delegation-layer 0.1.6 → 0.1.8

package/README.md

@@ -115,7 +115,11 @@ stopped. An explicit `--pueue-config` or
 `DELEGATE_PUEUE_CONFIG` can still select an existing compatible supervisor for
 advanced integrations. Node.js 18 or newer is needed only for the npm-based
 installers; it is not a runtime requirement for the released Go CLI. Provider
-authentication remains native to each provider.
+authentication remains native to each provider. Your provider settings, MCP
+servers, plugins, and skills stay with that provider. Permission modes select
+native behavior; Delegation Layer is not an independent sandbox. Authorized
+`workspace-write` tasks run unattended using native approval behavior, including
+Pi file edits and shell commands. Native access can extend beyond the workspace.
 
 ## Try one bounded task
 
@@ -138,8 +142,8 @@ The response contains a task ID and separate admission, liveness, and
 publication fields. Observe and collect it with:
 
 ```sh
-delegate status TASK_ID --json
-delegate collect TASK_ID --watch 5s --json
+delegate --root "$HOME/delegation-state" status TASK_ID --json
+delegate --root "$HOME/delegation-state" collect TASK_ID --watch 5s --json
 ```
 
 Use `delegate providers --json` for the compiled provider catalog and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "delegation-layer",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Multi-provider AI agent delegation CLI and Agent Skill for running bounded coding tasks across provider CLIs.",
   "keywords": [
     "ai-agents",

package/skills/agent-integration/SKILL.md

@@ -16,7 +16,7 @@ inspect, authenticate, or install a provider CLI directly.
 2. Use `dispatch --auto` unless the user explicitly selected a provider ID.
    Provider selection, executable checks, compatibility checks, authentication
    gates, and supervisor admission belong inside Delegation Layer.
-3. Give every turn an absolute workspace, a separate state root, a finite
+3. Give every turn an absolute workspace, a separate state root, an explicit
    permission mode, and a finite budget.
 4. Use `--json` and save the returned `task_id`. Read `admission`, `liveness`,
    `publication`, `status`, `outcome`, `continuation`, and `error` as separate
@@ -31,6 +31,10 @@ inspect, authenticate, or install a provider CLI directly.
    successful, or failed provider behavior, and do not invent login commands.
 8. Never put credentials, tokens, or unrestricted provider output in a brief,
    option, receipt, or agent message.
+9. Permission modes select provider-native behavior, not an independent sandbox.
+   Providers load their own configuration and extensions. If a task is rejected,
+   report delegate's evidence; do not assume the user's configuration is faulty
+   or remove MCP servers, plugins, settings, or credentials to make it pass.
 
 ## Operating procedure
 
@@ -42,8 +46,9 @@ Run a quick local check:
 command -v delegate && delegate --version
 ```
 
-If this fails, tell the caller that Delegation Layer is not installed and
-stop. Do not substitute a provider command.
+If discovery fails, report that Delegation Layer is missing. If the version
+command fails, report that the installed CLI is unusable. Stop in either case.
+Do not substitute a provider command.
 
 ### 2. Discover only when useful
 
@@ -59,11 +64,14 @@ ready. If the caller named one provider ID and wants a side-effect-free check,
 run:
 
 ```sh
-delegate preflight --provider PROVIDER_ID --cwd ABSOLUTE_WORKSPACE --json
+delegate preflight --provider PROVIDER_ID --cwd ABSOLUTE_WORKSPACE \
+  --permission REQUESTED_MODE --json
 ```
 
-Preflight reports static admission only. It does not create a task, start the
-supervisor, or launch a provider. Do not keep retrying preflight when it says
+Replace `REQUESTED_MODE` with `read-only` for investigation or
+`workspace-write` for authorized edits. Preflight reports static admission only.
+It does not create a task, start the supervisor, or launch a provider. Do not keep
+retrying preflight when it says
 `blocked` or `unsupported`; report the bounded reason.
 
 ### 3. Prepare separate paths and a finite brief
@@ -73,7 +81,7 @@ brief file that contains the requested work and its acceptance criteria. Keep
 the state root outside the workspace:
 
