@astrosheep/keiyaku 1.0.0 → 1.0.2

package/build/core/execution-pact.js

@@ -0,0 +1,141 @@
+import * as path from "node:path";
+import { ProjectionStateError } from "./atomic-publish.js";
+import { parseExecutionBinding as parseCanonicalExecutionBinding, parseExecutionCoordinates, } from "./execution-coordinate.js";
+const TOP_LEVEL_FIELDS = [
+    "version",
+    "pid",
+    "akuma",
+    "provider",
+    "authority",
+    "binding",
+    "mintedAt",
+    "workspaceRoot",
+];
+const TOP_LEVEL_OPTIONAL_FIELDS = ["effectivePolicy"];
+const PACT_FIELD_NAMES = TOP_LEVEL_FIELDS.filter((field) => field !== "authority");
+function pactError(pactPath, field, reason) {
+    return new ProjectionStateError(`invalid projection pact at ${pactPath}: field '${field}' ${reason}`);
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function assertExactFields(value, required, optional, pactPath, fieldPrefix) {
+    for (const field of required) {
+        if (!(field in value)) {
+            throw pactError(pactPath, fieldPrefix ? `${fieldPrefix}.${field}` : field, "is missing");
+        }
+    }
+    const allowed = new Set([...required, ...optional]);
+    const unknown = Object.keys(value).filter((field) => !allowed.has(field)).sort()[0];
+    if (unknown !== undefined) {
+        throw pactError(pactPath, fieldPrefix ? `${fieldPrefix}.${unknown}` : unknown, "is unknown");
+    }
+}
+function assertNonBlankString(value, pactPath, field) {
+    if (typeof value !== "string" || value.trim() === "") {
+        throw pactError(pactPath, field, "must be a non-blank string");
+    }
+}
+/** Parse the pre-publication authority choice without inventing a durable identity. */
+export function parseExecutionAuthoritySelection(value, pactPath = "projection identity", expectedKind) {
+    if (!isRecord(value))
+        throw pactError(pactPath, "authority", "must be an object");
+    assertExactFields(value, ["kind"], [], pactPath, "authority");
+    if (value.kind !== "repository" && value.kind !== "user") {
+        throw pactError(pactPath, "authority.kind", "must be 'repository' or 'user'");
+    }
+    if (expectedKind !== undefined && value.kind !== expectedKind) {
+        throw pactError(pactPath, "authority.kind", `must be '${expectedKind}' for this projection mint`);
+    }
+    return { kind: value.kind };
+}
+/** Parse and validate an execution binding without inventing authority identity. */
+export function parseExecutionBinding(value, pactPath = "projection identity") {
+    return parseCanonicalExecutionBinding(value, (field, reason) => pactError(pactPath, field, reason));
+}
+export function assertExecutionPactCoordinates(authorityValue, bindingValue, pactPath = "projection identity") {
+    return parseExecutionCoordinates(authorityValue, bindingValue, (field, reason) => pactError(pactPath, field, reason));
+}
+function parseEffectivePolicy(value, pactPath) {
+    if (!isRecord(value))
+        throw pactError(pactPath, "effectivePolicy", "must be an object");
+    assertExactFields(value, [], ["access", "network", "webSearch"], pactPath, "effectivePolicy");
+    if (value.access !== undefined && value.access !== "read" && value.access !== "write" && value.access !== "auto") {
+        throw pactError(pactPath, "effectivePolicy.access", "must be 'read', 'write', or 'auto'");
+    }
