@caupulican/pi-adaptative 0.94.0 → 0.95.0

package/docs/settings.md

@@ -113,7 +113,7 @@ The agent is instructed to edit only that source checkout, preserve unrelated ch
 | `autonomy.mode` | string | `"off"` | Low-config autonomy preset: `"off"`, `"safe"`, `"balanced"`, or `"full"` |
 | `autonomy.maxStallTurns` | number | `20` | Maximum provider rounds in one foreground goal loop before Pi stops continuing |
 
-Use `/settings` → **Autonomy** to choose one preset and the foreground goal-loop round budget, or `/autonomy off|safe|balanced|full` to switch the preset while preserving the configured round budget. `full` is the standing-autonomy mode: it schedules post-turn reflection whenever concurrency allows and grants autonomous authority for high-confidence memory writes, user/project skill creation or patching, small user/project extension/tool improvements, autonomy/Auto Learn setting tuning, and edits under the authorized `selfModification.sourcePath` when validation and rollback evidence are recorded.
+Use `/settings` → **Autonomy** to choose one preset and the foreground goal-loop round budget, or `/autonomy off|safe|balanced|full` to switch the preset while preserving the configured round budget. Main-session reflection is enabled in every mode, including `off`; eligible turns queue a durable root-only cue for the orchestrator's next ordinary current-session provider turn. It does not create a separate or background model request, and increasing autonomy never disables learning. `full` additionally grants standing authority for broader user/project skill, extension/tool, autonomy-setting, and authorized self-modification work when validation and rollback evidence are recorded.
 
 Hard stops still require explicit foreground approval even in `full`: publishing, npm release, git push, tag creation, credential disclosure or provider-auth changes, destructive user-data deletion, network-exposed services, or authority expansion beyond this policy. An active user-plane `secret_store` grant is the narrow exception: model-blind activation and migration from named accessible sources require no duplicate confirmation. `/autonomy status` shows the active grant and the Auto Learn audit/log directory.
 
@@ -135,10 +135,10 @@ Hard stops still require explicit foreground approval even in `full`: publishing
 | `modelRouter.cheapModel` | string | - | Model pattern for read-only, research, explanation, and question turns |
 | `modelRouter.mediumModel` | string | - | Model pattern for scoped implementation/planning turns |
 | `modelRouter.expensiveModel` | string | - | Model pattern for high-impact, modify, implementation, and escalated tool-heavy turns |
-| `modelRouter.learningModel` | string | `"active"` | Model pattern for background reflection, learn, and skill-creator work; `"active"` uses the current session model |
+| `modelRouter.learningModel` | string | `"active"` | Model pattern for explicit/background Auto Learn, learn, and skill-creator work; automatic reflection uses the orchestrator's current session turn; `"active"` uses the current session model |
 | `failover.subscriptionHop` | boolean | `true` | Allow subscription/OAuth quota failures to switch once to an authenticated provider default; metered/API-key quota failures always halt for explicit user choice |
 
-Use `/settings` → **Model Router** to configure these fields globally or for the current project's `.pi/settings.json`. `/session` and `/usage` show the active router state, diagnostics, and per-tier fitness when the gate is enabled. Profile files can also include a `modelRouter` block so a situation can carry its own cheap, medium, expensive, and learning/reflection models together with its model, thinking level, soul, and resource filters.
+Use `/settings` → **Model Router** to configure these fields globally or for the current project's `.pi/settings.json`. `/session` and `/usage` show the active router state, diagnostics, and per-tier fitness when the gate is enabled. Profile files can also include a `modelRouter` block so a situation can carry its own cheap, medium, expensive, and learning model together with its model, thinking level, soul, and resource filters. Automatic reflection does not select a separate reflection model.
 
 Fitness applicability is intentionally split by autonomy level:
 
@@ -162,17 +162,17 @@ Fitness applicability is intentionally split by autonomy level:
 
 ### Worker Delegation
 
-Pi's native delegation runtime is a durable recursive agent tree. A profile is not required. A profile-free root agent starts from the foreground model and the maximum classified core worker surface the host can materialize: `read`, `grep`, `find`, `ls`, `write`, `edit`, `memory`, the platform shell, and `delegate`. Live service switches can revoke memory, writes, or delegation. Every descendant inherits its parent's immutable execution grant and the tree's remaining budget by default.
+Pi's native delegation runtime manages durable, persistent leaf workers. A profile is not required. A fresh worker inherits the foreground model, live thinking level, and every active classified tool the native lane can materialize. It receives machine-wide read/write/process/network authority by default while raw Pi auth, session, settings, and memory state remain denied. Workers never receive `delegate`, descendant spawning, reflection, or memory mutation.
 
-Whenever `delegate` is active, root and worker prompts use the same provider-neutral decision rule: delegate useful independent research, implementation, tests, or specialist review early; keep dependent or trivial work local. Reasoning level, provider identity, and model identity do not enable or suppress that policy; the model-capability profile may still narrow tools for very small context windows.
+Whenever `delegate` is active, the root prompt uses a provider-neutral decision rule: delegate useful independent research, implementation, tests, or specialist review early; keep dependent or trivial work local. Reasoning level, provider identity, and model identity do not enable or suppress that policy; the model-capability profile may still narrow tools for very small context windows.
 
-An agent may set `authority` on `delegate` to choose its child's role label, authenticated model, supported reasoning level, and classified tool names. Omitted fields inherit from the parent or selected preset. The model-facing start schema has no per-dispatch budget field: ordinary starts inherit the unbounded baseline, host settings, or an owner-authored profile ceiling. The host validates the request, resolves the concrete model and tools, intersects execution authority with the immutable parent grant and live global switches, then persists the exact result before the child starts. A descendant can specialize or narrow authority but cannot add an execution capability, tool, path, or budget that the parent did not hold. Profile selection also cannot add context: every child resource pointer must fully match an ancestral pointer (ID alone is insufficient), soul text must match exactly, and a verifier stays within its previously admitted ancestral verifier or worker boundary. Roles are descriptive routing and audit labels; the built-in compiler does not impose hidden role ceilings, though an embedding may supply an explicit host ceiling.
+For a fresh `delegate start`, the orchestrator may optionally set `model`, `thinkingLevel`, one `path`, and `toolNames`. Omitted fields inherit. `path` changes the worker's real working directory and narrows direct read/write authority to that workspace; omitting it keeps the parent working directory for process execution without narrowing machine scope. Tool overrides may only narrow the compatible inherited surface and an unavailable or root-only requested tool fails admission instead of being silently ignored. The host derives capabilities and paths, applies global kill switches and private-state denials, and persists the exact immutable grant before execution. Reusing an `agentId` keeps its admitted grant and transcript, so overrides are rejected on reuse.
 
