@akagilnc/pi-workflow-roles 0.1.5797 → 0.1.5820

package/dist/worker-role.js

@@ -0,0 +1,184 @@
+import { validateAcceptedWorkerDetails, } from "./package-contracts/worker-output.js";
+import { validateFixerOutput } from "./package-contracts/fixer-output.js";
+import { registerFiledSubmissionTool } from "./filed-submission.js";
+import { roleSubmissionDeclaration } from "./role-submission-declarations.js";
+import { createWorkerSubmissionGate, WorkerCommitReminderError, WorkerPrefixReminderError, WorkerUnfinishedReasonReminderError, } from "./worker-submission-gates.js";
+import { deliveryLimitFromEnv } from "./receipt-delivery-policy.js";
+import { fixerBashSeatbeltDenyReason, matchFixerBashForbiddenLiteral, } from "./fixer-bash-seatbelt.js";
+import { isRecord } from "./unknown-value.js";
+export { CODER_OUTPUT_TOOL_NAME, FIXER_OUTPUT_TOOL_NAME, coderOutputSchema, validateAcceptedWorkerDetails, } from "./package-contracts/worker-output.js";
+/** #1168: phase only — dispatch text is the first message, not a packet flag. */
+export const FIXER_FLAG_DEFINITIONS = {
+    phase: {
+        name: "ak-fixer-phase",
+        definition: {
+            description: "Fixer phase: plan (inspect and propose a repair plan; no edits or commits) or apply (execute the approved plan, verify, and commit when repaired)",
+            type: "string",
+        },
+    },
+};
+export const FIXER_PHASES = ["plan", "apply"];
+function isWorkerPhase(value) {
+    return typeof value === "string" && FIXER_PHASES.includes(value);
+}
+/** Read only the field that selects the worker's next package-owned path. */
+function workerStatusOf(output) {
+    return isRecord(output) && typeof output.status === "string"
+        ? output.status
+        : undefined;
+}
+function deepFreeze(value) {
+    if (typeof value !== "object" || value === null || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}
+export function validateWorkerOutput(output, phase, roleLabel) {
+    if (roleLabel === "Fixer")
+        return validateFixerOutput(output, phase);
+    return validateAcceptedWorkerDetails(output, "Coder");
+}
+/**
+ * Coder and fixer share one submission sequence: record via the shared tool,
+ * then read status and bounce through the same reminder gate.
+ * Seat differences stay in the ready check and the projection.
+ */
+function registerWorkerSubmission(pi, role, options) {
+    registerFiledSubmissionTool(pi, roleSubmissionDeclaration(role), {
+        readyError: () => (options.ready() ? undefined : options.notReady),
+        beforeAccept: async ({ toolCallId, parameters, ctx }) => {
+            const phase = options.phase();
+            if (phase === undefined)
+                throw new Error(options.notReady);
+            const output = options.project(parameters, phase);
+            const status = workerStatusOf(output);
+            if (status !== undefined) {
+                assertAcceptableThroughHost(options.submissionGate, status, output, options.hostActions, ctx, toolCallId);
+            }
+            return output;
+        },
+    });
+}
+/** Reminder bounces stay typed rejects; IO/infrastructure keep identity via host failInfrastructure. */
+function assertAcceptableThroughHost(submissionGate, status, details, hostActions, ctx, toolCallId) {
+    try {
+        submissionGate.assertAcceptable(status, details);
+    }
+    catch (error) {
+        if (error instanceof WorkerCommitReminderError ||
+            error instanceof WorkerPrefixReminderError ||
+            error instanceof WorkerUnfinishedReasonReminderError) {
+            throw error;
+        }
+        hostActions.failInfrastructure(error, ctx, toolCallId);
+    }
+}
+export function createFixerRoleRuntime(pi, dependencies, hostActions, options) {
+    let soul;
+    let phase;
+    let lifecycleRegistered = false;
+    // #1132: ADR 0050 缺理由催全次数. The in-process seam passes the value it
+    // already resolved; the Pi child has only the env that seam projected.