+    if (value.network !== undefined && value.network !== "disabled" && value.network !== "enabled") {
+        throw pactError(pactPath, "effectivePolicy.network", "must be 'disabled' or 'enabled'");
+    }
+    if (value.webSearch !== undefined && !["disabled", "cached", "live"].includes(String(value.webSearch))) {
+        throw pactError(pactPath, "effectivePolicy.webSearch", "must be 'disabled', 'cached', or 'live'");
+    }
+    return value;
+}
+function parseExecutionPactFieldsRecord(value, pactPath) {
+    if (value.version !== 1)
+        throw pactError(pactPath, "version", "must equal 1");
+    if (!Number.isInteger(value.pid) || value.pid < 0) {
+        throw pactError(pactPath, "pid", "must be a non-negative integer");
+    }
+    assertNonBlankString(value.akuma, pactPath, "akuma");
+    assertNonBlankString(value.provider, pactPath, "provider");
+    assertNonBlankString(value.mintedAt, pactPath, "mintedAt");
+    const mintedAtMs = Date.parse(value.mintedAt);
+    if (!Number.isFinite(mintedAtMs) || new Date(mintedAtMs).toISOString() !== value.mintedAt) {
+        throw pactError(pactPath, "mintedAt", "must be an ISO-8601 timestamp");
+    }
+    assertNonBlankString(value.workspaceRoot, pactPath, "workspaceRoot");
+    if (!path.isAbsolute(value.workspaceRoot)) {
+        throw pactError(pactPath, "workspaceRoot", "must be an absolute path");
+    }
+    const binding = parseExecutionBinding(value.binding, pactPath);
+    return {
+        version: 1,
+        pid: value.pid,
+        akuma: value.akuma,
+        provider: value.provider,
+        binding,
+        mintedAt: value.mintedAt,
+        workspaceRoot: value.workspaceRoot,
+        ...(value.effectivePolicy !== undefined
+            ? { effectivePolicy: parseEffectivePolicy(value.effectivePolicy, pactPath) }
+            : {}),
+    };
+}
+/** Validate every pact field that exists before a repository identity is minted. */
+export function parseExecutionPactFields(value, pactPath = "projection identity") {
+    if (!isRecord(value))
+        throw pactError(pactPath, "$", "must be an object");
+    assertExactFields(value, PACT_FIELD_NAMES, TOP_LEVEL_OPTIONAL_FIELDS, pactPath, "");
+    return parseExecutionPactFieldsRecord(value, pactPath);
+}
+export function parseExecutionPact(value, pactPath = "projection identity") {
+    if (!isRecord(value))
+        throw pactError(pactPath, "$", "must be an object");
+    assertExactFields(value, TOP_LEVEL_FIELDS, TOP_LEVEL_OPTIONAL_FIELDS, pactPath, "");
+    const fields = parseExecutionPactFieldsRecord(value, pactPath);
+    const { authority, binding } = assertExecutionPactCoordinates(value.authority, fields.binding, pactPath);
+    return {
+        version: fields.version,
+        pid: fields.pid,
+        akuma: fields.akuma,
+        provider: fields.provider,
+        authority,
+        binding,
+        mintedAt: fields.mintedAt,
+        workspaceRoot: fields.workspaceRoot,
+        ...(fields.effectivePolicy !== undefined ? { effectivePolicy: fields.effectivePolicy } : {}),
+    };
+}
+export function parseExecutionPactJson(raw, pactPath = "projection identity") {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new ProjectionStateError(`invalid projection pact at ${pactPath}: field '$' contains malformed JSON`, {
+            cause: error,
+        });
+    }
+    return parseExecutionPact(value, pactPath);
+}