 ```sh
-STATE_ROOT="${DELEGATE_ROOT:-$HOME/.local/state/delegation-layer}"
+STATE_ROOT="${DELEGATE_ROOT:-$HOME/delegation-state}"
 WORKSPACE="$PWD"
 BRIEF="$(mktemp)"
 cat >"$BRIEF" <<'EOF'
@@ -83,11 +91,17 @@ EOF
 ```
 
 Replace the example brief with the actual user request. Do not place the state
-root inside the workspace or place secrets in either path’s task data.
+root inside the workspace or place secrets in either path’s task data. Keep it
+outside provider configuration and runtime directories as well. If delegate
+rejects placement before admission, choose a separate state directory; do not
+change provider settings. Once admitted, retain that state root for every
+observation and continuation.
 
 ### 4. Dispatch one bounded turn
 
-Use automatic selection unless the user explicitly supplied `PROVIDER_ID`:
+Use automatic selection unless the user explicitly supplied `PROVIDER_ID`.
+For a named provider, replace `--auto` with `--provider PROVIDER_ID`; never
+combine the two:
 
 ```sh
 delegate --root "$STATE_ROOT" dispatch --auto \
@@ -98,8 +112,11 @@ delegate --root "$STATE_ROOT" dispatch --auto \
   --json
 ```
 
-For an authorized code change, use `--permission workspace-write`. Keep the
-budget finite. A successful dispatch means the request was durably admitted;
+For an authorized code change, use `--permission workspace-write`; this requests
+unattended native tool execution, including shell commands and file edits.
+The provider may allow access beyond the selected workspace. Delegate supplies
+the native approval options; do not add provider flags or call its CLI yourself.
+Keep the budget finite. A successful dispatch means the request was durably admitted;
 it does not mean the delegated work finished.
 
 Save the exact `task_id` from the JSON response. If dispatch returns an error,
@@ -117,8 +134,10 @@ delegate --root "$STATE_ROOT" status TASK_ID --json
 delegate --root "$STATE_ROOT" collect TASK_ID --watch 5s --json
 ```
 
-If `collect` exits with code `3` because publication is still pending, wait a
-short interval and run `collect` again. Do not dispatch again. Continue until
+Check `status` first: if it is `timed_out`, follow step 6 even when publication
+is pending and no outcome is present. Otherwise, if `collect` exits with code
+`3` because publication is still pending, wait a short interval and run
+`collect` again. Do not dispatch again. Continue until
 the response has a terminal `outcome` or a bounded operational error that
 requires the caller’s attention.
 
@@ -156,8 +175,10 @@ delegate --root "$STATE_ROOT" continue \
   --json
 ```
 
-The command preserves the exact provider session and creates a new task ID.
-Observe and collect the successor by repeating step 5. If `resumable` is
+The command preserves the exact provider session and permission mode and
+creates a new task ID. Do not add `--permission` to `continue`. Always include
+the original `--root`, even if a returned command hint omits it. Observe and
+collect the successor by repeating step 5. If `resumable` is
 false, report the reason and stop; a fresh dispatch would lose the original
 conversation and is not an equivalent recovery.
 
@@ -176,7 +197,8 @@ The adapter’s required flags and runtime behavior decide compatibility.
 
 Authentication is a separate live gate. `live_acceptance.status` values are
 `not_run`, `passed`, or `blocked`; a blocked authentication prerequisite is
-neutral evidence and must not be relabeled.
+neutral evidence and must not be relabeled. Report the missing authentication
+prerequisite and stop that attempt; do not retry or authenticate the provider.
 
 The task response separates:
 

package/skills/agent-integration/evals/evals.json

@@ -26,6 +26,26 @@
       "name": "provider-neutrality",
       "prompt": "Use the skill without a provider name.",
       "expected": ["delegate only", "dispatch --auto", "no direct provider CLI"]
+    },
+    {
+      "name": "pi-write",
+      "prompt": "Use pi:json through delegate to update a file and run its tests. Edits are authorized.",
+      "expected": ["--provider pi:json", "--permission workspace-write", "delegate only", "save task_id", "collect validated evidence"]
+    },
+    {
+      "name": "write-permission-denial",
+      "prompt": "An admitted workspace-write task reports a native tool permission denial.",
+      "expected": ["report task evidence", "do not edit provider configuration", "do not call provider CLI", "no automatic redispatch"]
+    },
+    {
+      "name": "unavailable-provider",
+      "prompt": "The selected provider is unavailable before admission.",
+      "expected": ["report bounded reason", "do not install or authenticate provider", "do not claim success"]
+    },
+    {
+      "name": "write-timeout",
+      "prompt": "An authorized write task has status timed_out, publication unknown, no outcome, and continuation.resumable true.",
+      "expected": ["delegate continue --task", "same state root", "new task id", "do not wait indefinitely for an outcome", "no fresh unrelated dispatch"]
     }
   ]
 }

package/skills/agent-integration/examples/read-only-task.md

@@ -1,7 +1,7 @@
 # Read-only task
 