-`workerDelegation.modelPins` optionally lets the owner fix the provider, model, and thinking level used by each fresh worker role. With no pins, delegation keeps the adaptive behavior above exactly. An applicable pin overrides model/thinking chosen by `authority` or a preset, while role, tools, resources, paths, and budgets still follow normal admission. This applies to fresh top-level workers, fresh nested workers, and mandatory verifiers. The admitted binding is persisted and reported by `delegate start`; queued work, retries, resumes, recovery, and later tasks on a reused `agentId` keep that immutable contract even if settings change.
+`workerDelegation.modelPins` optionally lets the owner fix the provider, model, and thinking level used by each fresh worker role. With no pins, delegation keeps the adaptive behavior above exactly. An applicable pin is a hard ceiling: a conflicting explicit `model` or `thinkingLevel` override fails closed with `worker_model_pin_conflict:<role>` instead of silently running a different model, while an omitted override uses the pin. Owner-authored preset bindings are still narrowed to the pin. Tools, resources, workspace, and budgets follow normal admission. This applies to fresh workers and mandatory verifiers. The admitted binding is persisted and reported by `delegate start`; queued work, retries, resumes, recovery, and later tasks on a reused `agentId` keep that immutable contract even if settings change.
 
 Pin precedence is deliberately different from ordinary deep-merged settings: global role, global default, trusted local role, trusted local default, then adaptive routing. A global default therefore wins over every project role. Within trusted local settings, the user-level directory overlay wins over the project file at the same role/default tier. Untrusted project settings are ignored. Every binding must contain an exact `provider`, `modelId`, and supported `thinkingLevel`. Malformed pin configuration blocks fresh worker admission with `worker_model_pins_invalid`; an unavailable applicable pin blocks with `worker_model_pin_unavailable:<role>`. Neither condition falls back to another model. Configure pins directly in JSON; `/settings` does not edit them.
 
-A `roles`-only configuration (no `default` in any scope) leaves every role not listed under `roles` entirely unpinned: a delegation using an unlisted role plus an explicit `authority.model` is not blocked, since there is no applicable pin to enforce, and it uses the caller-requested model exactly as ordinary adaptive routing would. This is expected, not an admission bug, but it is easy to configure by accident. The host surfaces it two ways so it stays observable: a settings diagnostic lists the unpinned roles whenever a `roles`-only policy compiles with no `default`, and a delegation that hits this gap (an active pin policy, no pin for the effective role, and an explicit requested model) reports `modelPinBypass: <role>` on its `delegate start` result. Add a `default` to close the gap for every role, or pin every role explicitly under `roles` if adaptive routing is never intended.
+A `roles`-only configuration (no `default` in any scope) leaves every role not listed under `roles` unpinned. This is valid but easy to configure by accident, so settings diagnostics list unpinned roles. Add a `default` to close the gap for every role, or pin every role explicitly under `roles` if adaptive routing is never intended.
 
 ```json
 {
@@ -207,36 +207,22 @@ For a new logical agent, `forkTurns` chooses immutable sanitized birth context:
   "action": "start",
   "instructions": "Implement and verify the scheduler change.",
   "forkTurns": "3",
-  "authority": {
-    "role": "implementer",
-    "model": { "provider": "openai-codex", "modelId": "gpt-5.5" },
-    "thinkingLevel": "high",
-    "capabilities": [
-      "filesystem.read",
-      "filesystem.write",
-      "worktree.read",
-      "worktree.mutate",
-      "process.exec",
-      "memory.query",
-      "workflow.delegate"
-    ],
-    "toolNames": ["read", "grep", "find", "ls", "write", "edit", "memory", "bash", "delegate"],
-    "readPaths": ["."],
-    "writePaths": ["packages/coding-agent"],
-    "budget": { "maxTokens": 32000, "maxCostUsd": 2, "maxToolCalls": 80 }
-  }
+  "model": { "provider": "openai-codex", "modelId": "gpt-5.5" },
+  "thinkingLevel": "high",
+  "path": "/home/me/GitHub/project",
+  "toolNames": ["read", "grep", "find", "ls", "write", "edit", "python", "bash"]
 }
 ```
 
-Fleet creation is bounded before Pi creates a durable task, conversation, agent, or queue entry: depth is at most 8, one parent may own at most 64 direct children, one session may retain at most 256 logical agents, and the scheduler may retain at most 256 queued dispatches. The profile-free baseline is deliberately lean: the session may retain one nested identity at depth one, and that child is a leaf; additional root workers remain available and can reuse the retained specialists. An owner-authored profile may set `delegationLimits.maxDepth`, `delegationLimits.maxChildrenPerAgent`, and `delegationLimits.maxNestedAgentsPerSession` up to the host ceilings; omitted authored limits retain the host ceilings. Descendant profile selection intersects these limits with the ancestor's immutable contract and cannot widen them. Admission dynamically preserves queue and durable-projection headroom for every implementation whose mandatory verifier has not yet materialized, plus a newly admitted contract's verifier. A verifier dispatch that encounters saturation remains represented by its durable subject and replays on a queue-capacity event. The shared durable projection independently caps agents, tasks, and attempts at 256 each. `workerDelegation.maxConcurrent` remains the global running-agent limit; excess admitted work enters the bounded durable queue. The kernel also rejects an exact recursive cycle when a child repeats the same normalized instructions and effective profile already present in its ancestor chain. Root budgets are cumulative across every descendant and attempt: token, cost, tool-call, active-wall-clock, and attempt usage are reconstructed from durable checkpoints and checked before more work is admitted. The default delegation baseline adds no cost or active-time ceiling; positive global settings, profile budgets, and inherited foreground ceilings remain authoritative when explicitly configured.
+Fleet creation is bounded before Pi creates a durable task, conversation, agent, or queue entry: one session may retain at most 256 logical agents, and the scheduler may retain at most 256 queued dispatches. Every compiled worker profile has zero descendant depth and fan-out even if a legacy profile contains recursive limits. Admission preserves queue and durable-projection headroom for mandatory verifiers. A verifier dispatch that encounters saturation remains represented by its durable subject and replays on a queue-capacity event. `workerDelegation.maxConcurrent` is the global running-agent limit; excess admitted work enters the bounded durable queue. Worker token, cost, tool-call, active-wall-clock, and attempt usage are reconstructed from durable checkpoints and checked before more work is admitted. The default delegation baseline adds no cost or active-time ceiling; positive global settings, profile budgets, and inherited foreground ceilings remain authoritative when explicitly configured.
 