package/build/core/forfeit.js

@@ -1,6 +1,5 @@
 import { FlowError } from "../flow-error.js";
 import { activeLedgerRef, appendWithRetry, readLedger } from "./ledger.js";
-import { dequeueContract } from "./queue.js";
 import { releaseScope } from "./registry.js";
 import { deriveContractState, isTerminalState } from "./status.js";
 import { cleanupContractWorkspace, stableRepoRoot } from "./worktree-path.js";
@@ -15,7 +14,7 @@ export async function forfeitContract(input) {
     if (ledger) {
         const state = deriveContractState(ledger.entries);
         if (state.state === "forfeited") {
-            await dequeueContract(input.cwd, { contractId: input.contractId, actor: input.actor, at });
+            // Already-forfeited retry only performs idempotent cleanup.
             const cleanup = await cleanupForfeit(input.cwd, input.contractId, input.actor, at);
             return { contractId: input.contractId, cleanup };
         }
@@ -44,7 +43,7 @@ export async function forfeitContract(input) {
     });
     if (!result.ok)
         throw new FlowError("INTERNAL_STATE", `failed to forfeit ${input.contractId}: ${result.reason}`);
-    await dequeueContract(input.cwd, { contractId: input.contractId, actor: input.actor, at });
+    // Forfeit entry naturally removes membership; no dequeue record.
     const cleanup = await cleanupForfeit(input.cwd, input.contractId, input.actor, at);
     return { contractId: input.contractId, cleanup };
 }

package/build/core/hints.js

@@ -4,12 +4,12 @@ import { renderTemplate } from "../flow-error.js";
 const GUIDANCE_BRANCH_LIST_LIMIT = 3;
 const HELP_BODY_TEMPLATE = [
     "## Workflow",
-    "`bind -> arc -> [summon/ask | amend | delivery work]* -> arc | renew | petition`",
+    "`bind -> arc -> [call | amend | delivery work]* -> arc | renew | petition`",
     "",
     `- **\${bind}**: Create the active contract ledger and workspace files from Markdown stdin. The worktree must be clean; call it once per Keiyaku.`,
     `- **\${arc}**: Record the delivery arc title, objective, and brief before work starts. It seals any open arc and does not run agents or mutate delivery code.`,
-    `- **\${summon}** / **ask**: Summon a ${ACTOR_IDENTITY} for bounded work. An open arc supplies scoped context; the caller still owns review, integration, and commits.`,
-    `- **akuma list / akuma show**: Inspect available ${ACTOR_IDENTITY_PLURAL} and their resolved provider/executable before choosing \`keiyaku summon NAME\`.`,
+    `- **\${call}**: Call a ${ACTOR_IDENTITY} for bounded work. An open arc supplies scoped context; the caller still owns review, integration, and commits.`,
+    `- **akuma list / akuma show**: Inspect available ${ACTOR_IDENTITY_PLURAL} and their resolved provider/executable before choosing \`keiyaku call NAME\`.`,
     "- **delivery commits**: Commit the actual code or documentation changes in git before sealing them.",
     `- **\${renew}**: Capture receipts, update delivery onto the default branch, seal the open arc, and record the new base.`,
     `- **\${amend}**: Update the Keiyaku when scope, rules, criteria, or intent changed.`,
@@ -19,12 +19,12 @@ const HELP_BODY_TEMPLATE = [
     "- **status**: Render the Kanshi board: 現世 head, arc sparkline, age, drift ▲N, and queue stall.",
     "",
     "## Command Boundaries",
-    `- \`\${arc}\` and \`\${renew}\` are ledger operations; they do not summon agents and do not edit delivery code.`,
-    `- \`\${summon}\` and \`ask\` can run outside a Keiyaku, but an open arc gives the ${ACTOR_IDENTITY} better context.`,
-    `- \`\${summon}\` starts a new session. Use \`keiyaku resume RESPONSE_PATH\` to continue a prior response artifact.`,
+    `- \`\${arc}\` and \`\${renew}\` are ledger operations; they do not call agents and do not edit delivery code.`,
+    `- \`\${call}\` can run outside a Keiyaku, but an open arc gives the ${ACTOR_IDENTITY} better context.`,
+    `- \`\${call}\` starts a new session. Use \`keiyaku revive ARTIFACT_ID\` to continue a prior response artifact.`,
     "- `akuma list` and `akuma show <name>` are read-only inspection commands; they do not start a helper.",
-    "- `keiyaku resume` restores the agent from the response artifact; `--incognito` summons cannot be resumed later.",
-    "- Premature `petition` requests are rejected; continue with `${arc}`, `${summon}`, or `${renew}` until the work is verified.",
+    "- `keiyaku revive` restores the agent from the response artifact; `--incognito` calls cannot be revived later.",
+    "- Premature `petition` requests are rejected; continue with `${arc}`, `${call}`, or `${renew}` until the work is verified.",
     "",
     "## Core Files (.keiyaku/)",
     "Detailed configuration and protocol nuances live here.",
@@ -56,13 +56,13 @@ const HELP_BODY_TEMPLATE = [
     "",
     "## Workflow Tactics",
     "- **Pause / Resume**: Use `status` to find active contracts and `@<id-prefix>` to address them from any terminal.",
-    "- **Delegation Markers**: Place `KEIYAKU_TODO(<instruction>)` comments when you want ${summon} or ${bind} to pick up scoped follow-on work.",
+    "- **Delegation Markers**: Place `KEIYAKU_TODO(<instruction>)` comments when you want ${call} or ${bind} to pick up scoped follow-on work.",
 ];
 const ARCHITECT_TOOL_NAMES = {
     bind: TOOL_NAMES.bind,
     arc: TOOL_NAMES.arc,
     renew: TOOL_NAMES.renew,
-    summon: TOOL_NAMES.summon,
+    call: TOOL_NAMES.call,
     amend: TOOL_NAMES.amend,
     close: TOOL_NAMES.close,
 };

