pi-daddy 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -12,86 +12,79 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
-## 0.14.0 — `pi-daddy init`, and a startup line that names what it will and will not spawn
-
-> **Reviewed before release by five independent agents, one hypothesis each. All five found something, and
-> nine defects were fixed here** — including one that executed arbitrary code from the file this feature
-> tells you to commit (R-78), one that overwrote an operator's file and wrote through symlinks (R-79), and
-> one where the startup line blamed your `SKILL.md` files for a misconfigured environment variable (R-81).
-> **ADR-0029 came out of that review**: the generated grant is read-only by default. The reasoning for each
-> is in `docs/03-risks.md` R-78 through R-82.
-
-The pi-daddy half of making this package and a package of skills work together out of the box
-(`docs/HANDOFF-principal-pi-skills-integration.md`, items B1/B2/B4; **ADR-0028**). Nothing about grant
-resolution, enforcement, approvals or the ledger changed — this is the part before and around them.
-
-- **The generated grant is READ-ONLY by default** (ADR-0029). `init` grants what the copied skills declare
-  minus anything that can change your machine — `bash`, `write`, `edit` and the universal capabilities are
-  written **commented**, naming the definitions that need them. `init` + `source` gives a working read-only
-  setup; widening costs one deliberate uncomment. The reason: `PI_GRANTS_GRANT` is what *bounds* a declared
-  ceiling, so generating it from those ceilings would give the bound and the bounded one author, and it
-  would not be you.
-
-- **`npx pi-daddy init` scaffolds a governed project.** It reads `<cwd>/node_modules` for packages declaring
-  skills in their own `package.json` (`"pi": {"skills": [...]}`, pi's convention), copies each declared
-  `SKILL.md` into `.pi/skills/`, and writes an annotated `.pi/grants.env`. That replaces, per skill: make a
-  directory, copy the body, hand-write frontmatter, choose a capability set with no guidance, and assemble a
-  `PI_GRANTS_GRANT` string by hand — seven times for `principal-pi-skills`.
-
-  **It chooses no ceiling, and that boundary is the whole design.** A skill that declares `allowed-tools` is
-  copied byte for byte; one that declares none is copied with a *commented* placeholder and stays
-  unspawnable until a human fills it in. The placeholder is deliberately not a working example, so
-  uncommenting it unedited fails loudly instead of granting something nobody decided. An existing file is
-  **kept**, never overwritten — that edit is the capability decision, and a second `init` run is exactly
-  when it would be destroyed. `--force` exists and says what it costs.
-
-- **Session start says how many definitions are spawnable, and names the withheld ones.** The line reported
-  the grant and never the definitions, so *"governance is working"* and *"did the install fail?"* looked
-  identical:
-
-  ```
-  grants: 1 of 7 definitions spawnable — review
-    withheld: architect, build, … — need agent:architect, …, which this session does not hold
-  ```
-
-  Classified by the same planner a real spawn comes through (no human is asked, stored approvals count), and
-  it speaks even when **nothing** is spawnable — which is the state most worth being told about. It is an
-  upper bound: it runs before the tool surface is observed, and `/grants` is the settled answer.
-
-- **A worked `principal-pi-skills` example in the README**, replacing the invented one, with every line
-  produced by running the commands (`docs/probes/b2-init-principal-pi-skills`).
-
-- **Fixed before release: a skill's `allowed-tools` VALUE could execute code from the generated grant file**
-  (R-78). `ceilingForDefinition` passes `ext:`/`skill:`/`agent:` entries through as written — correct for
-  enforcement, where the catalog refuses what it does not know — so a package declaring
-  `allowed-tools: Read,ext:x";touch /tmp/pwned;PI_GRANTS_GRANT="` produced a `.pi/grants.env` that ran the
-  payload when sourced: silently, exit 0, with the variable left looking plausible. It survives
-  `--ignore-scripts` and travels in the file you commit. Declared ids are whitelisted now, `tool:*`/`agent:*`
-  from a package are refused, and the assembled grant is charset-checked before the file is written at all.
-
-- **Fixed before release: `init` overwrote an operator's file and wrote through symlinks** (R-79). The
-  presence probe was `readFile`, which treats *unreadable* as *absent* — so a permissions-restricted
-  `SKILL.md` was replaced and its ceiling **widened**, with no `--force`. And `writeFile` follows symlinks, so
-  a dangling link at a target path created the file outside the project while reporting an in-project path.