-`delegate` exposes the shared durable task/tree state through distinct authority boundaries:
+`delegate` exposes the shared durable worker state to the owning root through distinct control actions:
 
 - `tasks` returns a bounded view of durable DAG tasks, dependencies, status, latest attempt/agent dispatch, verifier state, terminal reason, and persisted retry eligibility. `start.dependsOn` accepts only existing same-objective task IDs; forward, cross-objective, self, and cyclic edges fail before dispatch.
-- `list` returns safe metadata for session agents, including lineage, depth, state, and reusable activity; it does not grant transcript or control authority.
-- `transcript` pages bounded messages only for the session root or the caller's own agent/control subtree, with an opaque raw-entry cursor and page size of 1-64. A page may be empty and still provide `nextCursor` after visiting non-message entries; an individually oversized message is omitted and counted rather than partially returned. Sibling and unrelated peer transcripts are not readable by workers.
+- `list` returns safe metadata for session agents, including state and reusable activity; it does not expose private resume state.
+- `transcript` pages bounded messages for the session root with an opaque raw-entry cursor and page size of 1-64. A page may be empty and still provide `nextCursor` after visiting non-message entries; an individually oversized message is omitted and counted rather than partially returned.
 - `send` and `broadcast` queue bounded, non-waking, threaded peer evidence; broadcast canonicalizes a bounded target set and reports acceptance per target. Peer content is untrusted data, never authority.
-- `follow_up`, `interrupt`, `resume`, and `cancel` may wake or mutate only within the caller's control subtree. `resume` keeps the admitted model, transcript, resources, and grant; a paused objective retains its suspended attempt without starting or cancelling it until objective resume drains the scheduler. `cancel` terminates only the selected current task.
+- `follow_up`, `interrupt`, `resume`, and `cancel` let the owning root steer worker lifecycle. `resume` keeps the admitted model, transcript, resources, and grant; a paused objective retains its suspended attempt without starting or cancelling it until objective resume drains the scheduler. `cancel` terminates only the selected current task.
 - `reply` answers one exact reply-expected request. The session root consumes replies through the acknowledged `inbox`, event-driven `inbox_wait`, and `inbox_ack` flow instead of unsolicited transcript injection.
 - `wait` and `wait_many` are event-driven; `wait_many` accepts a bounded canonical target set and completes in `any` or `all` mode. `retire` replay-safely closes only an idle leaf after its mailbox and reply obligations clear, preserving its binding and transcript.
 
@@ -244,7 +230,7 @@ Transient attempt retries are evidence-gated. A classified provider or transport
 
 `delegate` returns a stable agent/lane identity immediately. A fresh `start` does not accept `laneId`; omit it, retain the returned `agentId`, and pass that `agentId` to a later `start` to reuse the persistent worker. Completion persists a bounded terminal handoff before waking the parent; late output stays in the worker transcript instead of racing into the active foreground transcript. Review-pending results remain `partial` and project blockers remain `blocked` in lane status and terminal handoffs instead of either being collapsed into harness failures. A scheduled transient retry is reported as nonterminal with its durable state retained. A full parent mailbox retains the attempt-keyed handoff until an explicit terminal, mailbox-capacity, state-change, or recovery event drains it—there is no retry polling loop. Exact replays are inert, conflicts fail closed, and delivery errors remain retained. Use `delegate { action: "status", laneId }` for bounded lane-result retrieval.
 
-Global profiles live at `~/.pi/agent/profiles/orchestration/<id>.json`; project profiles live at `.pi/profiles/orchestration/<id>.json`. They are optional presets for model, reasoning, tools, resources, budget, verification, prompt defaults, and recursive `delegationLimits`. Select one with `profileId` on a call or configure `workerDelegation.orchestrationProfile`. `dispatchProfileIds` is preset-routing metadata, not an admission allowlist. Profile `maxConcurrent` is retained in the authored schema but does not override the global scheduler. `delegate` actions `profile_inspect` and `profile_create` manage optional immutable session-scoped narrowings; task profiles inherit the owner-authored base budget unchanged, and direct authority selection does not require a profile.
+Global profiles live at `~/.pi/agent/profiles/orchestration/<id>.json`; project profiles live at `.pi/profiles/orchestration/<id>.json`. They are optional presets for model, reasoning, tools, resources, workspace, budget, verification, and prompt defaults. Select one with `profileId` on a call or configure `workerDelegation.orchestrationProfile`. Profile `maxConcurrent` is retained in the authored schema but does not override the global scheduler. `delegate` actions `profile_inspect` and `profile_create` manage immutable session-scoped narrowings. `profile_create` can omit `baseProfileId`; Pi then derives the foreground model, live thinking, compatible tools, and machine scope before applying optional `model`, `thinkingLevel`, `path`, and `toolNames` narrowing.
 
 A preset with `requireIndependentVerification: true` still names an owner-authored `verificationProfileId`. The runtime creates a separate durable verifier task and accepts the implementation only after a typed verifier decision. A profile using `run_process` must declare `executionPolicy`; that tool launches only listed executables as direct argv. The platform shell is different: it is a real persistent per-agent shell and is not OS/container isolation. Shell commands can exercise the host process, filesystem, network, and credentials available to Pi; direct `write`/`edit` path scopes do not sandbox shell side effects.
 
@@ -252,13 +238,12 @@ Direct `write`/`edit` calls use review-after-apply semantics. The compiled grant
 
 | Setting | Type | Default | Description |
 |---------|------|---------|-------------|
-| `workerDelegation.enabled` | boolean | `true` | Enable autonomous recursive agent trees; explicit `false` is a hard off-switch |
+| `workerDelegation.enabled` | boolean | `true` | Enable autonomous persistent leaf workers; explicit `false` is a hard off-switch |
 | `workerDelegation.orchestrationProfile` | string | - | Optional default execution preset; agents may replace its defaults within inherited authority |
-| `workerDelegation.maxUsd` | number | `0` | Cumulative USD ceiling for one root tree; `0` is unbounded and a positive value explicitly enables the ceiling |
-| `workerDelegation.maxWallClockMs` | number | `0` | Cumulative active wall-clock ceiling for one root tree; `0` is unbounded and a positive value explicitly enables the ceiling |
+| `workerDelegation.maxUsd` | number | `0` | USD ceiling for one worker task; `0` is unbounded and a positive value explicitly enables the ceiling |
+| `workerDelegation.maxWallClockMs` | number | `0` | Active wall-clock ceiling for one worker task; `0` is unbounded and a positive value explicitly enables the ceiling |
 | `workerDelegation.maxConcurrent` | number | `20` | Global running-agent concurrency inside the fixed fleet and queue bounds |
 | `workerDelegation.writeEnabled` | boolean | `true` | Expose direct `write`/`edit`; explicit `false` revokes them for newly admitted work and narrows resumed grants |
-| `workerDelegation.writePaths` | string[] | `["."]` | Global envelope for direct child writes; an explicit empty array revokes direct `write`/`edit` |
 | `workerDelegation.modelPins` | object | - | Optional exact `default` and per-role provider/model/thinking bindings for fresh workers; malformed or unavailable applicable pins fail closed |
 