package/build/core/ids.js

@@ -1,6 +1,12 @@
 import { createGit, wrapGitError } from "../git/core.js";
 const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 const ULID_RE = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+/** Canonical commission identity: slugified lowercase hyphen segments + `.` + Crockford ULID. */
+export const COMMISSION_ID_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[0-9A-HJKMNP-TV-Z]{26}$/;
+/** Minted opaque repository identity: `repo_` + ULID. */
+export function isCommissionId(value) {
+    return COMMISSION_ID_RE.test(value);
+}
 export class ContractIdError extends Error {
     code = "INVALID_CONTRACT_ID";
     constructor(message, options) {

package/build/core/ledger.js

@@ -2,8 +2,9 @@ import { createGit, errorContainsAnyPattern, MISSING_HEAD_PATTERNS, wrapGitError
 import { formatLedgerEntryCommitMessage, parseLedgerEntryCommitMessage, } from "./entry.js";
 const EMPTY_TREE_HASH = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 const MISSING_REF_SENTINEL = "0".repeat(40);
+export const ACTIVE_LEDGER_REF_PREFIX = "refs/keiyaku/active/";
 export function activeLedgerRef(contractId) {
-    return `refs/keiyaku/active/${contractId}`;
+    return `${ACTIVE_LEDGER_REF_PREFIX}${contractId}`;
 }
 async function resolveRefHead(cwd, ref) {
     const git = createGit(cwd);
@@ -115,3 +116,17 @@ export async function readLedger(cwd, contractId) {
         return null;
     return { contractId, ...(await readLedgerRef(cwd, ref, head)) };
 }
+export async function listContractIds(cwd) {
+    const git = createGit(cwd);
+    try {
+        const output = await git.raw(["for-each-ref", "--format=%(refname)", ACTIVE_LEDGER_REF_PREFIX]);
+        return output
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter((line) => line.startsWith(ACTIVE_LEDGER_REF_PREFIX))
+            .map((ref) => ref.slice(ACTIVE_LEDGER_REF_PREFIX.length));
+    }
+    catch (error) {
+        throw wrapGitError(`for-each-ref ${ACTIVE_LEDGER_REF_PREFIX}`, error, cwd);
+    }
+}