-  Both are one `open(path, "wx")`. `--force` no longer regenerates `.pi/grants.env`, and `pi-daddy init
-  --Force` is no longer accepted as a silent no-op.
-
-- **Fixed before release: the startup line blamed your files for a session-level refusal** (R-81). A session
-  at its depth limit, or with a malformed `PI_GRANTS_MAX_DEPTH`, was told its `SKILL.md` files were written
-  wrong — two lines above `/grants` saying "delegation is disabled (maxDepth 0)". A session with no
-  `tool:delegate`, which has no delegate tool at all, was told definitions were spawnable.
-
-- **Fixed before release: a skill's directory name could write a capability into the generated grant**
-  (R-77). A name is interpolated into a comma-separated `PI_GRANTS_GRANT`, into a file the operator sources,
-  and into a path. A package shipping a directory called `a,tool:bash` produced
-  `PI_GRANTS_GRANT="agent:a,tool:bash,…"` — `tool:bash` in an operator's grant, declared by no definition.
-  Names are now whitelisted at discovery and a refusal is printed with its reason.
-
-- **Fixed before release: `npx pi-daddy init` printed nothing and exited 0 for every installed copy** (R-73).
-  npm installs a bin as a symlink, so `process.argv[1]` is the link and the entry-point guard compared it
-  against the real file's URL. Caught by the smoke test, which now runs the installed bin — the same class of
-  defect as the `exports` map that worked in the tree and threw for every consumer, and the second time that
-  script has caught it.
+## 0.18.0 — generic runtime enforcement for external controllers
+
+- Optional correlation metadata joins capability decisions to run/task/workspace/context IDs, candidate
+  `tree_sha`, sequence floors and opaque policy metadata. Trusted task/definition/request/effective digests
+  are computed separately; supplied IDs and digests never grant authority.
+- Correlated gated approvals bind the exact definition, task, requested/effective capabilities,
+  workspace/context and parent. They do not inherit. Legacy calls without correlation keep their existing
+  approval behavior. Persisted approvals retain the 30-day expiry; `once` remains one-use. Concurrent exact
+  scopes never share a dialog or rebind one human answer to another task.
+- Operator-registered Git worktrees can be selected by ID. The child starts at the validated canonical root;
+  a kernel `flock` permits at most one pi-daddy-governed writer per canonical root. Caller `read` cannot
+  lower write-capable grants; parent death stops the attached process/herdr tab before recovery. This is
+  coordination, **not path confinement** and not exclusion of unrelated writers or detached bash children.
+- Stable refusal codes accompany existing human diagnostics.
+- `pi-daddy/check-runner` runs operator-named executable+argv definitions without shell interpolation,
+  with an environment allowlist, timeout/output bounds, privately staged exact executable bytes, and
+  pre/post-verified Git HEAD/candidate-tree receipts under an exclusive coordination lease. Arbitrary
+  executables remain arbitrary code; no filesystem/network sandbox is claimed.
+- **BREAKING — ledger format v2:** append-only capability, workspace-lease, child-lifecycle and
+  check-receipt events. The new reader accepts legacy grant lines. Three things a consumer must know, two of
+  which are compile-or-run breaks rather than advisories:
+  - External readers that assume every line is a grant record must **switch on `event`** first.
+  - `LedgerReport` (published via `pi-daddy/ledger`) gained **required** fields — `events`,
+    `workspaceLeases`, `lifecycle`. Any TypeScript consumer that constructs one, or handles it
+    exhaustively, breaks at compile time.
+  - `report.records` **changed meaning**: it counted every parsed line and now counts capability decisions
+    only, with lease/lifecycle/receipt lines going to `events`. A consumer reading it as "ledger lines"
+    silently gets a different number.
+  - A line carrying `ledgerVersion` is now **rejected as corrupt** unless it satisfies the full v2 field
+    set, which matters to anyone who hand-writes or re-emits ledger lines.
