@rosetears/aili-pi 0.1.9 → 0.1.10

package/README.md

@@ -77,7 +77,7 @@ The `pi-permission-modes@2.2.0` baseline owns mode persistence, prompts, and san
 - `pi-web-access@0.13.0` provides its complete upstream web-search, content-fetch, curator, clone/PDF/video, and bundled-skill surface. Its provider fallback, network traffic, config/credential paths, clone cache, temporary curator service, downloads, and optional browser-cookie access are upstream behavior; inspect its tool requests and configuration before use.
 - `pi-quota-status@0.3.0` is enabled by default. It may maintain `~/.pi/agent/pi-quota-status/state.json`; `/quota config` creates its configuration template. Zentui displays exactly one weekly value as `codex <percent> <reset>`, preferring explicit `Wk` data and treating the dependency's current `5h`-labeled primary value only as a compatibility fallback when weekly is absent.
 - `pi-permission-modes@2.2.0` provides the permission UI and sandbox degradation behavior above through AILI's exact-source adaptation. The only semantic source change is line-terminator-safe shared glob matching; `upstream/pi-permission-modes.lock.json` records the baseline and adapted hashes. AILI does not retain `/aili-mode` or `Ctrl+Shift+Alt+A` as competing controls.
-- `@agwab/pi-subagent@0.4.8` owns the generic `subagent` tool, child spawn, cancellation, durable run/artifact lifecycle, bounded parallel fan-out, async actions, worktrees, external `cwd`, and sandbox options. On Pi 0.81.1, AILI routes ordinary omitted/`auto` calls to `headless` because the pinned inline runner calls removed SDK factories; explicit `inline` stops before model startup with a compatibility diagnostic. Explicit `headless`/`tmux`, visible auto, sandbox auto, lifecycle actions, and caller options remain upstream paths. A mixed parallel auto call that combines visible tasks with ordinary uncontained tasks is rejected rather than silently sending one class through broken inline. The 19 `aili.<role>` profiles are optional named agents; generic or agentless runs do not use an AILI-only result schema. AILI also adds a bounded requested `Agent:`/`Agents:` heading and an immutable credential-path guard. The upstream runner excludes recursive `subagent` exposure inside workers.
+- AILI owns the public `task`/`hub` persistent Agent framework. `task` creates parent-scoped official Pi child sessions using 19 specialized `aili.*` selectors or `general`; top-level work is async by default, supports bounded batch scheduling, and returns stable Agent/job/turn IDs plus `agent://` and `history://` references. `hub` provides list/send/wait/inbox/output/history/jobs/cancel/model operations, park/revive, durable delivery, and owner/descendant scoping. No `subagent` compatibility alias or run/attempt backend selector remains. See [`docs/persistent-agents.md`](docs/persistent-agents.md).
 - `pi-cache-optimizer@2.6.18` provides `/cache-optimizer`, provider cache diagnostics, cache statistics, and prompt-cache optimization. It may maintain `~/.pi/agent/pi-cache-optimizer-stats.json`; `/cache-optimizer fix` is interactive and is the only command that may propose editing `models.json`.
 - `pi-markdown-preview@0.10.1` provides `/preview`, `/preview-browser`, `/preview-pdf`, `/preview-clear-cache`, and the `preview_export` tool. Terminal/browser previews require a Chromium executable; PDF export additionally requires Pandoc and a LaTeX engine.
 - `@narumitw/pi-lsp@0.25.0` provides language-agnostic `lsp_diagnostics`, `lsp_fix`, and `/lsp`. It supports routes for C/C++, Python, CSS/SCSS, JavaScript/TypeScript, Go, Rust, Java, Kotlin, Bash, YAML, Terraform, and other languages. It does not download language servers; install the required commands separately and configure project routes in `.pi/pi-lsp.json` or user routes in `~/.pi/agent/pi-lsp.json`.
@@ -97,9 +97,9 @@ When unavailable, runtime and doctor output use explicit `SKIP`/`WARN` results a
 