package/build/core/petition-claim-gates.js

@@ -1,8 +1,8 @@
 import { spawn } from "node:child_process";
 import { getConfig } from "../config/env.js";
 import { assertSettingsKnobUsable, loadKeiyakuSettings, resolveReviewerAgentName, } from "../config/settings.js";
-import { loadAkumaCatalog } from "../config/akuma-loader.js";
-import { formatAvailableAgentNames } from "../agents/selector.js";
+import { loadAkumaCatalogV2 } from "../config/akuma-loader_v2.js";
+import { formatAvailableAgentNamesV2 } from "../agents/selector_v2.js";
 import { getDiffStats } from "../git/diff/preview.js";
 import { readDiff } from "../git/diff/read.js";
 import { getCurrentBranch } from "../git/branches.js";
@@ -11,7 +11,7 @@ import { DIFF_PREVIEW_TEXT_MAX_CHARS } from "../keiyaku.js";
 import { FlowError } from "../flow-error.js";
 import { persistResponseHistory } from "./transcripts.js";
 import { logInfo } from "../telemetry/logger.js";
-import { execSubagent } from "./summon.js";
+import { execSubagent } from "./call.js";
 import { readContractLog } from "./log.js";
 import { buildVerificationFailureHints } from "./hints.js";
 const CLAIM_VERIFICATION_OUTPUT_MAX_CHARS = 1200;
@@ -159,7 +159,7 @@ export function createAgentReviewGate() {
                 return REVIEW_SKIPPED_RESULT;
             }
             const loaded = await loadKeiyakuSettings(cwd);
-            // Always touch legacy profile authority + reviewer. Touch default only when reviewer is absent
+            // Always touch agents catalog disease + reviewer. Touch default only when reviewer is absent
             // and resolution would fall back through resolveReviewerAgentName → default.
             assertSettingsKnobUsable(loaded, "agents");
             assertSettingsKnobUsable(loaded, "reviewer");
@@ -168,10 +168,10 @@ export function createAgentReviewGate() {
             }
             const settings = loaded.knobs;
             const reviewerAgentName = resolveReviewerAgentName(settings);
-            const catalog = await loadAkumaCatalog(cwd);
-            const availableNames = Object.keys(catalog.definitions);
-            if (catalog.definitions[reviewerAgentName] === undefined) {
-                throw new FlowError("UNKNOWN_SUBAGENT", `Unknown agent '${reviewerAgentName}'. Expected one of: ${formatAvailableAgentNames(availableNames)}`);
+            const catalog = await loadAkumaCatalogV2(cwd);
+            const availableNames = Object.keys(catalog.selected);
+            if (catalog.selected[reviewerAgentName] === undefined) {
+                throw new FlowError("UNKNOWN_SUBAGENT", `Unknown agent '${reviewerAgentName}'. Expected one of: ${formatAvailableAgentNamesV2(availableNames)}`);
             }
             const [contractLog, diffStat, fullDiff, currentBranch, headRef] = await Promise.all([
                 readContractLog({ cwd, contractId }),
@@ -197,26 +197,28 @@ export function createAgentReviewGate() {
             const selectedReviewerAgentName = reviewerAgentName;
             const subagentResult = await execSubagent(selectedReviewerAgentName, prompt, cwd, {
                 signal: input.signal,
+                authority: { kind: "repository" },
+                binding: { kind: "commission", commissionId: contractId },
             });
             const reviewHeadBeforeWrite = await getLatestCommitHash(cwd);
             const raw = subagentResult.finalMessage.trim();
             const passed = raw.startsWith(REVIEW_PASS_TOKEN);
             const observations = passed ? raw.slice(REVIEW_PASS_TOKEN.length).trim() || undefined : undefined;
-            const responsePath = await persistResponseHistory({
+            const persisted = await persistResponseHistory({
                 cwd,
                 tool: "review",
+                provenance: { authority: { kind: "repository" }, binding: { kind: "commission", commissionId: contractId }, evidenceCwd: cwd },
                 title: String(reviewNumber),
                 prompt,
                 response: subagentResult.finalMessage,
                 session: subagentResult.session,
                 subagentName: selectedReviewerAgentName,
-                branch: currentBranch,
-                commit: headRef,
+                launchSnapshot: subagentResult.launchSnapshot,
             });
             const review = {
                 review: reviewNumber,
                 result: passed ? "passed" : "rejected",
-                historyPath: responsePath,
+                historyPath: persisted.responsePath,
                 findings: passed ? observations : raw || REVIEW_RESPONSE_FALLBACK,
             };
             if (review.result === "passed") {