+- **BREAKING — `correlation` is a whitelist.** Only the pinned schema 1.0 field set is accepted; strings are
+  capped at 512 characters, `assurance_scope` at 4 KB, and an **undeclared key is refused by name** rather
+  than passed through. A caller sending extra fields must stop. This is a privacy control: `correlation` is
+  model-facing and copied verbatim onto every append-only event, so an unbounded object was a channel for
+  writing arbitrary text into a file that carries no prompts, arguments or results.
+- **BREAKING for direct API callers — `WorkspaceLease.release()` returns
+  `"released" | "released-unrecorded" | "lost"` and no longer throws**, and `recovered` is
+  `boolean | "unknown"`. `WorkspaceLeaseOutcome` gains `uncontended`, `released-unrecorded`, `lost` and
+  `retained`. Code that relied on `release()` rejecting must read the value instead.
+- **Fixes from a six-reviewer pass over this candidate before release.** The capability invariant held on
+  every path any reviewer could construct; these are the runtime half. `flock`'s command inherits the lock
+  file descriptor (measured — `docs/probes/g35-flock-fd-inheritance`), so teardown killing only the wrapper
+  stranded the lock and reported it to everyone else as a conflict. `recovered` could assert a crash after a
+  clean handover and hide a real one. The herdr close loop retried forever while holding the lock. A bound
+  approval could be spent outside the workspace it named, because two of its six identity components were
+  read from caller-supplied correlation. A refused delegation could leave a 30-day approval on disk. A child
+  could mint the upstream controller's `BLOCKED_CRITICAL_ASSURANCE` verdict out of a timeout. Fan-out
+  discarded every sibling error but the first. Five planner refusals and every execution-phase failure
+  carried no stable code. See `docs/03-risks.md` R-99…R-118 and the ADR-0034 amendment, which also lists
+  what the pass did **not** resolve.
+
+New public subpaths: `pi-daddy/correlation`, `pi-daddy/refusals`, `pi-daddy/workspace`, and
+`pi-daddy/check-runner`.
+
+## 0.17.1 — no functional change: the release that exists because a rule got enforced
+
+**Nothing in the shipped code changed.** This tarball differs from 0.17.0 in its version and in this file,
+and that is stated here rather than dressed up, because a changelog that implies behaviour changed is worse
+than a version nobody needed. `dist/`, `src/` and `extensions/` are byte-identical to 0.17.0.
+
+What happened is in the repository, not the package: working rule 10 — **`main` is only ever advanced by
+merging a pull request** — plus `hooks/pre-commit`, which refuses a commit on `main` and names a recovery that
+is never a force-push, and `test/branch-guard.test.ts`, which pins it against seven mutations of the hook
+(tests are not published, so that file is not in this tarball either).
+
+**Why a version at all**, since nothing here changed: rule 10 says version bumps take the same path as
+everything else, and this one did — branch, PR, review, squash-merge. The rule's first draft was reviewed by
+six independent agents across two rounds that found sixteen defects, including that *"never commit to `main`"*
+forbids the merge the rule requires, and that the guard written to fix that had reproduced the same defect in
+shell. `docs/03-risks.md` R-85 and the 2026-08-18 session-log entry hold the details.
+
+**Also fixed here:** this file claimed "Newest first" while 0.14.0 sat above 0.17.0, 0.16.0 and 0.15.0. The
+order is now what the sentence says it is.
 
 ## 0.17.0 — `delegate_chain`
 
@@ -244,6 +237,87 @@ pi
 - **`init` counted authorisations and called them declarations** — "7 skill(s), 3 declaring allowed-tools"
   when all seven declared.
 
+## 0.14.0 — `pi-daddy init`, and a startup line that names what it will and will not spawn
+
+> **Reviewed before release by five independent agents, one hypothesis each. All five found something, and
+> nine defects were fixed here** — including one that executed arbitrary code from the file this feature
+> tells you to commit (R-78), one that overwrote an operator's file and wrote through symlinks (R-79), and
+> one where the startup line blamed your `SKILL.md` files for a misconfigured environment variable (R-81).
+> **ADR-0029 came out of that review**: the generated grant is read-only by default. The reasoning for each
+> is in `docs/03-risks.md` R-78 through R-82.
+
+The pi-daddy half of making this package and a package of skills work together out of the box
+(`docs/HANDOFF-principal-pi-skills-integration.md`, items B1/B2/B4; **ADR-0028**). Nothing about grant
+resolution, enforcement, approvals or the ledger changed — this is the part before and around them.