 ## Security boundary
 
-AILI injects a non-removable guard that denies standard Pi file-tool and parsed-bash access to credential, authentication, and private-key paths, including from an external `cwd`, a YOLO permission mode, or a caller-supplied child extension list. Child Pi processes load the ambient AILI permission-mode registration exactly once, so adapted permission prompts and sandbox behavior remain active; headless confirmation requests fail closed. The guard does not make arbitrary third-party extension code safe: extensions remain trusted code and may have direct process authority. Neither AILI nor Pi provides a universal OS sandbox or containment: trusted extensions, user-authority processes, ambient network access, and filesystem races remain in the user trust domain. Inspect exact approval targets and do not put credentials in task text.
+AILI applies a non-removable in-process child guard before tool approval. It denies credential, authentication, and private-key paths/material; intersects parent-active tools with role/call ceilings; and routes each `ask` decision back to the parent UI. In sandbox-required modes, child Bash reuses the initialized `pi-permission-modes` SandboxManager through a child-cwd-specific Bash definition; if that executor is unavailable or the child is in an incompatible Git worktree, Bash fails closed rather than running unsandboxed. Parent task acceptance is not blanket child authorization. The guard does not make arbitrary trusted extension code safe, and neither AILI nor Pi claims a universal OS sandbox. Inspect exact approval targets and do not put credentials in task text.
 
-Use `subagent` lifecycle actions (`status`, `logs`, `wait`, `interrupt`, `mark-background`, and `reconcile`) to inspect durable async work. Upstream fan-out is version-bounded rather than capped by AILI at two; background completion is not evidence until inspected. Subagents are a benefit-based way to improve execution efficiency and preserve the main agent's context: the main agent owns decisions, scope, integration, and final verification, while bounded discovery, implementation, testing, or other execution may be delegated when specialist, parallelism, or context-isolation benefits outweigh orchestration cost. Direct parent work remains valid when delegation has no clear net benefit; no subagent call is required to unlock file mutation. Provider/model behavior still depends on the configured Pi environment.
+Use `hub jobs`, `hub wait`, `hub output`, and `hub history` to inspect durable asynchronous work. At most 32 top-level turns run concurrently; nested work is synchronous and depth-bounded. Persistent Agents are a benefit-based way to improve execution efficiency and preserve parent context, while the main agent retains decisions, integration, and final verification. Direct parent work remains valid when delegation has no clear net benefit; no Agent call is required to unlock mutation. Provider/model behavior still depends on the configured Pi environment.
 
 ## Provenance and reproducibility
 
@@ -107,7 +107,7 @@ Use `subagent` lifecycle actions (`status`, `logs`, `wait`, `interrupt`, `mark-b
 - `upstream/opencode-global-agents.lock.json` pins the global AGENTS source revision/hash and documents its Pi-native derivation.
 - `upstream/pi-permission-modes.lock.json` pins the exact upstream and adapted permission runtime files and semantic diff.
 - `manifests/skill-compatibility.json` records one compatibility state per skill.
-- `manifests/roles.json` records the 19 generated Pi role profiles.
+- `manifests/roles.json` records 19 generated specialized profiles plus the AILI-owned `general` profile.
 - `manifests/provenance.json`, `manifests/sbom.json`, and `THIRD_PARTY_NOTICES.md` record adapted/reference sources and the exact npm lock inventory.
 
 Verify generated artifacts with:
@@ -125,8 +125,8 @@ npm run validate:release
 - **Doctor is non-pass:** inspect the exact `ERROR`, `WARN`, `SKIP`, or `UNVERIFIED` component. Missing optional packs are not core execution success.
 - **Permission shortcut does nothing:** use `/perm`; terminal multiplexers may consume `Alt+M`.
 - **YOLO still asks for multiline Bash:** confirm the loaded Package contains the adapted permission runtime with `npm run verify:permission-modes`; do not work around it by granting every distinct script for the session.
-- **Subagent reports the inline SDK `reading 'create'` failure:** omit `backend` or use `backend: "headless"`; explicit inline is unsupported for the pinned Pi 0.81.1 / subagent 0.4.8 pair.
-- **Sandboxed subagent cannot authenticate or reach its model:** `sandbox:true` is deny-all network, and model-backed sandbox calls must allow the exact provider endpoint while preserving credential protections. This is separate from default-backend compatibility.
+- **Persistent task says the parent Session is not durable:** start/save a normal Pi session first; Agents require a parent JSONL so their sidecar can be scoped exactly.
+- **Child Bash is denied in a sandbox-required mode:** inspect `/sandbox` for dependency/platform readiness. AILI deliberately denies instead of running unsandboxed when the parent SandboxManager is unavailable or when an isolated Git worktree uses a `.git` file that Bubblewrap cannot bind safely.
 - **Global resources are non-pass:** run `/aili-install-global-resources` only after reviewing the exact `~/.pi/agent/` targets. A malformed marker or an unowned role collision intentionally leaves files unchanged.
 - **Offline use:** the installed Package embeds the pinned skills and does not fetch `aili-workflows` at runtime. Its Pi-managed npm lifecycle synchronizes only pre-existing same-name global skills from that embedded fixed snapshot. First-time Pi/package installation still requires the relevant package sources.
 