 ### Tool Repair
@@ -287,21 +272,35 @@ Environment kill switches override their diagnostic layers: `PI_TOOL_REPAIR_DISA
 
 ### Auto Learn Advanced
 
+Native reflection belongs only to the main/orchestrator session. Eligible turns append a durable cue to the orchestrator's next ordinary current-session provider turn; reflection never starts a separate/background model request. Workers cannot run reflection or mutate durable memory; they return evidence to the parent, which decides what should be retained. A fresh main session uses this audited learning policy:
+
 | Setting | Type | Default | Description |
 |---------|------|---------|-------------|
-| `autoLearn.enabled` | boolean | derived from `autonomy.mode` (`false` when off) | Autonomously trigger background history scavenging for long sessions |
+| `learningPolicy.enabled` | boolean | `true` | Route reflection writes through the decision/audit/rollback policy |
+| `learningPolicy.autoApplyEnabled` | boolean | `true` | Apply eligible additive or organizational learning without asking the user to babysit it |
+| `learningPolicy.confidenceThreshold` | number | `50` | Minimum confidence for automatic application |
+| `learningPolicy.minObservations` | number | `1` | Minimum repeated observations for automatic application |
+| `learningPolicy.allowedAutoApplyLayers` | string[] | `["memory", "skill"]` | Layers eligible for automatic application; other layers remain proposals |
+| `learningPolicy.requireRollbackPlan` | boolean | `true` | Require an inverse plan before an automatic durable write |
+| `learningPolicy.autoApplySupersessions` | boolean | `false` | Keep memory replacement/removal approval-gated unless explicitly enabled |
+
+Safe `memory_add`, `okf_add`, and `okf_organize` writes can therefore land autonomously, including moving an exact hot-memory fact from `MEMORY.md` into structured OKF storage. Clean skill promotion is also eligible after overlap checks. `memory_replace` and `memory_remove` remain proposals by default because they supersede existing knowledge. Every applied write records its decision, outcome, and rollback data.
+
+| Setting | Type | Default | Description |
+|---------|------|---------|-------------|
+| `autoLearn.enabled` | boolean | `true` in every autonomy mode | Enable root-session current-turn reflection. Disabling it immediately dismisses any pending cue and removes the standing reflection contract; re-enabling does not resurrect dismissed evidence. Automatic reflection never schedules a separate or background model request. |
 | `autoLearn.model` | string | `modelRouter.learningModel`, otherwise `"active"` | Legacy/direct override for the background learner; `"active"` uses the current session model, otherwise use a `pi --model` pattern |
-| `autoLearn.longSessionMessages` | number | `32` | Trigger after this many message entries in the active branch |
-| `autoLearn.longSessionContextPercent` | number | `70` | Trigger when current context usage reaches this percent |
-| `autoLearn.cooldownMinutes` | number | `120` | Per-session-tenant cooldown between learner launches |
+| `autoLearn.longSessionMessages` | number | `32` | Readiness threshold after this many message entries in the active branch for an eligible learner run |
+| `autoLearn.longSessionContextPercent` | number | `70` | Readiness threshold when current context usage reaches this percent |
+| `autoLearn.cooldownMinutes` | number | `1440` | Per-session-tenant cooldown between learner launches |
 | `autoLearn.leaseMinutes` | number | `90` | Shared-state lease duration for a running background learner |
-| `autoLearn.maxConcurrentLearners` | number | `2` | Maximum running Auto Learn background learners per session tenant |
+| `autoLearn.maxConcurrentLearners` | number | `1` | Maximum running Auto Learn background learners per session tenant |
 | `autoLearn.applyHighConfidence` | boolean | `false` | Allow the learner to apply high-confidence memory candidates; broader write authority is controlled by `autonomy.mode` |
-| `autoLearn.reflectionReview` | boolean | `true` | When Auto Learn is enabled, also run bounded post-turn reflection after corrective or complex turns |
-| `autoLearn.reflectionMinToolCalls` | number | `5` | Trigger reflection review after this many tool calls in one completed turn |
-| `autoLearn.reflectionCooldownMinutes` | number | `60` | Per-session-tenant cooldown between reflection-review learners |
+| `autoLearn.reflectionReview` | boolean | `true` | When enabled, allow root-only automatic reflection cues after eligible corrective or complex turns; the cue is consumed by the next ordinary current-session turn |
+| `autoLearn.reflectionMinToolCalls` | number | `12` | Queue a root-session reflection cue after this many tool calls in one completed turn |
+| `autoLearn.reflectionCooldownMinutes` | number | `1440` | Per-session-tenant cooldown between automatic root-session reflection cues; corrective and complex-task signals can bypass it |
 
-Use `/settings` → **Model Router** for the preferred place to choose the scavenger/reflection/skill-creator model. Use `/settings` → **Auto Learn Advanced** for trigger/cooldown/concurrency overrides and the legacy direct `autoLearn.model` override. Use `/autonomy status` for the compact preset dashboard, `/auto-learn status` to inspect trigger state, reflection cooldown, and running leases, or `/auto-learn run` to start one learner immediately.
+Use `/settings` → **Model Router** for the preferred place to choose the learner/skill-creator model. Automatic reflection uses the orchestrator's current session turn rather than a separate or background model request. Use `/settings` → **Auto Learn Advanced** for readiness/cooldown/concurrency overrides and the legacy direct `autoLearn.model` override. Use `/autonomy status` for the compact preset dashboard, `/auto-learn status` to inspect readiness and running leases, or `/auto-learn run` to explicitly start one bounded background learner immediately. Workers never receive reflection or durable-memory mutation authority; they return evidence to the root orchestrator.
 