+    const submissionGate = createWorkerSubmissionGate({
+        unfinishedReasonBounceLimit: options?.unfinishedReasonBounceLimit
+            ?? deliveryLimitFromEnv(process.env),
+    });
+    pi.registerFlag(FIXER_FLAG_DEFINITIONS.phase.name, FIXER_FLAG_DEFINITIONS.phase.definition);
+    return {
+        async activate() {
+            soul = (await dependencies.loadSoul()).trim();
+            if (soul.length === 0)
+                throw new Error("Fixer soul is empty");
+            const selectedPhase = pi.getFlag(FIXER_FLAG_DEFINITIONS.phase.name);
+            if (!isWorkerPhase(selectedPhase)) {
+                throw new Error("Fixer role requires --ak-fixer-phase plan|apply; no other phase is supported");
+            }
+            phase = selectedPhase;
+            if (!lifecycleRegistered) {
+                lifecycleRegistered = true;
+                registerWorkerSubmission(pi, "fixer", {
+                    notReady: "修内司阶段未装载",
+                    ready: () => phase !== undefined,
+                    phase: () => phase,
+                    project: (parameters, current) => deepFreeze(validateFixerOutput(parameters, current)),
+                    submissionGate,
+                    hostActions,
+                });
+                pi.on("tool_call", (event) => {
+                    if (event.toolName !== "bash")
+                        return;
+                    const command = event.input["command"];
+                    if (typeof command !== "string")
+                        return;
+                    const matched = matchFixerBashForbiddenLiteral(command);
+                    if (matched === undefined)
+                        return;
+                    return {
+                        block: true,
+                        reason: fixerBashSeatbeltDenyReason(matched),
+                    };
+                });
+                // #1168: soul + phase only; dispatch text is the first message.
+                pi.on("before_agent_start", (event) => {
+                    if (soul === undefined)
+                        throw new Error("修内司职分未装载");
+                    return {
+                        systemPrompt: `${event.systemPrompt}\n\n<fixer_soul>\n${soul}\n</fixer_soul>\n\n<fixer_phase>\n${phase ?? ""}\n</fixer_phase>`,
+                    };
+                });
+            }
+        },
+        armSubmissionGate(cwd, parent, invocationScopeId) {
+            submissionGate.arm(cwd, parent, invocationScopeId);
+        },
+    };
+}
+export function createCoderRoleRuntime(pi, dependencies, hostActions, options) {
+    let soul;
+    let phase;
+    let lifecycleRegistered = false;
+    // #1132: same resolved ceiling as the fixer gate. Absent = Pi child env.
+    const submissionGate = createWorkerSubmissionGate({
+        unfinishedReasonBounceLimit: options?.unfinishedReasonBounceLimit
+            ?? deliveryLimitFromEnv(process.env),
+    });
+    pi.registerFlag("ak-coder-phase", {
+        description: "Coder phase: plan (inspect and propose an implementation plan; no edits or commits) or apply (execute the approved plan and verify the first implementation)",
+        type: "string",
+    });
+    return {
+        async activate() {
+            soul = (await dependencies.loadSoul()).trim();
+            if (soul.length === 0)
+                throw new Error("Coder soul is empty");
+            const selectedPhase = pi.getFlag("ak-coder-phase");
+            if (selectedPhase !== "plan" && selectedPhase !== "apply") {
+                throw new Error("Coder role requires --ak-coder-phase plan|apply; no other phase is supported");
+            }
+            phase = selectedPhase;
+            if (!lifecycleRegistered) {
+                lifecycleRegistered = true;
+                registerWorkerSubmission(pi, "coder", {
+                    notReady: "将作监阶段未装载",
+                    ready: () => phase !== undefined,
+                    phase: () => phase,
+                    project: (parameters, current) => validateWorkerOutput(parameters, current, "Coder"),
+                    submissionGate,
+                    hostActions,
+                });
+                // #1168: soul + phase only; dispatch text is the first message.
+                pi.on("before_agent_start", (event) => {
+                    if (soul === undefined)
+                        throw new Error("将作监职分未装载");
+                    return {
+                        systemPrompt: `${event.systemPrompt}\n\n<coder_soul>\n${soul}\n</coder_soul>\n\n<coder_phase>\n${phase ?? ""}\n</coder_phase>`,
+                    };
+                });
+            }
+        },
+        armSubmissionGate(cwd, parent, invocationScopeId) {
+            submissionGate.arm(cwd, parent, invocationScopeId);
+        },
+    };
+}

package/dist/worker-submission-gates.js

@@ -0,0 +1,333 @@
+/** #242/#369 worker gates ①② at submission seam.