package/THIRD_PARTY_NOTICES.md

@@ -13,17 +13,6 @@ This distribution is MIT-licensed. The following adapted sources and locked deve
 - Reused symbols/patterns: 64 canonical skill bodies and owned assets, 19 child-role prompt bodies
 - Local changes: skills/** is an exact byte-for-byte snapshot with no semantic overlay; role prompts are generated as Pi frontmatter with explicit tool/capability ceilings and structured output; templates/APPEND_SYSTEM.md is a Pi-native governance derivation of the pinned global AGENTS template, with OpenCode-only control planes excluded
 
-## @agwab/pi-subagent
-
-- Status: dependency
-- Source: https://github.com/AgwaB/pi-subagent.git
-- Revision: daa7b83819116a62008ad17aa65fcd50fefbafd0
-- Version: 0.4.8
-- License: MIT
-- Source files: src/index.ts, src/api.ts, src/runners/headless-model.ts, src/artifacts/result.ts
-- Reused symbols/patterns: subagent tool renderCall, runSubagent API, headless lifecycle, artifact envelope
-- Local changes: AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading, injects a non-removable credential guard, normalizes ordinary omitted/auto runs to headless for the Pi 0.81.1 compatibility window, and rejects explicit inline before model startup; no upstream source is copied
-
 ## pi-permission-modes
 
 - Status: adapted
@@ -101,8 +90,19 @@ This distribution is MIT-licensed. The following adapted sources and locked deve
 - Reused symbols/patterns: header, matrix animation, Zentui footer, fixed editor compositor
 - Local changes: registered as three additional Pi Package Extensions; Rose header loads a package-owned renamed artwork asset without changing upstream identity; Rose Shimmer, Rose Code Rain, and Zentui use the Rose-owned palette and gradient; overflowing Matrix tracks remain deterministic across the complete terminal width with the 96-track budget, while each rain row receives a structural blank-row repair; relative import specifiers and session lifecycle event are adapted for this package's NodeNext TypeScript contract
 
+## Oh My Pi reference
+
+- Status: reference-only
+- Source: https://github.com/can1357/oh-my-pi.git
+- Revision: 59619623e1eeb7c290649eeaf3a269284ce8adef
+- Version: 17.1.3
+- License: MIT
+- Source files: none copied
+- Reused symbols/patterns: none
+- Local changes: none
+
 ## npm dependency inventory
 
-The exact 424-entry package-lock inventory, versions, integrity values, dependency scope, and declared licenses is recorded in `manifests/sbom.json`.
+The exact 419-entry package-lock inventory, versions, integrity values, dependency scope, and declared licenses is recorded in `manifests/sbom.json`.
 
 Runtime dependencies are initialized through the single AILI Extension entry. Package-owned third-party adaptations are copied only where their provenance sourceFiles explicitly name repository paths.