package/build/core/petition-claim.js

@@ -82,6 +82,7 @@ export async function claimKeiyaku(input, context, dependencies) {
         nowMs: Date.now(),
         intent: "claim",
         oath,
+        waivePaths: input.waivePaths,
     });
     const log = await readContractLog({ cwd, contractId });
     const verdict = await verdictContract({

package/build/core/petition-run.js

@@ -2,7 +2,7 @@ import { assertSettingsKnobUsable, loadKeiyakuSettings } from "../config/setting
 import { FlowError } from "../flow-error.js";
 import { readCurrentContractContext } from "./context.js";
 import { readLedger } from "./ledger.js";
-import { resolveDefaultBranch } from "./status.js";
+import { commissionTarget } from "./status.js";
 import { getCurrentBranch, isGitRepo } from "../git/branches.js";
 import { claimKeiyaku } from "./petition-claim.js";
 import { forfeitKeiyaku } from "./petition-forfeit.js";
@@ -41,10 +41,14 @@ async function loadCloseContext(cwd, requestedContractId) {
         if (!ledger) {
             throw new FlowError("INTERNAL_STATE", `contract ${requestedContractId} not found or not active`);
         }
+        const target = commissionTarget(ledger.entries);
+        if (!target) {
+            throw new FlowError("INTERNAL_STATE", `contract ${requestedContractId} active ledger is missing commission target`);
+        }
         return {
             cwd,
             keiyakuBranch: `keiyaku/${requestedContractId}`,
-            baseBranch: (await resolveDefaultBranch(cwd))?.branch ?? await getCurrentBranch(cwd),
+            baseBranch: target.branch,
             contractId: requestedContractId,
         };
     }