+ * Durability (#1178): this leg's state.jsonl via reportRunRecord / readStateControlRowsSync.
+ * No session/worker-submission-gate/ side-branch nest.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, lstatSync, readdirSync, readFileSync, rmdirSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { runDirectoryOfSessionFile } from "./role-run-placement.js";
+import { readStateControlRowsSync } from "./run-dossier.js";
+import { RUN_STATE_FILE } from "./run-dossier-files.js";
+import { reportRunRecord } from "./sitian-facade.js";
+import { WorkerCommitReminderError, WorkerPrefixReminderError, WorkerUnfinishedReasonReminderError, } from "./submission-errors.js";
+import { WORKER_DONE_STATUSES } from "./worker-submission-contracts.js";
+import { deliveryLimitFromConfig } from "./receipt-delivery-policy.js";
+import { isRecord } from "./unknown-value.js";
+export { WorkerCommitReminderError, WorkerPrefixReminderError, WorkerUnfinishedReasonReminderError } from "./submission-errors.js";
+export { WORKER_DONE_STATUSES } from "./worker-submission-contracts.js";
+export const WORKER_COMMIT_BASELINE_ENTRY_TYPE = "commit-baseline";
+export const WORKER_COMMIT_REMINDER_BOUNCE_ENTRY_TYPE = "commit-reminder-bounce";
+export const WORKER_PREFIX_REMINDER_BOUNCE_ENTRY_TYPE = "prefix-reminder-bounce";
+export const WORKER_UNFINISHED_REASON_BOUNCE_ENTRY_TYPE = "unfinished-reason-bounce";
+/** Historical package hook ownership marker — uninstall criterion only. */
+const HOOK_MARKER = "ak-roles: worker-submission-gates reference-transaction";
+const HOOKS_DIR = "ak-roles-hooks";
+const HOOK_FILE = "reference-transaction";
+/** Open platform-prefix domain (constitution #10) — not a closed singleton. */
+const PLATFORM_PREFIX = /^[A-Za-z][A-Za-z0-9_-]*:/;
+const GATE_SOURCE = "worker-submission-gates";
+function git(cwd, args) {
+    return execFileSync("git", args, {
+        cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, GIT_DIR: undefined, GIT_WORK_TREE: undefined, GIT_COMMON_DIR: undefined },
+    }).trim();
+}
+function gitFile(file, args) {
+    return execFileSync("git", ["config", "--file", file, ...args], {
+        encoding: "utf8", stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, GIT_DIR: undefined, GIT_WORK_TREE: undefined, GIT_COMMON_DIR: undefined },
+    }).trim();
+}
+function statusOf(error) {
+    return typeof error === "object" && error !== null && "status" in error
+        ? error.status
+        : undefined;
+}
+function tryGetAll(file, key) {
+    if (!existsSync(file))
+        return [];
+    try {
+        const out = gitFile(file, ["--get-all", key]);
+        return out.length === 0 ? [] : out.split("\n");
+    }
+    catch (error) {
+        // --get-all exit 1 = absent; other failures stay loud.
+        if (statusOf(error) !== 1)
+            throw error;
+        return [];
+    }
+}
+/** True only when the file exists and carries the historical package marker.
+ *  Read failures propagate — never disguised as "not owned". */
+function ownedHook(path) {
+    if (!existsSync(path))
+        return false;
+    return readFileSync(path, "utf8").includes(HOOK_MARKER);
+}
+/** Escape a hooksPath value for git config --unset value-pattern (POSIX ERE). */
+function escapeGitConfigValueRegex(value) {
+    return value.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+}
+/**
+ * Remove only package-owned core.hooksPath values; keep every foreign value.
+ * --unset without a value-pattern exits 5 for both "absent" and "multi-value",
+ * so multi-valued keys must be addressed per matching value.
+ */
+function unsetOwnedHooksPath(file) {
+    const owned = [];
+    for (const value of tryGetAll(file, "core.hooksPath")) {
+        if (!ownedHook(resolve(value, HOOK_FILE)))
+            continue;
+        try {
+            // --unset-all + exact value-pattern drops every duplicate owned copy; foreign stays.