 ```sh
-STATE_ROOT="${DELEGATE_ROOT:-$HOME/.local/state/delegation-layer}"
+STATE_ROOT="${DELEGATE_ROOT:-$HOME/delegation-state}"
 BRIEF="$(mktemp)"
 printf '%s\n' 'Inspect the workspace and summarize the current test failures. Do not edit files.' >"$BRIEF"
 delegate --root "$STATE_ROOT" dispatch --auto \

package/skills/agent-integration/examples/workspace-write-task.md

@@ -1,12 +1,14 @@
 # Authorized workspace write task
 
 ```sh
-STATE_ROOT="${DELEGATE_ROOT:-$HOME/.local/state/delegation-layer}"
+STATE_ROOT="${DELEGATE_ROOT:-$HOME/delegation-state}"
 delegate --root "$STATE_ROOT" dispatch --auto \
   --brief "$PWD/delegated-task.md" --cwd "$PWD" \
   --permission workspace-write --budget 30m --json
 ```
 
 Use `workspace-write` only when the caller authorized edits in the selected
-workspace. The CLI still owns provider selection, policy, admission, and
-publication.
+workspace. Delegate requests unattended native approval for commands and edits.
+The provider owns its tools and access restrictions; the workspace is not an
+independent sandbox. Save the returned task ID, then use the same state root
+with `status` and `collect`; do not run the provider directly after a denial.

package/skills/agent-integration/references/command-reference.md

@@ -24,7 +24,7 @@ Dispatch flags:
 
 - `--brief FILE`: bounded task instructions;
 - `--cwd ABS`: workspace for the delegated turn;
-- `--permission read-only|workspace-write`: requested containment;
+- `--permission read-only|workspace-write`: read-only investigation or authorized unattended write execution, including commands (not independent containment);
 - `--budget DURATION`: finite turn budget;
 - `--auto`: let the CLI select a ready provider;
 - `--provider ID`: use only when the caller explicitly selected an ID;

package/skills/agent-integration/references/continuation.md

@@ -24,6 +24,10 @@ delegate --root "$STATE_ROOT" continue \
   --json
 ```
 
+A timed-out turn can have `publication: "unknown"` and no `outcome` while
+`continuation.resumable` is true. Use that continuation decision; do not wait
+indefinitely for a publication that the interrupted turn cannot complete.
+
 The follow-up brief is optional. If it is omitted, Delegation Layer reuses the
 validated predecessor brief. A successful continuation returns a new task ID
 and links it to the predecessor. Observe and collect the new ID separately.

package/skills/agent-integration/references/result-handling.md

@@ -4,16 +4,19 @@ Use the response fields independently. A successful control command is not
 the same as a successful provider result.
 
 1. Save `task_id` immediately after dispatch or continue.
-2. If `admission` is not admitted, report the bounded `error` and do not claim
-   that provider work ran.
-3. If `liveness` is queued or running, call `status` or `collect` again with a
-   finite watch interval.
+2. If a dispatch or continue response does not confirm admission, preserve any
+   task ID and report its bounded error. An uncertain admission must be
+   inspected, never automatically dispatched again. Status and collect can
+   report `admission: "unknown"` alongside valid terminal evidence.
+3. If `status` is `timed_out`, follow the continuation procedure before treating
+   pending publication as a reason to wait. `continuation.resumable: true`
+   permits a linked successor even when no outcome has been published.
 4. If `publication` is committed and `outcome.verdict` is committed, return
    the result and its payload/evidence descriptors.
 5. If `outcome.verdict` is rejected, report a terminal rejected result with its
    refusal and evidence. Do not retry automatically.
-6. If `status` is `timed_out`, follow the continuation procedure. A timeout is
-   recoverable only when `continuation.resumable` is true.
+6. Otherwise, if `liveness` is queued or running or publication is pending,
+   observe the same task again with a finite watch interval.
 7. If authentication is `blocked`, preserve that neutral state and tell the
    caller what prerequisite is unavailable without inventing a login command.
 8. If a command reports an operational uncertainty, inspect the original task