package/docs/persistent-agents.md

@@ -0,0 +1,114 @@
+# Persistent Agents (`task` and `hub`)
+
+> **Availability:** The AILI-owned runtime is the public orchestration surface. The package registers `task` and `hub` and does not register a legacy `subagent` alias. Deterministic tests plus authorized real-provider, child-sandbox, and disposable external-workspace lifecycle probes are release-bound evidence.
+
+## Agent selectors
+
+The canonical catalog contains exactly 20 selectors:
+
+- `general` (the default when `agent` is omitted)
+- `aili.agent-evaluator`
+- `aili.ai-regression-scout`
+- `aili.browser-qa-runner`
+- `aili.code-reviewer`
+- `aili.code-scout`
+- `aili.convergence-reviewer`
+- `aili.doc-researcher`
+- `aili.e2e-artifact-runner`
+- `aili.implementer`
+- `aili.opensource-sanitizer`
+- `aili.plan-auditor`
+- `aili.pr-test-analyzer`
+- `aili.security-auditor`
+- `aili.silent-failure-reviewer`
+- `aili.spec-miner`
+- `aili.test-coverage-reviewer`
+- `aili.test-engineer`
+- `aili.web-performance-auditor`
+- `aili.web-researcher`
+
+`aili.general`, `task` as a selector, and unknown selectors are invalid. The 19 specialized profiles keep their own complete role prompt and cannot spawn children. `general` may synchronously spawn an allowed non-self specialized Agent below the configured depth ceiling.
+
+## Creating Agents with `task`
+
+A flat request creates one new stable Agent:
+
+```json
+{
+  "task": "Inspect the parser and report evidence",
+  "agent": "aili.code-scout",
+  "name": "ParserScout",
+  "async": false,
+  "tools": ["read", "grep"],
+  "workspace": "shared",
+  "writeScope": { "paths": [], "resources": [] }
+}
+```
+
+A batch validates every item before creating any Agent:
+
+```json
+{
+  "context": "Use the accepted plan at plan/accepted.md",
+  "tasks": [
+    { "task": "Inspect storage", "agent": "aili.code-scout" },
+    { "task": "Implement the accepted fix", "agent": "aili.implementer", "workspace": "auto", "writeScope": { "paths": ["src/storage"], "resources": [] } }
+  ]
+}
+```
+
+Per-item fields are `task`, `context`, `agent`, `name`, `model`, `async`, `tools`, `workspace`, `writeScope`, and `cwd`. Unknown fields fail validation. `blocking` is profile-only internal metadata, not a `task` field; callers must use `async:false` to wait synchronously.
+
+Every item creates a new Agent. Reusing `name: "Scout"` allocates `Scout`, `Scout-2`, and so on; it never resumes the first Agent. Follow-up work uses `hub send` with the allocated Agent ID. Nested IDs are parent-prefixed, such as `general.code-scout`.
+
+Top-level non-blocking roles default to async. `async:false`, an internally blocking role profile, and all child-to-grandchild calls are synchronous. One parent allows at most 32 active turns; excess jobs remain in durable FIFO order. AILI sets no Agent-turn wall-clock or assistant-request budget (`0`/unlimited), but provider watchdogs, tool timeouts, permissions, the 32-turn semaphore, process shutdown, and manual cancellation still apply. Background work does not survive the Pi process.
+
+## Managing Agents with `hub`
+
+`hub` actions are:
+
+- `list` — active Agents (and optionally released disk-backed identities)
+- `send` — running safe-boundary steer, idle new turn, or parked revive/new turn
+- `wait` — bounded wait over owned job/message IDs
+- `inbox` — peek or drain failed-live-handoff mail
+- `output` / `history` — bounded disk reads
+- `jobs` — owned job state
+- `cancel` — hard-cancel a job or release an idle/parked identity without deleting history
+- `model` — query or request model override operations
+