+            gitFile(file, [
+                "--unset-all",
+                "core.hooksPath",
+                `^${escapeGitConfigValueRegex(value)}$`,
+            ]);
+        }
+        catch (error) {
+            // 5 = this specific value already absent (not multi-value ambiguity).
+            if (statusOf(error) !== 5)
+                throw error;
+        }
+        owned.push(value);
+    }
+    return owned;
+}
+/** Delete only the package-owned hook file; rmdir solely when empty. */
+function rmOwnedDir(dir) {
+    const hookPath = resolve(dir, HOOK_FILE);
+    if (!ownedHook(hookPath))
+        return;
+    rmSync(hookPath, { force: true });
+    if (existsSync(dir) && readdirSync(dir).length === 0)
+        rmdirSync(dir);
+}
+function linkedGitDirs(commonDir) {
+    const root = resolve(commonDir, "worktrees");
+    if (!existsSync(root))
+        return [];
+    // Enumeration/lstat failures propagate — never skip a linked admin dir silently.
+    // lstat does not follow: symlink entries are not directories and stay out of range.
+    return readdirSync(root)
+        .map((name) => resolve(root, name))
+        .filter((dir) => lstatSync(dir).isDirectory());
+}
+/**
+ * ADR 0070 §4 — private one-shot uninstall on arm.
+ * Range: current repo + enumerable worktree admin dirs. Owned hooksPath/files only.
+ * Never rolls back extensions.worktreeConfig / migrated bare|worktree / foreign hooksPath.
+ */
+function uninstallPackageWorkerHooks(cwd) {
+    let inside;
+    try {
+        inside = git(cwd, ["rev-parse", "--is-inside-work-tree"]);
+    }
+    catch {
+        return;
+    }
+    if (inside !== "true")
+        return;
+    const commonDir = git(cwd, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+    // Unset owned hooksPath before deleting the marker file (ownership check needs it).
+    const clear = (configFile) => {
+        for (const hooks of unsetOwnedHooksPath(configFile))
+            rmOwnedDir(hooks);
+    };
+    clear(resolve(commonDir, "config"));
+    clear(resolve(commonDir, "config.worktree"));
+    rmOwnedDir(resolve(commonDir, HOOKS_DIR));
+    const legacy = resolve(commonDir, "hooks", HOOK_FILE);
+    if (ownedHook(legacy))
+        rmSync(legacy, { force: true });
+    for (const gitDir of linkedGitDirs(commonDir)) {
+        clear(resolve(gitDir, "config.worktree"));
+        rmOwnedDir(resolve(gitDir, HOOKS_DIR));
+    }
+}
+/** ADR 0050: a written explanation, including text carried by an object key. */
+function containsWrittenReason(value) {
+    if (typeof value === "string")
+        return value.trim().length > 0;
+    if (Array.isArray(value))
+        return value.some(containsWrittenReason);
+    if (isRecord(value)) {
+        return Object.entries(value).some(([key, item]) => containsWrittenReason(key) || containsWrittenReason(item));
+    }
+    return false;
+}
+function unfinishedReasonPresent(details) {
+    if (!isRecord(details))
+        return false;
+    return containsWrittenReason(details.reason);
+}
+function liveRunDirectory(parent) {
+    const file = parent.getSessionFile();
+    if (file === undefined || file.length === 0) {
+        throw new Error("Worker submission gate requires a parent session file for this leg's state.jsonl");
+    }
+    return runDirectoryOfSessionFile(file);
+}
+/**
+ * Interpret gate facts from this leg's control-plane state rows.
+ * File IO / decoder fail-closed is sole-owned by readStateControlRowsSync;
+ * illegal gate payloads still refuse here — never wash into re-arm (#1178 C1/C4).
+ */
+function readGateState(runDirectory, invocationScopeId) {
+    const rows = readStateControlRowsSync(runDirectory);
+    let baseline;
+    let reminded = false;
+    let prefixReminded = false;
+    let unfinishedReasonBounces = 0;
+    for (const row of rows) {
+        const kind = row.kind;
+        const payload = row.payload;
+        if (kind === WORKER_COMMIT_BASELINE_ENTRY_TYPE) {
+            // Illegal payload keeps failure identity — never wash into older/absent baseline.