 When enabled, Auto Learn keeps a small shared state file for visibility/cooldowns, but prompt/log/session artifacts are isolated under per-session-tenant directories so one session's learner does not consume another session's concurrency budget. Learners must confront available user/project memory first, using existing rules, preferences, corrections, and project facts to decide whether each candidate is useful, unique versus merge/upgrade-worthy, and agent-improving. Candidate validation is chunked/vectorized instead of one memory query per candidate. Successful Auto Learn workers purge their internal prompt/log/session artifacts after exit; the 7-day retention pruner is a fallback for unfinished or failed artifacts, and active leases are skipped so running learners are not raced. Provider/user history pruning is delegated to the continuous-learning tool after it records a learning outcome: only files older than 7 days whose current fingerprint still matches a successfully extracted index entry are deleted, and active/current sessions are protected.
 
@@ -312,13 +311,13 @@ When enabled, Auto Learn keeps a small shared state file for visibility/cooldown
     "model": "active",
     "longSessionMessages": 32,
     "longSessionContextPercent": 70,
-    "cooldownMinutes": 120,
+    "cooldownMinutes": 1440,
     "leaseMinutes": 90,
-    "maxConcurrentLearners": 2,
+    "maxConcurrentLearners": 1,
     "applyHighConfidence": false,
     "reflectionReview": true,
-    "reflectionMinToolCalls": 5,
-    "reflectionCooldownMinutes": 60
+    "reflectionMinToolCalls": 12,
+    "reflectionCooldownMinutes": 1440
   }
 }
 ```
@@ -349,10 +348,21 @@ The checkpoint owns user intent mechanically: `## Active Task` copies the latest
 
 | Setting | Type | Default | Description |
 |---------|------|---------|-------------|
-| `costGuard.maxTurnUsd` | number | `0` | Projected per-turn USD warning ceiling; disabled by default, positive values explicitly enable it |
+| `costGuard.enabled` | boolean | `false` | Explicitly enable foreground per-turn cost projections and enforcement |
+| `costGuard.maxTurnUsd` | number | `0` | Projected per-turn USD ceiling; a positive legacy value remains dormant until `enabled` is `true` |
 | `costGuard.action` | string | `"warn"` | `"warn"` only reports the estimate; `"downgrade"` also lowers reasoning one rung for that request without changing saved/profile state |
 
-The projection uses the session response reserve, cached-input rates, and model-declared long-context tiers. ChatGPT subscription usage is marked `(sub)` and does not enter the USD guard.
+The projection uses the session response reserve, cached-input rates, and model-declared long-context tiers. ChatGPT subscription usage is marked `(sub)` and does not enter the USD guard. Enable it explicitly through `/settings` → **Foreground cost guard**, or in JSON:
+
+```json
+{
+  "costGuard": {
+    "enabled": true,
+    "maxTurnUsd": 0.5,
+    "action": "warn"
+  }
+}
+```
 
 ### Context GC
 

package/docs/tmux-agent-manager.md

@@ -31,12 +31,17 @@ Run `/tmux-agents` or call `tmux_agent_manager` with `action: "status"` to check
 
 ## Completion contract
 
-`fire_task` creates panes, injects prompts, and arms one event-driven `tmux pipe-pane` watcher per worker before returning. Each watcher:
+`fire_task` creates idle panes and arms one event-driven `tmux pipe-pane` watcher per worker. It then
+starts every provider with the initial prompt file as part of the same CLI command
+(`--prompt-interactive` for Agy), so task delivery cannot race TUI startup. Each watcher:
 
 1. consumes pane output as it arrives;
 2. writes one atomic terminal result when it sees the worker's `DONE` or `BLOCKED` marker, the pane closes, or its one-shot deadline expires;
 3. updates tmux status metadata and emits a display notification.
 
+On deadline, the watcher persists `timeout` first and then terminates its owned pane. A timed-out
+provider process therefore cannot remain live and continue spending resources.
+
 The parent Pi session watches result-file events. Once a turn's worker is terminal, it records a per-agent notification marker (`notifiedTurn`) and sends a bounded, source-labelled untrusted handoff with `triggerTurn: true`. Startup performs one reconciliation pass for terminal events produced while Pi was offline, and also reconciles tmux **sessions**: see [Persistence](#persistence-follow-ups-reconcile-dismiss) below.
 
 Do not poll pane state, capture pane output, or inspect logs merely to detect completion. Use `job_status` or terminal artifacts after the handoff only when its bounded evidence is insufficient.
@@ -53,13 +58,14 @@ actions manage that persistence:
   (relaunch with `fire_task` instead) or if the job was `dismiss`ed.
 - **`dismiss`** — stops tracking a job (no more re-arming, no more handoffs) without killing its tmux
   session; the pane keeps running and can still be attached to (`tmux attach -t <session>`) or stopped
-  later with `stop_job`/`stop_session`.
+  later with `stop_job`/`stop_session`. Dismiss detaches the completion watcher, so its old deadline no
+  longer owns that pane.
 - **Session reconcile** — on session start, Pi diffs live tmux sessions against its own job records for
   jobs it started. A session that has disappeared while its job was not yet terminal is marked orphaned
-  (informational only — nothing is ever killed to produce this state, and the job directory is never
+  (informational only — reconciliation never kills it to produce this state, and the job directory is never
   deleted automatically). A session that is still alive with a pending turn has its watcher re-armed so
-  the job can still complete normally. Killing a session always stays behind the explicit
-  `stop_job`/`stop_session` confirm path.
+  the job can still complete normally. Manual early termination stays behind the explicit
+  `stop_job`/`stop_session` confirm path; a managed deadline terminates only its owned pane.
 
 An idle worker (no turn currently dispatched) does not hold this session's reload-quiesce; `/reload` is
 never blocked merely because a persistent tmux worker exists between turns.
@@ -68,33 +74,36 @@ Running managed lanes are checkpointed at dispatch and rehydrated with the same
 `/reload`. A later terminal event therefore completes the existing goal binding instead of minting a
 replacement lane or risking a duplicate dispatch.
 
-## Approval-gated dispatch: the standing grant
-
-A real (non-dry-run) `fire_task` or `send_followup` launch requires either a **standing grant** or a
-one-shot interactive approval — never a silent launch:
-
-- **`grant_dispatch`** authorizes repeated unattended dispatch. Set `agent` (required), `maxLaunches`
-  (required), and optionally `goalId` (an unscoped grant covers any goal), `allowedTools`,
-  `resourceProfile`, `writePaths`, and `expiresInMinutes`. Requires interactive confirmation when a UI is
-  attached; in print/rpc/non-interactive mode, requires the `--allow-tmux-dispatch` CLI flag instead.
-  Once granted, matching launches proceed unattended. Team launches validate every child against the
-  grant and consume one unit of `maxLaunches` for each child process launched; a single-provider grant
-  cannot authorize a mixed-provider team.
-- **`revoke_grant`** ends a standing grant early (defaults to whichever grant is currently active).
-- With **no covering grant**: an interactive session is prompted for a one-shot approval; a