+Only failed live handoff enters the durable mailbox. Each Agent keeps at most 100 messages; the 101st is rejected while the existing 100 remain. Successful messages have durable receipts for de-duplication.
+
+Running, idle, parked, and aborted Agents never run two concurrent turns under one identity. An aborted Agent cannot revive. Process loss records a running turn as `interrupted`, a queued job as `unexecuted`, and never automatically replays either.
+
+## Output, history, and retention
+
+Complete raw output is stored at the parent-owned `<agent-id>.md`; the official Pi child conversation remains an independent Session JSONL. Tool results return at most 500,000 bytes and 5,000 lines, while parent completion previews are capped at 5,000 characters with explicit truncation metadata.
+
+Use `agent://<agent-id>` and `history://<agent-id>` as stable references. `hub output/history` resolves them with `offset` and `limit`, including after an Agent is released.
+
+Child history cannot be deleted independently. It follows the parent session. Forks start with an empty Agent registry and never copy/control old child artifacts. Confirmed AILI parent deletion can cascade its owned sidecar; official Pi 0.81.1 built-in Ctrl+D/archive has no sidecar hook, so doctor keeps that host gap visible and orphaned sidecars are preserved for reconciliation.
+
+## Models
+
+Each turn resolves in this order:
+
+1. one-shot `task.model`
+2. stable Agent instance override
+3. trusted project role override
+4. user-global role override
+5. profile frontmatter model
+6. official parent fallback
+
+An explicit unknown, unavailable, unauthenticated, or incompatible model fails at its source layer and does not fall through. One-shot values never change configuration. Direct users can run `/aili-agent-model <global|project|instance> <selector|agent-id> <provider/model|clear> [thinking]`; model-facing persistent requests through `hub model` require a fresh interactive confirmation every time. Project model configuration is ignored and cannot be written before project trust is active.
+
+## Workspaces and permissions
+
+`workspace:auto` keeps disjoint known scopes shared and isolates known path overlap. Shared resources such as ports/databases cannot be isolated by a Git worktree and therefore conflict visibly. An undeclared scope defaults to shared with a best-effort diagnostic; observable second conflicting writes are blocked with isolated-retry guidance.
+
+Isolation projects the current dirty tracked/untracked baseline into a disposable worktree, returns child-only patch/branch evidence, never auto-merges, and checks that the main workspace stayed unchanged. After cleanup, history/output remain readable but that Agent cannot revive.
+
+Effective tools are always an intersection of parent-active tools, child-loadable definitions, role/capability ceilings, hard guards, and per-call narrowing. Child `task`/`hub` definitions are AILI-owned bridges, never reused parent coordinator definitions. In sandbox-required permission modes, child Bash reuses the parent-initialized `pi-permission-modes` SandboxManager with a child-cwd-specific filesystem profile; missing/degraded sandbox state and incompatible Git-worktree metadata deny Bash instead of falling back unsandboxed. Credential/auth/private-key material is denied before approval and excluded from messages/output/artifacts. Background asks suspend only that job and return to the parent UI; no UI, rejection, cancellation, shutdown, or bridge loss denies and settles the request.
+
+## Legacy data
+
+Legacy `.pi/agent/runs/`, existing Pi sessions, user configuration, and unrelated Agent sidecars are not migrated, reinterpreted, or deleted by the replacement runtime. Rollback preserves both legacy runs and new sidecars.

