converged|continue|escalate.
  * Not a packaged engine handbook line (#755 exception for 读不出三态).
- * inspector / notary / auditor keep shared gate words; 给事中 uses own three-state
- * field and words so reask does not invite non-contract values (#969 / ADR 0055).
+ * Every review officer uses the same `status` field and three queue words (#1028).
  */
 export const OFFICER_CONCLUSION_REASK =
-  "上次交卷的结论不是 pass、bounce、escalate 三态之一。请重新输出，结论字段写明其一；打回或上呈的话就是给对方看的原文。" as const;
-
-/** 给事中 re-ask: countersignStatus converged|continue|escalate only (#969). */
-export const COUNTERSIGN_CONCLUSION_REASK =
-  "上次交卷的 countersignStatus 不是 converged、continue、escalate 三态之一。请重新输出，countersignStatus 写明其一；封驳或上呈的话就是给对方看的原文。" as const;
+  "上次交卷的 status 不是 converged、continue、escalate 三态之一。请重新输出，status 写明其一；continue 或 escalate 的话就是给对方看的原文。" as const;
 
 /** Pick the re-ask line for the officer under review. */
 export function officerConclusionReask(officer: GateOfficer): string {
-  return packagedGateDecision(officer) === "countersign-status"
-    ? COUNTERSIGN_CONCLUSION_REASK
-    : OFFICER_CONCLUSION_REASK;
+  return OFFICER_CONCLUSION_REASK;
 }
 
 /**
  * Summon (via injected seam) + project. Default summonGateOfficer drive lives
- * on the shared envelope (`gatekeeper-pass-envelope.ts`, ADR 0018 / #675) —
+ * on the shared envelope (`submission-gate.ts`, ADR 0018 / #675) —
  * role module keeps projection only.
  */
 export async function projectGatekeeperRun(