+            if (!isRecord(payload) || !(payload.head === null || typeof payload.head === "string")) {
+                throw new Error(`${RUN_STATE_FILE} ${WORKER_COMMIT_BASELINE_ENTRY_TYPE} payload is invalid: ${runDirectory}`);
+            }
+            baseline = payload.head;
+        }
+        else if (kind === WORKER_COMMIT_REMINDER_BOUNCE_ENTRY_TYPE) {
+            reminded = true;
+        }
+        else if (kind === WORKER_PREFIX_REMINDER_BOUNCE_ENTRY_TYPE) {
+            prefixReminded = true;
+        }
+        else if (kind === WORKER_UNFINISHED_REASON_BOUNCE_ENTRY_TYPE) {
+            if (!isRecord(payload)) {
+                throw new Error(`${RUN_STATE_FILE} ${WORKER_UNFINISHED_REASON_BOUNCE_ENTRY_TYPE} payload is invalid: ${runDirectory}`);
+            }
+            if (invocationScopeId !== undefined && payload.invocationScopeId === invocationScopeId) {
+                unfinishedReasonBounces += 1;
+            }
+        }
+    }
+    return { baseline, reminded, prefixReminded, unfinishedReasonBounces };
+}
+function appendGateState(runDirectory, kind, payload) {
+    reportRunRecord(runDirectory, kind, payload, GATE_SOURCE);
+}
+function isAncestor(cwd, ancestor, descendant) {
+    try {
+        git(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]);
+        return true;
+    }
+    catch (error) {
+        if (statusOf(error) === 1)
+            return false;
+        throw error;
+    }
+}
+/**
+ * Reliable window (ADR 0070). null = unreliable tip-SHA baseline; [] = empty.
+ * Structured git-log fields only — never parse a shell command string.
+ */
+function reliableWindow(cwd, baseline, head) {
+    if (baseline !== null && !isAncestor(cwd, baseline, head))
+        return null;
+    const range = baseline === null ? head : `${baseline}..${head}`;
+    const raw = git(cwd, ["log", "--format=%P%x1e%s", range]);
+    if (raw.length === 0)
+        return [];
+    return raw.split("\n").flatMap((line) => {
+        const sep = line.indexOf("\x1e");
+        if (sep < 0)
+            return [];
+        return [{
+                subject: line.slice(sep + 1),
+                merge: line.slice(0, sep).trim().includes(" "),
+            }];
+    });
+}
+export function createWorkerSubmissionGate(options = {}) {
+    let baseline;
+    let root;
+    let reminded = false;
+    let prefixReminded = false;
+    let unfinishedReasonBounces = 0;
+    let invocationScopeId;
+    /** Live parent — mid-turn report-ticket renames the run leaf and updates setSessionFile. */
+    let parentRef;
+    // #1132: one configured number, resolved once at gate construction.
+    const unfinishedReasonBounceLimit = deliveryLimitFromConfig(options.unfinishedReasonBounceLimit);
+    const head = (cwd) => {
+        try {
+            return git(cwd, ["rev-parse", "HEAD"]);
+        }
+        catch {
+            git(cwd, ["rev-parse", "--git-dir"]); // surface real git failures
+            return null;
+        }
+    };
+    /** Current leg directory from the live parent session file. */
+    const liveDir = () => {
+        if (parentRef === undefined) {
+            throw new Error("Worker submission gate is not armed");
+        }
+        return liveRunDirectory(parentRef);
+    };
+    return {
+        arm(cwd, parent, scope) {
+            invocationScopeId = scope;
+            uninstallPackageWorkerHooks(cwd);
+            root = cwd;
+            parentRef = parent;
+            const runDirectory = liveRunDirectory(parent);
+            const prior = readGateState(runDirectory, invocationScopeId);
+            unfinishedReasonBounces = prior.unfinishedReasonBounces;
+            if (prior.baseline !== undefined) {
+                baseline = prior.baseline;
+                reminded = prior.reminded;
+                prefixReminded = prior.prefixReminded;
+                return;
+            }
+            baseline = head(cwd);
+            reminded = false;
+            prefixReminded = false;
+            appendGateState(runDirectory, WORKER_COMMIT_BASELINE_ENTRY_TYPE, {
+                version: 1,
+                head: baseline,
+            });
+        },
+        assertAcceptable(status, details) {
+            if (status === "unfinished" && !unfinishedReasonPresent(details)) {
+                if (unfinishedReasonBounces < unfinishedReasonBounceLimit) {
+                    if (parentRef !== undefined) {
+                        appendGateState(liveDir(), WORKER_UNFINISHED_REASON_BOUNCE_ENTRY_TYPE, {
+                            version: 1,
+                            invocationScopeId,
+                        });
+                    }
+                    unfinishedReasonBounces += 1;
+                    throw new WorkerUnfinishedReasonReminderError();
+                }
+            }
+            if (baseline === undefined || root === undefined || !WORKER_DONE_STATUSES.has(status))
+                return;
+            const now = head(root);
+            const headMoved = now !== null && (baseline === null || now !== baseline);
+            // Gate ① — forgetfulness reminder (ADR 0066; behavior unchanged).