-  non-interactive session (no UI, no grant) is **refused** with a clear error — never launched silently.
-
-A grant-covered (or one-shot-approved) `pi` child is launched with a **restricted profile**: `--tools`
-(or a read-biased default), `--resource-profile` (or `--no-extensions --no-skills`), and a scoped
-`--append-system-prompt` naming the grant and a fixed hard-stop list (publish/push/tag/credential
-changes/destructive deletion must come back BLOCKED, never self-approved). This pushes the envelope into
-the **child's own** launch configuration — it is not an in-process sandbox, and non-`pi` agents
-(`agy`/`claude`/`codex`/`opencode`/custom) are bounded only at the launch layer; their internal tool-loop
-behavior is that CLI's own responsibility.
-
-Grant budget (`maxLaunches`, `expiresInMinutes`) is real and enforced. `maxUsdAdvisory` and any
-self-reported worker usage are **advisory** — a claim to review, never a hard cap across the process
-boundary (the child bills under its own authentication).
+## Autonomous dispatch profiles
+
+A real `fire_task` or `send_followup` runs autonomously without a UI prompt or CLI allow flag. Tmux
+availability detection happens inside every action; `guard` is diagnostic only and is never a required
+handshake.
+
+Before `fire_task` creates any pane, watcher, prompt, or job artifact, it derives one immutable internal
+execution profile per worker and durably reserves that worker's managed lane. Omitted tool and thinking
+fields inherit the orchestrator's eligible worker surface. Omitted `path` uses the normal process cwd
+while inheriting the host-derived full-machine scope except private harness paths. An explicit `path`
+sets the process cwd and passes an immutable child-scope channel that enforces that workspace for Pi's
+structured filesystem tools. Follow-up turns reuse the persisted profile and may change instructions,
+never authority.
+
+For `pi` workers, `tools`, `resourceProfile`, `thinkingLevel`, and `worktreeLane` become Pi CLI flags. The shared worker
+ceiling removes memory, root-owned durable state, and agent-launching controls while retaining ordinary
+inherited capabilities such as Python. When `resourceProfile` is omitted, the host compiles the
+orchestrator's effective extension/skill/prompt/theme/agent/tool filters into a one-shot child profile;
+an explicit value overrides that inheritance. The structured read/write/edit/search tools hard-deny
+Pi's private auth, session, memory, settings, state, and work roots, and an explicit `path` further
+restricts those structural calls to that workspace. Arbitrary process tools such as bash and
+Python remain deliberate host-trust boundaries and can reach OS-visible files; this profile is not
+misrepresented as process sandboxing. These fields are rejected for non-Pi providers because arbitrary
+external CLIs own their own tool, thinking, and workspace controls; put native provider options in
+`command` instead. A non-Pi `path` changes its cwd only. Its durable profile records one machine-wide,
+host-trusted process (`bash` capability) rather than projecting the parent's Pi tool names or claiming
+CLI/OS sandbox enforcement.
+
+Any cooperative self-reported worker usage is **advisory** — a claim to review, never a hard cap across
+the process boundary (the child bills under its own authentication).
 
 Dispatched tmux workers appear as `tmux-worker` lanes alongside in-process worker lanes in `/autonomy`
 and `delegate { action: "status" }`; a worker's self-reported changed files are re-checked against the session's active
@@ -105,16 +114,14 @@ write scope and flagged for parent review when out of scope, exactly like an in-
 The `goal` tool's `dispatch_worker` action can bind a single open requirement to a persistent tmux worker
 instead of the default in-process one: pass `dispatchTarget: "tmux"`. Core invokes `fire_task` itself (the
 same call the model would make) with exactly one `pi` agent, so the dispatch maps 1:1 to the
-requirement's bound lane; the launch still goes through the standing-grant authorization above unchanged
-— an unattended goal/idle loop with no covering grant is honestly refused, never silently launched. The
-requirement's binding is recorded either way; a successful tmux dispatch waits and resumes through the
-same lane machinery as an in-process worker.
+requirement's bound lane. The same autonomous profile derivation and pre-launch durable reservation
+apply. A successful tmux dispatch waits and resumes through the same lane machinery as an in-process
+worker.
 
 When no worker was dispatched, the tool response's `dispatchSkipReason` explains why:
 
-- `no_standing_grant` — no covering grant, and this call had no UI to prompt (run `grant_dispatch` first).
 - `tmux_extension_not_loaded` — `tmux_agent_manager` is not loaded in this session (see Enable above).
-- `tmux_dispatch_failed` — the `fire_task` launch threw for a reason other than the grant (a bad jobId, a
+- `tmux_dispatch_failed` — the `fire_task` launch threw (an invalid `launchKey`, a
   live session-name collision, an environment failure).
 - `tmux_dispatch_incomplete` — the launch call returned without the job/agent details needed to identify
   the new lane.
@@ -130,8 +137,8 @@ When no worker was dispatched, the tool response's `dispatchSkipReason` explains
 
 ## Safety
 
-Launch actions run directly unless `dryRun: true` is requested, and are approval-gated per the standing
-grant above. Stop actions can discard active pane work, so they remain previews by default and require
+Launch actions run directly unless `dryRun: true` is requested. Stop actions can discard active pane
+work, so they remain previews by default and require
 `confirm: "yes-tmux-stop"` for execution. Existing sessions are never replaced silently; `force: true`
 archives an old job directory but does not kill a live tmux session.
 

package/docs/usage.md

@@ -316,6 +316,6 @@ pi --exclude-tools ask_question
 
 ## Design Principles
 
-Pi keeps the core focused and pushes project-specific workflows into extensions, skills, prompt templates, and packages. Core includes the cross-project lifecycle primitives it depends on itself: native goals, task steps, durable recursive agent orchestration, and a platform-selected shell. Broader integrations such as MCP and external-provider teams remain extension/package territory.
+Pi keeps the core focused and pushes project-specific workflows into extensions, skills, prompt templates, and packages. Core includes the cross-project lifecycle primitives it depends on itself: native goals, task steps, durable root-managed leaf-worker orchestration, and a platform-selected shell. Broader integrations such as MCP and external-provider teams remain extension/package territory.
 
 For the full rationale, read the [blog post](https://mariozechner.at/posts/2025-11-30-pi-coding-agent/).

package/docs/worker-profiles.md

@@ -1,22 +1,24 @@
 # Task worker presets
 
-Native delegation does not require a profile. `delegate.authority` can choose a child model, reasoning level, role label, and classified tool names directly. Omitted fields inherit from the caller, and Pi persists the resulting immutable execution grant. The model-facing tool has no token, cost, time, attempt, or tool-call ceiling fields; those come only from host settings or owner-authored profiles.