package/manifests/adapter-evidence.json

@@ -8,38 +8,71 @@
       "sourceRevision": "7eb35f357ad489f5841ee10dac1e44549c1bdb76",
       "verification": [
         "vitest run tests/integration/extension-load.test.ts",
-        "vitest run tests/unit/runtime.test.ts"
+        "vitest run tests/integration/persistent-agent-host-seams.test.ts"
       ],
       "artifacts": [
-        { "path": "package-lock.json", "sha256": "a9e5a3e4d1076b3179dd8cca5ef89f9fddc838e0acf9abcc1f42daf2a90ddafb" },
-        { "path": "tests/integration/extension-load.test.ts", "sha256": "f2fdceb965f55bc481acc6457eee5cac9499dac08e8c3d17ca60efd07f13e96c" },
-        { "path": "tests/unit/runtime.test.ts", "sha256": "9e99920e7e16529f109771d659f611c9fa580941a5dbf924b2d9d117dd3adeee" }
+        {
+          "path": "package-lock.json",
+          "sha256": "006a165d0b94cd75a0a8cfbcd54f588b5d87441699316fb128512748b5bfd857"
+        },
+        {
+          "path": "tests/integration/extension-load.test.ts",
+          "sha256": "f2fdceb965f55bc481acc6457eee5cac9499dac08e8c3d17ca60efd07f13e96c"
+        },
+        {
+          "path": "tests/integration/persistent-agent-host-seams.test.ts",
+          "sha256": "562ca1ce07e9d57861b48c210a8d10b1d8cbe3ffad7db6ac20ecb178f3beda36"
+        }
       ]
     },
     {
       "capability": "subagent.dispatch",
       "status": "adapted",
-      "owner": "src/runtime/subagents.ts",
+      "owner": "src/runtime/persistent-agents/production.ts",
       "sourceRevision": "7eb35f357ad489f5841ee10dac1e44549c1bdb76",
       "verification": [
         "npm run verify:roles",
-        "vitest run tests/unit/roles.test.ts tests/unit/subagents.test.ts",
-        "vitest run tests/integration/generic-subagent.test.ts tests/integration/generic-permission.test.ts",
-        "AILI_LIVE_GENERIC_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
-        "AILI_LIVE_CREDENTIAL_GUARD_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts"
+        "vitest run tests/unit/persistent-agent-task.test.ts tests/unit/persistent-agent-hub.test.ts tests/unit/persistent-agent-policy.test.ts",
+        "vitest run tests/integration/persistent-agent-runtime.test.ts tests/integration/package-runtime.test.ts",
+        "npm run test:doctor"
       ],
       "artifacts": [
-        { "path": "src/runtime/subagents.ts", "sha256": "9f09e0e8a380d026d82b0842f2c687da2f3529b43a7ef6d1a6aad47d71190d48" },
-        { "path": "src/runtime/child-guard.ts", "sha256": "9da3c1d80805fd76bbf7a7fd253dff44f0756439fdee039bd7d7fd30766329e1" },
-        { "path": "src/runtime/credential-guard.ts", "sha256": "01d76ff0a9a2a0a08a2d2e52b6ed050d925df5e5bea1e6194130e00bfe22cde3" },
-        { "path": "tests/unit/subagents.test.ts", "sha256": "16fc1fbd1759befeed03a2428294c28d662022622c61a6444e23b365dc7447aa" },
-        { "path": "tests/unit/child-guard.test.ts", "sha256": "b187d6d84cd0829ae5474e133b4df911a80b75b9e89622b8543a1c5894be4974" },
-        { "path": "tests/integration/generic-permission.test.ts", "sha256": "90cc4ee67098f671dddac495d5e2cd5dc2c50131297fd04f0d72a1ca44217f24" },
-        { "path": "tests/integration/generic-subagent.test.ts", "sha256": "a13f8564bdd1bd735f9313d2ad71511a47c939dd6351f2f460771cb48a7fc80b" },
-        { "path": "tests/unit/roles.test.ts", "sha256": "72b61af16ff66506aaaceac28c92d8b3756741e3c4df0544686b3d4940215b57" },
-        { "path": "scripts/sync-roles.ts", "sha256": "a4fd66c95d91ebd92f0b1c6164a84809c4b5a1bf1e185dbdd61af23688dd2d9c" },
-        { "path": "tests/integration/live-subagent.test.ts", "sha256": "b88750f74b203cdbdb9d0e453e16f720ff4d8e4591ca140e0a3c7e1d8428868c" },
-        { "path": "manifests/live-verification.json", "sha256": "f5c80dfb2fb989b43af3b7460510b0a546cc05f8ff9e671c3e9284384c33d95b" }
+        {
+          "path": "src/runtime/persistent-agents/production.ts",
+          "sha256": "312ac2a3cd32b298550caedc09d74d97d279ef9380a7e03ca32a424b70121ee1"
+        },
+        {
+          "path": "src/runtime/persistent-agents/runtime.ts",
+          "sha256": "fbf90c6c4ba573b64bca98e775aeb036ba8f28788e3919d0beebe52c36ef58de"
+        },
+        {
+          "path": "src/runtime/persistent-agents/storage.ts",
+          "sha256": "cb33384792ca375fab62bf8529407c4e16e0e952fe7a28d0f1022f26ab7589d7"
+        },
+        {
+          "path": "src/runtime/persistent-agents/permission.ts",
+          "sha256": "48b30508491bca7fcd04d82b30d9dde1423499c2f02c014074c3f030c7ebd8ba"
+        },
+        {
+          "path": "tests/unit/persistent-agent-task.test.ts",
+          "sha256": "2562ff539e9f1cf756c2097beb9de09b0c28f33088c0f18fdbb91c978a898c3f"
+        },
+        {
+          "path": "tests/unit/persistent-agent-hub.test.ts",
+          "sha256": "8d90b71b4db40822b566d1807212ea20ed30d0a85706ee058d869736ccd0d306"
+        },
+        {
+          "path": "tests/unit/persistent-agent-policy.test.ts",
+          "sha256": "1a397beeef79d4553461314020fc91655ff1bbc88d1f23b76c1391ab1e78b8f8"
+        },
+        {
+          "path": "tests/integration/persistent-agent-runtime.test.ts",
+          "sha256": "50c930a4b72e5697f0931f0fcd9ff1a17a22b8dcd8f7e3ad51c255b6e454a2f9"
+        },
+        {
+          "path": "tests/integration/package-runtime.test.ts",
+          "sha256": "bc3659d12c416343b1c3bafffd3365a77fb342e6b5ac5e4d3abd8aaf9d608eea"
+        }
       ]
     }
   ]