+            if (!headMoved && !reminded) {
+                reminded = true;
+                appendGateState(liveDir(), WORKER_COMMIT_REMINDER_BOUNCE_ENTRY_TYPE, { version: 1 });
+                throw new WorkerCommitReminderError();
+            }
+            reminded = true;
+            // Gate ② — open platform-prefix soft reminder (ADR 0070).
+            if (prefixReminded || now === null)
+                return;
+            const window = reliableWindow(root, baseline, now);
+            if (window === null ||
+                window.length === 0 ||
+                !window.some((c) => !c.merge && !PLATFORM_PREFIX.test(c.subject))) {
+                return;
+            }
+            prefixReminded = true;
+            appendGateState(liveDir(), WORKER_PREFIX_REMINDER_BOUNCE_ENTRY_TYPE, { version: 1 });
+            throw new WorkerPrefixReminderError();
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.5797",
+  "version": "0.1.5820",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/resources/engine-dispatch.md

@@ -45,9 +45,9 @@ themselves. Stuffing large bodies into argv/prompt is the verified cause of
 
 ## Failure handling
 
-Once an engine is selected, invoking that engine CLI is mandatory: you MUST
-actually run it. On any spawn, auth, quota, model-id, stream-stall,
-connection-drop, or other engine-process failure, return the typed failure and
-STOP — the run fails. In-seat labor after an engine-process failure is
-FORBIDDEN, and so is skipping the engine CLI to work in-seat. Zero invocations
-is a violation, not a fallback. Do not silently swap to another engine id.
+Prefer outsourcing labor to the selected engine rather than doing the work
+in-seat (尽量外包，别自己干). On spawn, auth, quota, model-id, stream-stall,
+connection-drop, or other engine-process failure, the real failure and any
+process result come back to this same session; decide next steps here (retry,
+report, or submit through the existing path). Do not silently swap to another
+engine id.

package/resources/engines/agy.md

@@ -35,6 +35,6 @@ agy --sandbox --dangerously-skip-permissions --print 'YOUR_LABOR_PROMPT' --log-f
 ```
 
 When the dispatch order names a model, pass it verbatim via `--model`; an
-unknown model id is an engine-process failure (typed failure, stop — per
+unknown model id is an engine-process failure (returned to this seat — per
 `../engine-dispatch.md`). Never copy a model id from this note or from a
 previous run — ids here would go stale.

package/src/compliance-transport.ts

@@ -141,12 +141,16 @@ async function usageFromSummonedSession(summoned: PublicSummonResult): Promise<U
 async function projectAuditorTerminal(summoned: PublicSummonResult): Promise<ComplianceDecision> {
   const outcome = summoned.terminal?.roleOutcome;
   if (outcome === undefined) {
+    // #1214 A5: officer process failure without a terminal stays transport_failure
+    // on the compliance decision — do not throw and kill the audited seat call.
     const detail = summoned.stderr?.trim();
-    throw new Error(
-      detail && detail.length > 0
+    return {
+      status: "transport_failure",
+      diagnostic: detail && detail.length > 0
         ? `Auditor public summon produced no terminal (exit ${summoned.exitCode}: ${detail})`
         : `Auditor public summon produced no terminal (exit ${summoned.exitCode})`,
-    );
+      ...(summoned.terminal === undefined ? {} : { terminal: summoned.terminal }),
+    };
   }
   const usage = await usageFromSummonedSession(summoned);
   if (outcome.kind === "no_receipt") {