+Native delegation does not require a profile. The model-facing `delegate start` action exposes only top-level `model`, `thinkingLevel`, `path`, and `toolNames` overrides. Omitted fields inherit the live compatible foreground model, thinking level, classified tools, and machine scope. Pi compiles that request into an immutable host execution grant; the model does not provide an authority envelope, role/capability grant, budget, or tool-call ceiling. Budgets, leases, and other limits come from host settings and owner-authored profiles.
 
 `delegate` profile actions remain useful when the foreground orchestrator wants a reusable session-scoped preset. They do not edit user or project profile files. Task presets are:
 
-- Derived only from an owner-authorized base profile.
+- Derived from an owner-authored base profile or the live compatible foreground contract.
 - Immutable and assigned a `task-...` ID by Pi.
 - Stored on the owning session branch, never shared across independent sessions.
 - Limited to 32 presets per session.
-- Unable to add tools or resources beyond the base profile, and always inherit its budget unchanged.
+- Unable to add tools or resources; tools may only narrow the inherited surface and resources/budgets stay host-owned.
 - Limited to configured, authenticated, non-exhausted models and a reasoning level that model supports.
 
-Use `delegate { action: "profile_inspect" }` when the reusable bases or model combinations are unknown. Then call `profile_create` with a concise task and only the model/tool/resource defaults worth preserving. Pass the returned profile ID unchanged to `delegate start`; never invent one.
+Use `delegate { action: "profile_inspect" }` when reusable owner-authored bases or model combinations are unknown. Otherwise `profile_create` can derive directly from the live foreground contract. Supply a concise task and only the model, thinking, path, or tool narrowing worth preserving. Pass the returned profile ID unchanged to `delegate start`; never invent one.
 
-Worker agents do not receive the root-only profile/status actions. They receive `delegate` only when their admitted tool set and capability ceiling both retain delegation; a caller can create a non-delegating leaf by narrowing either field. Delegating workers may recursively create descendants within the fixed depth, direct-child, session-agent, and queue bounds. They can discover safe session-peer metadata, exchange non-waking threaded messages and bounded broadcasts, and use event-driven `wait`/`wait_many`, but bounded transcript reads and waking controls remain limited to the caller's own control subtree. Transcript cursors address raw session entries, so a continuation page may be empty after non-message entries; an individually oversized message is omitted with a count instead of being truncated. A descendant may vary model or role through another preset, but it cannot acquire new resources: pointers must fully match the ancestor's admitted pointer metadata, soul text must match exactly, and verifier resources and authority stay within the ancestral verifier or worker boundary.
+Worker agents are root-managed leaves. They do not receive root-only profile/status/control actions or `delegate`, and cannot create descendants. The root owns worker lifecycle, queue admission, budgets, leases, cancellation, status, and bounded transcript retrieval. Each fresh worker receives a new classified tool surface and the live compatible model, thinking level, tools, and machine scope; top-level overrides can narrow or focus that inherited base. Worker output is untrusted evidence delivered to the owning root through the durable terminal handoff.
+
+The root `memory` tool and raw memory prompt snapshot never enter a worker or child session. When retrieval is enabled and the admitted profile or dispatch selects `memory_read`, Pi materializes a fresh query-only broker with `memory.query` authority and returns bounded, source-labeled evidence; it cannot write memory or expose memory files.
 
 New agents may receive immutable sanitized birth context with `forkTurns: "none"`, `"all"`, or a positive user-turn count such as `"3"`. Omitted starts receive no parent transcript, so a self-contained task cannot inherit and mistake parent-level orchestration intent for child ownership. Explicit inheritance remains available inside the exact provider/model boundary. Crossing either provider or model defaults to no inherited turns, and an explicit non-`none` cross-boundary fork is rejected. Tool calls/results, reasoning/commentary, system/developer/custom messages, mailbox controls, non-text content, and incomplete assistant output never enter the snapshot. Dispatching another task with an existing `agentId` reuses that agent's durable transcript and cannot replace its birth context.
 
 `delegate tasks` is the bounded view of the same durable task/DAG runtime used for dispatch and recovery. A new task may name existing same-objective task IDs with `dependsOn`; it remains pending until those dependencies complete, while invalid or cyclic edges fail closed. Evidence-classified transient failures retain their attempt/retry count and exact `notBefore` deadline across restart. Agent, task, and attempt projections are independently capped at 256 entries.
 
-Pi admits fleet and queue capacity before registering a new logical child; every accepted queued child then has a stable agent ID. Queue and projection admission preserve one continuation slot for every pending mandatory verifier, and a verifier blocked by saturation is retried from durable subject state when capacity changes. A parent that waits yields its scheduler slot until an event-driven state change. A worker cannot wait for itself or for a queued target blocked by its own write reservation; that wait fails immediately and tells the worker to finish its task so the owning parent can continue coordination. Every terminal child writes one bounded, idempotent handoff to its owning parent's mailbox. Review-pending results retain terminal status `partial`, and project-level blockers retain `blocked`; neither is projected as a harness failure. Evidence-classified retries stay nonterminal and report that their durable state is preserved. A full mailbox retains that handoff by terminal attempt ID until an explicit capacity/state/recovery signal drains it; no timer polls for delivery. Active parents receive the handoff without transcript races; idle registered parents resume once. Child output remains in the child transcript. `interrupt`, `resume`, `cancel`, and `follow_up` are subtree-scoped; a paused objective keeps a suspended worker nonterminal until resume. `retire` closes only an idle leaf with no unresolved mailbox/reply work and preserves its binding and transcript. A resumed worker retains the exact admitted preset or adaptive grant, model, resources, lineage, and transcript.