package/build/core/petition.js

@@ -1,18 +1,32 @@
 import { FlowError } from "../flow-error.js";
+import { createGit, errorContainsAnyPattern, MISSING_HEAD_PATTERNS, wrapGitError } from "../git/core.js";
 import { parseCommandMarkdown } from "./command-io.js";
 import { activeLedgerRef, appendWithRetry, readLedger } from "./ledger.js";
-import { enqueueContract, queuePosition } from "./queue.js";
+import { allocateSettlementSeat, queueMembership, readQueueReadModel } from "./queue_v2.js";
 import { findOpenArc, receiptsAfterFence, sealOpenArc } from "./seal.js";
-import { deriveContractState, latestBase, resolveDefaultBranch } from "./status.js";
+import { commissionTarget, deriveContractState, latestBase } from "./status.js";
 import { findContractWorktreePath } from "./worktree-path.js";
-async function settledQueuePosition(cwd, contractId, writtenPosition) {
-    return writtenPosition || (await queuePosition(cwd, contractId)) || 0;
+async function resolveCommit(cwd, ref) {
+    const git = createGit(cwd);
+    try {
+        return (await git.raw(["rev-parse", "--verify", `${ref}^{commit}`])).trim();
+    }
+    catch (error) {
+        if (errorContainsAnyPattern(error, MISSING_HEAD_PATTERNS))
+            return null;
+        throw wrapGitError(`rev-parse ${ref}`, error, cwd);
+    }
 }
-async function assertFresh(cwd, contractId, base) {
-    const target = await resolveDefaultBranch(cwd);
-    if (!target)
-        return;
-    if (base !== target.head) {
+async function assertFresh(cwd, contractId, entries, base) {
+    const target = commissionTarget(entries);
+    if (!target) {
+        throw new FlowError("INTERNAL_STATE", `contract ${contractId} missing commission target`);
+    }
+    const head = await resolveCommit(cwd, target.ref);
+    if (!head) {
+        throw new FlowError("INTERNAL_STATE", `contract ${contractId} commission target ${target.ref} does not resolve`);
+    }
+    if (base !== head) {
         throw new FlowError("INTERNAL_STATE", `contract ${contractId} must renew onto ${target.branch} before petition`, { hints: [`keiyaku @${contractId} renew — renews delivery before petition`] });
     }
 }
@@ -24,20 +38,15 @@ function assertPetitionable(contractId, entries) {
 }
 export async function petitionContract(input) {
     const at = new Date(input.nowMs).toISOString();
-    let ledger = await readLedger(input.cwd, input.contractId);
+    const ledger = await readLedger(input.cwd, input.contractId);
     if (!ledger) {
         throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} not found or not active`);
     }
-    const existingState = deriveContractState(ledger.entries);
-    if (existingState.state === "petitioned") {
-        const queued = await enqueueContract(input.cwd, { contractId: input.contractId, actor: input.actor, at });
-        return { contractId: input.contractId, position: await settledQueuePosition(input.cwd, input.contractId, queued.position) };
-    }
     const deliveryCwd = (await findContractWorktreePath(input.cwd, input.contractId)) ?? input.cwd;
     const base = latestBase(ledger.entries);
     if (!base)
         throw new FlowError("INTERNAL_STATE", "ledger must contain bind entry");
-    await assertFresh(input.cwd, input.contractId, base);
+    await assertFresh(input.cwd, input.contractId, ledger.entries, base);
     if (!findOpenArc(ledger.entries)) {
         const loose = await receiptsAfterFence(deliveryCwd, ledger.entries);
         if (loose.length > 0) {
@@ -51,6 +60,16 @@ export async function petitionContract(input) {
         contractId: input.contractId,
         sealedBy: "petition",
         nowMs: input.nowMs,
+        waivePaths: input.intent === "claim" ? input.waivePaths : undefined,
+    });
+    const target = commissionTarget(ledger.entries);
+    if (!target) {
+        throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} missing commission target`);
+    }
+    const allocated = await allocateSettlementSeat(input.cwd, {
+        target: target.ref,
+        actor: input.actor,
+        at,
     });
     const ref = activeLedgerRef(input.contractId);
     const result = await appendWithRetry(input.cwd, ref, (_head, entries) => {
@@ -59,8 +78,17 @@ export async function petitionContract(input) {
             return null;
         assertPetitionable(input.contractId, entries);
         const data = input.intent === "claim"
-            ? { intent: "claim", oath: input.oath }
-            : { intent: "forfeit" };
+            ? {
+                intent: "claim",
+                oath: input.oath,
+                target: target.ref,
+                seat: allocated.seat,
+            }
+            : {
+                intent: "forfeit",
+                target: target.ref,
+                seat: allocated.seat,
+            };
         const entry = {
             v: 1,
             kind: "petition",
@@ -71,13 +99,26 @@ export async function petitionContract(input) {
         };
         return entry;
     });
-    if (!result.ok && result.reason !== "aborted") {
+    if (!result.ok) {
+        // Race/abort: allocated seat remains a legal hole; do not report success.
+        if (result.reason === "aborted") {
+            const current = await readLedger(input.cwd, input.contractId);
+            if (current) {
+                assertPetitionable(input.contractId, current.entries);
+            }
+            throw new FlowError("INTERNAL_STATE", `failed to petition contract ${input.contractId}: aborted`);
+        }
         throw new FlowError("INTERNAL_STATE", `failed to petition contract ${input.contractId}: ${result.reason}`);
     }
-    const queued = await enqueueContract(input.cwd, { contractId: input.contractId, actor: input.actor, at });
+    const model = await readQueueReadModel(input.cwd);
+    const membership = queueMembership(model, input.contractId);
+    const position = membership?.position ?? 0;
+    if (position <= 0) {
+        throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} missing target-local queue position after petition`);
+    }
     return {
         contractId: input.contractId,
-        position: await settledQueuePosition(input.cwd, input.contractId, queued.position),
+        position,
         ...(sealed ? { sealed } : {}),
     };
 }
@@ -92,5 +133,6 @@ export function buildPetitionClaimInput(input) {
         plea: `Settle contract ${input.contractId} through the petition pipeline.`,
         oath,
         signal: input.signal,
+        waivePaths: input.waivePaths,
     };
 }