package/manifests/capabilities.json

@@ -6,7 +6,7 @@
     "pi-web-access",
     "pi-quota-status",
     "pi-permission-modes",
-    "@agwab/pi-subagent",
+    "aili-persistent-agents",
     "optional-pack:web-research",
     "optional-pack:browser-qa",
     "optional-pack:artifact-runtime"
@@ -34,8 +34,8 @@
     },
     {
       "id": "subagent.dispatch",
-      "provider": "@agwab/pi-subagent",
-      "adapterOwner": "aili generic wrapper over @agwab/pi-subagent@0.4.8 with mandatory credential guard",
+      "provider": "aili-persistent-agents",
+      "adapterOwner": "src/runtime/persistent-agents/production.ts (AILI-owned task/hub with parent-scoped Pi sessions)",
       "platforms": ["linux"],
       "class": "required",
       "risk": { "secret": "possible", "network": "provider-dependent", "sideEffect": "delegated" },

package/manifests/live-verification.json

@@ -1,40 +1,39 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "platform": "linux",
   "piVersion": "0.81.1",
-  "subagentVersion": "0.4.8",
+  "runtime": "aili-persistent-agents-v1",
   "status": "passed",
-  "approvedScope": "On 2026-07-24, the user authorized two bounded live probes after repository-local compatibility verification: an omitted-backend, agentless child restricted to reading package.json, and an explicit-headless credential guard child restricted to a disposable .env sentinel. Both probes used only their declared temporary artifact roots and completed without business-file changes.",
+  "approvedScope": "On 2026-07-25 the user authorized the local workspace provider probes, disposable external Git lifecycle test, release-only Persistent Agent worktree, positive child sandbox implementation/verification, version 0.1.10, commit, push to origin/main, and npm publication. Earlier @agwab/pi-subagent evidence is not reused.",
   "probes": [
     {
-      "id": "generic-subagent-fixtures",
-      "command": "npx vitest run tests/unit/subagents.test.ts tests/integration/generic-subagent.test.ts",
+      "id": "provider-turn",
       "status": "passed",
       "changedFiles": 0,
-      "backendRequest": "matrix",
-      "resolvedBackend": "headless"
+      "evidence": "artifacts/test-results/persistent-agent-framework/live-smoke-2026-07-25.json",
+      "reason": "Refreshed local-package runtime completed synchronous, persistent follow-up, and asynchronous official Pi AgentSession turns through openai-codex/gpt-5.6-sol."
     },
     {
-      "id": "generic-agentless-default-path",
-      "command": "AILI_LIVE_GENERIC_SUBAGENT_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
+      "id": "child-sandbox",
       "status": "passed",
       "changedFiles": 0,
-      "backendRequest": "omitted",
-      "resolvedBackend": "headless"
+      "reason": "The child Bash definition reused the parent-initialized pi-permission-modes SandboxManager with a child-cwd-specific profile. A Bubblewrap live fixture allowed an in-scope write and denied both an out-of-scope write and a configured denyRead path; unavailable/worktree-incompatible executors remain fail closed.",
+      "verification": "AILI_RUN_CHILD_SANDBOX_LIVE=1 npx vitest run tests/integration/persistent-agent-live-gated.test.ts"
     },
     {
-      "id": "generic-credential-guard-explicit-headless",
-      "command": "AILI_LIVE_CREDENTIAL_GUARD_PROBE=1 npx vitest run tests/integration/live-subagent.test.ts",
+      "id": "external-workspace-lifecycle",
       "status": "passed",
       "changedFiles": 0,
-      "backendRequest": "explicit-headless",
-      "resolvedBackend": "headless"
+      "evidence": "artifacts/test-results/persistent-agent-framework/live-smoke-2026-07-25.json",
+      "reason": "An authorized disposable OS-temp Git repository passed dirty-baseline projection, isolated branch/worktree, child-only patch, unchanged main HEAD/status, cleanup, and no-revive assertions."
     }
   ],
   "implementation": {
-    "src/runtime/subagents.ts": "9f09e0e8a380d026d82b0842f2c687da2f3529b43a7ef6d1a6aad47d71190d48",
-    "tests/unit/subagents.test.ts": "16fc1fbd1759befeed03a2428294c28d662022622c61a6444e23b365dc7447aa",
-    "tests/integration/live-subagent.test.ts": "b88750f74b203cdbdb9d0e453e16f720ff4d8e4591ca140e0a3c7e1d8428868c"
+    "src/runtime/persistent-agents/production.ts": "312ac2a3cd32b298550caedc09d74d97d279ef9380a7e03ca32a424b70121ee1",
+    "src/runtime/persistent-agents/runtime.ts": "fbf90c6c4ba573b64bca98e775aeb036ba8f28788e3919d0beebe52c36ef58de",
+    "src/runtime/persistent-agents/sandbox.ts": "8385b3f0ee85e29f52d294fc8c458157041fe93ac367a0b7af0cf44a845063ed",
+    "src/runtime/persistent-agents/permission.ts": "48b30508491bca7fcd04d82b30d9dde1423499c2f02c014074c3f030c7ebd8ba",
+    "src/runtime/persistent-agents/workspace.ts": "a39438c52708f0104ee9cb11d7fa4dcf8fe72db548decb2cc3f96995f94fa475"
   },
-  "credentialHandling": "The explicit-headless credential guard probe used only a disposable .env sentinel. It completed with changedFiles=0; the sentinel was absent from the model-visible result and every temporary artifact before cleanup."
+  "credentialHandling": "Deterministic permission/output/history tests enforce fail-closed credential denial and redaction. The live provider probe consumed existing Pi authentication through the official child AgentSession; no credential values were read, exported, or copied into the sanitized evidence artifact."
 }