+Pi admits fleet and queue capacity before registering each root-dispatched worker; every accepted queued worker then has a stable agent ID. Queue and projection admission preserve one continuation slot for every pending mandatory verifier, and a verifier blocked by saturation is retried from durable subject state when capacity changes. The root yields its scheduler slot while waiting for an event-driven state change. A worker cannot wait for itself or for a queued target blocked by its own write reservation; that wait fails immediately and tells the worker to finish its task so the root can continue coordination. Every terminal worker writes one bounded, idempotent handoff to the owning root's mailbox. Review-pending results retain terminal status `partial`, and project-level blockers retain `blocked`; neither is projected as a harness failure. Evidence-classified retries stay nonterminal and report that their durable state is preserved. A full mailbox retains that handoff by terminal attempt ID until an explicit capacity/state/recovery signal drains it; no timer polls for delivery. The root receives the handoff without transcript races and resumes once when idle. Worker output remains in the worker transcript. `interrupt`, `resume`, `cancel`, and `follow_up` are root-owned; a paused objective keeps a suspended worker nonterminal until resume. `retire` closes only an idle leaf with no unresolved mailbox/reply work and preserves its binding and transcript. A resumed worker retains the exact admitted preset or adaptive grant, model, resources, lineage, and transcript.

package/docs/worktree-sync.md

@@ -164,24 +164,22 @@ environment value a lane-bound process can set to shed the worker ceiling below.
 
 ### Forbidden-tool ceiling
 
-A worker session can never activate: `goal`, `pipeline`, `delegate`, `improvement_loop`,
-`extensionify`, `skillify`, `run_toolkit_script`, `model_fitness`, `tmux_agent_manager`,
-`context_scout`, `python`. This is enforced as the FIRST line of the tool registry's allow
+A worker session can never activate: the legacy composite `goal`, `secret_store`, `memory`, `delegate`,
+`improvement_loop`, `model_fitness`, `tmux_agent_manager`, or `context_scout`. This is enforced as the FIRST line of the tool registry's allow
 predicate (`RuntimeBuilder.refreshToolRegistry`'s `isAllowedTool`) -- it wins over an allow-list,
-an exclude-list, or an active resource profile that names the tool explicitly. `goal`/`delegate`/
-`tmux_agent_manager` are sub-orchestration (a worker dispatching its own workers
-defeats single-owner lane accountability); `improvement_loop`/`extensionify`/`skillify` are
-self-adaptation surface a worker should never mutate; `run_toolkit_script`/`model_fitness` spend
-budget a worker's dispatcher does not control. **`python`** is included because it is a bounded but
-still largely unrestricted execution contract -- excluding it is load-bearing for the zero-footprint
-guarantee below (an unbounded interpreter can write state anywhere it can reach on disk).
-**`context_scout`** is excluded because it is itself sub-orchestration: it spawns its own isolated
-agent loop.
-
-`bash` is deliberately **not** forbidden. It stays available as the same documented cooperative
-boundary the lane gate already applies to foreign (non-`pi`) CLIs it cannot structurally contain --
-a worker's bash access is bounded by the lane gate's G8/G10 rules and the path envelope below, not
-by removing the tool.
+an exclude-list, or an active resource profile that names the tool explicitly. The legacy `goal`
+stays root-only because its composite action set embeds `dispatch_worker`; its non-dispatching
+`create_goal`/`get_goal`/`update_goal` lifecycle tools inherit normally. `delegate`,
+`tmux_agent_manager`, `context_scout`, and `model_fitness` launch agent/provider worker loops.
+`memory` and `improvement_loop` mutate root-owned reflection state, while `secret_store` mutates
+machine credential/project bindings. Ordinary tools including `pipeline`, `ask_question`, `skill`,
+`extensionify`, `skillify`, and `run_toolkit_script` inherit when the orchestrator exposes them.
+
+`bash` and `python` are deliberately **not** forbidden. Removing only one execution route would not
+create a meaningful filesystem boundary. Pi hard-denies private harness roots for structural
+read/write/edit/search calls, but arbitrary process code remains a deliberate host-trust boundary and
+can reach any file visible to the OS account. The harness does not claim a process sandbox it does not
+have; lane G8/G10 and the land gate remain the backstops for repository integration.
 
 ### `worktree_sync` tool scoping for a worker
 
@@ -207,7 +205,15 @@ deliberately engine-level and applies to `land`/`release_lane` ONLY -- `sync`/`c
 from the tool-layer `laneKey` check above. `release_lane`'s existing G11 discard-confirm requirement
 is unaffected: it still applies once ownership no longer conflicts.
 
-### Edit/write path envelope
+### Structural path envelopes
+
+Every worker session wraps structural read/write/edit/grep/find/ls calls in a symlink-safe private-path
+envelope. `auth.json`, `MEMORY.md`, `USER.md`, settings/model files, session/state/work roots, and the
+active project's `.pi/settings.json` are denied before the underlying tool runs. The positive scope is
+empty for an unrestricted worker, meaning arbitrary sibling projects and machine paths remain available
+as required by the inherited full-machine profile. A managed Pi worker launched with an explicit profile
+`path` receives that path through an immutable startup channel, and the same envelope then denies
+structural access outside it.
 
 For a lane-bound session, `edit`/`write` targets are checked against the lane's own worktree root
 (`WorktreeLaneGate.checkMutation`'s `targetPath` parameter, resolved by `RuntimeBuilder`'s tool
@@ -216,8 +222,8 @@ lane's worktree root and the target are both resolved through `realpath` (walkin
 nearest EXISTING ancestor when the target itself does not exist yet, so a not-yet-created file
 cannot be smuggled through a symlink that escapes the lane). A target outside the resolved lane root
 is refused (`path_outside_lane`). No active lane record leaves the existing fail-open behavior
-unchanged. `bash` is untouched by this check -- its containment stays the G10 cooperative boundary
-described above.
+unchanged. Arbitrary process code is untouched by the structural envelope and retains the explicit
+host-trust semantics described above.
 
 ### Zero state/settings footprint
 

package/examples/extensions/custom-provider-anthropic/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pi-extension-custom-provider",
-  "version": "0.94.0",
+  "version": "0.95.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pi-extension-custom-provider",
-      "version": "0.94.0",
+      "version": "0.95.0",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.52.0"
       }

package/examples/extensions/custom-provider-anthropic/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-extension-custom-provider-anthropic",
   "private": true,
-  "version": "0.94.0",
+  "version": "0.95.0",
   "type": "module",
   "scripts": {
     "clean": "echo 'nothing to clean'",

package/examples/extensions/custom-provider-gitlab-duo/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-extension-custom-provider-gitlab-duo",
   "private": true,
-  "version": "0.94.0",
+  "version": "0.95.0",
   "type": "module",
   "scripts": {
     "clean": "echo 'nothing to clean'",

package/examples/extensions/sandbox/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "pi-extension-sandbox",
-	"version": "0.94.0",
+	"version": "0.95.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "pi-extension-sandbox",
-			"version": "0.94.0",
+			"version": "0.95.0",
 			"dependencies": {
 				"@anthropic-ai/sandbox-runtime": "^0.0.26"
 			}

package/examples/extensions/sandbox/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "pi-extension-sandbox",
 	"private": true,
-	"version": "0.94.0",
+	"version": "0.95.0",
 	"type": "module",
 	"scripts": {
 		"clean": "echo 'nothing to clean'",