package/build/core/places.js

@@ -5,7 +5,6 @@ export const CONTRACT_PLACES = Object.freeze([
     "neverland",
     "mordor",
     "shire",
-    "rivendell",
     "olympus",
     "valhalla",
     "asgard",
@@ -18,7 +17,6 @@ export const CONTRACT_PLACES = Object.freeze([
     "namek",
     "laputa",
     "tatooine",
-    "pandora",
     "stomach",
     "eyeball",
     "braincell",
@@ -27,20 +25,10 @@ export const CONTRACT_PLACES = Object.freeze([
     "armpit",
     "chineseroom",
     "catbox",
-    "platocave",
-    "hilberthotel",
-    "panopticon",
-    "theseus",
     "babel",
     "teapot",
     "blackhole",
     "wormhole",
-    "oddpoint",
-    "eventhorizon",
-    "kleinbottle",
-    "mobius",
-    "tesseract",
-    "nullisland",
     "devnull",
     "localhost",
     "recyclebin",
@@ -77,6 +65,111 @@ export const CONTRACT_PLACES = Object.freeze([
     "dumpster",
     "blanketfort",
     "kotatsu",
-    "toire",
     "fishbowl",
+    "pokeball",
+    "pineapple",
+    "titanic",
+    "disneyland",
+    "ikea",
+    "costco",
+    "warppipe",
+    "tetris",
+    "minecraft",
+    "ufo",
+    "catbus",
+    "timemachine",
+    "moonbox",
+    "huaguoshan",
+    "pansidong",
+    "bellybutton",
+    "sock",
+    "spam",
+    "downloads",
+    "toilet",
+    "blender",
+    "toaster",
+    "litterbox",
+    "kiddiepool",
+    "beanbag",
+    "vacuum",
+    "elevator",
+    "glovebox",
+    "attic",
+    "cloud",
+    "wall",
+    "can",
+    "cup",
+    "wc",
+    "bean",
+    "bus",
+    "helicopter",
+    "commandroom",
+    "box",
+    "jar",
+    "pot",
+    "wok",
+    "bowl",
+    "bucket",
+    "drawer",
+    "sofa",
+    "fridge",
+    "microwave",
+    "well",
+    "ditch",
+    "puddle",
+    "tent",
+    "cave",
+    "shed",
+    "garage",
+    "basement",
+    "balcony",
+    "corner",
+    "pigpen",
+    "henhouse",
+    "excavator",
+    "tank",
+    "submarine",
+    "treehouse",
+    "igloo",
+    "phonebooth",
+    "mailbox",
+    "doormat",
+    "bathtub",
+    "wardrobe",
+    "quicksand",
+    "tarpit",
+    "haystack",
+    "manhole",
+    "chimney",
+    "dryer",
+    "fittingroom",
+    "lazysusan",
+    "revolvingdoor",
+    "minibar",
+    "casino",
+    "karaoke",
+    "pinball",
+    "funhouse",
+    "burrito",
+    "dumpling",
+    "hotpot",
+    "bento",
+    "teabag",
+    "fortunecookie",
+    "airlock",
+    "escapepod",
+    "hammock",
+    "legroom",
+    "sidequest",
+    "lootbox",
+    "gutter",
+    "pawnshop",
+    "hermitcrab",
+    "couchgap",
+    "dumbwaiter",
+    "petridish",
+    "baggageclaim",
+    "morgue",
+    "ballpit",
+    "clawmachine",
 ]);