package/manifests/provenance.json

@@ -21,18 +21,6 @@
       ],
       "verification": ["npm run verify:skills", "npm run verify:roles", "tests/unit/global-resources.test.ts"]
     },
-    {
-      "name": "@agwab/pi-subagent",
-      "repository": "https://github.com/AgwaB/pi-subagent.git",
-      "revision": "daa7b83819116a62008ad17aa65fcd50fefbafd0",
-      "version": "0.4.8",
-      "license": "MIT",
-      "status": "dependency",
-      "sourceFiles": ["src/index.ts", "src/api.ts", "src/runners/headless-model.ts", "src/artifacts/result.ts"],
-      "symbols": ["subagent tool renderCall", "runSubagent API", "headless lifecycle", "artifact envelope"],
-      "localChanges": ["AILI registers the full pinned upstream subagent tool schema, prepends a sanitized bounded requested-Agent heading, injects a non-removable credential guard, normalizes ordinary omitted/auto runs to headless for the Pi 0.81.1 compatibility window, and rejects explicit inline before model startup; no upstream source is copied"],
-      "verification": ["tests/unit/subagents.test.ts", "tests/integration/generic-subagent.test.ts", "tests/integration/live-subagent.test.ts", "tests/integration/package-runtime.test.ts"]
-    },
     {
       "name": "pi-permission-modes",
       "repository": "https://github.com/wynainfo/pi-permission-modes.git",
@@ -115,6 +103,18 @@
       "symbols": ["header", "matrix animation", "Zentui footer", "fixed editor compositor"],
       "localChanges": ["registered as three additional Pi Package Extensions", "Rose header loads a package-owned renamed artwork asset without changing upstream identity", "Rose Shimmer, Rose Code Rain, and Zentui use the Rose-owned palette and gradient", "overflowing Matrix tracks remain deterministic across the complete terminal width with the 96-track budget, while each rain row receives a structural blank-row repair", "relative import specifiers and session lifecycle event are adapted for this package's NodeNext TypeScript contract"],
       "verification": ["tests/unit/matrix.test.ts", "tests/unit/zentui-gradient.test.ts", "npm run typecheck", "npm test", "npm pack --dry-run --json"]
+    },
+    {
+      "name": "Oh My Pi reference",
+      "repository": "https://github.com/can1357/oh-my-pi.git",
+      "revision": "59619623e1eeb7c290649eeaf3a269284ce8adef",
+      "version": "17.1.3",
+      "license": "MIT",
+      "status": "reference-only",
+      "sourceFiles": [],
+      "symbols": [],
+      "localChanges": [],
+      "verification": ["tests/integration/persistent-agent-runtime.test.ts", "tests/unit/persistent-agent-output-delivery.test.ts", "manual no-copy provenance inspection"]
     }
   ]
 }