+
+- **The generated grant is READ-ONLY by default** (ADR-0029). `init` grants what the copied skills declare
+  minus anything that can change your machine — `bash`, `write`, `edit` and the universal capabilities are
+  written **commented**, naming the definitions that need them. `init` + `source` gives a working read-only
+  setup; widening costs one deliberate uncomment. The reason: `PI_GRANTS_GRANT` is what *bounds* a declared
+  ceiling, so generating it from those ceilings would give the bound and the bounded one author, and it
+  would not be you.
+
+- **`npx pi-daddy init` scaffolds a governed project.** It reads `<cwd>/node_modules` for packages declaring
+  skills in their own `package.json` (`"pi": {"skills": [...]}`, pi's convention), copies each declared
+  `SKILL.md` into `.pi/skills/`, and writes an annotated `.pi/grants.env`. That replaces, per skill: make a
+  directory, copy the body, hand-write frontmatter, choose a capability set with no guidance, and assemble a
+  `PI_GRANTS_GRANT` string by hand — seven times for `principal-pi-skills`.
+
+  **It chooses no ceiling, and that boundary is the whole design.** A skill that declares `allowed-tools` is
+  copied byte for byte; one that declares none is copied with a *commented* placeholder and stays
+  unspawnable until a human fills it in. The placeholder is deliberately not a working example, so
+  uncommenting it unedited fails loudly instead of granting something nobody decided. An existing file is
+  **kept**, never overwritten — that edit is the capability decision, and a second `init` run is exactly
+  when it would be destroyed. `--force` exists and says what it costs.
+
+- **Session start says how many definitions are spawnable, and names the withheld ones.** The line reported
+  the grant and never the definitions, so *"governance is working"* and *"did the install fail?"* looked
+  identical:
+
+  ```
+  grants: 1 of 7 definitions spawnable — review
+    withheld: architect, build, … — need agent:architect, …, which this session does not hold
+  ```
+
+  Classified by the same planner a real spawn comes through (no human is asked, stored approvals count), and
+  it speaks even when **nothing** is spawnable — which is the state most worth being told about. It is an
+  upper bound: it runs before the tool surface is observed, and `/grants` is the settled answer.
+
+- **A worked `principal-pi-skills` example in the README**, replacing the invented one, with every line
+  produced by running the commands (`docs/probes/b2-init-principal-pi-skills`).
+
+- **Fixed before release: a skill's `allowed-tools` VALUE could execute code from the generated grant file**
+  (R-78). `ceilingForDefinition` passes `ext:`/`skill:`/`agent:` entries through as written — correct for
+  enforcement, where the catalog refuses what it does not know — so a package declaring
+  `allowed-tools: Read,ext:x";touch /tmp/pwned;PI_GRANTS_GRANT="` produced a `.pi/grants.env` that ran the
+  payload when sourced: silently, exit 0, with the variable left looking plausible. It survives
+  `--ignore-scripts` and travels in the file you commit. Declared ids are whitelisted now, `tool:*`/`agent:*`
+  from a package are refused, and the assembled grant is charset-checked before the file is written at all.
+
+- **Fixed before release: `init` overwrote an operator's file and wrote through symlinks** (R-79). The
+  presence probe was `readFile`, which treats *unreadable* as *absent* — so a permissions-restricted
+  `SKILL.md` was replaced and its ceiling **widened**, with no `--force`. And `writeFile` follows symlinks, so
+  a dangling link at a target path created the file outside the project while reporting an in-project path.
+  Both are one `open(path, "wx")`. `--force` no longer regenerates `.pi/grants.env`, and `pi-daddy init
+  --Force` is no longer accepted as a silent no-op.
+
+- **Fixed before release: the startup line blamed your files for a session-level refusal** (R-81). A session
+  at its depth limit, or with a malformed `PI_GRANTS_MAX_DEPTH`, was told its `SKILL.md` files were written
+  wrong — two lines above `/grants` saying "delegation is disabled (maxDepth 0)". A session with no
+  `tool:delegate`, which has no delegate tool at all, was told definitions were spawnable.
+
+- **Fixed before release: a skill's directory name could write a capability into the generated grant**
+  (R-77). A name is interpolated into a comma-separated `PI_GRANTS_GRANT`, into a file the operator sources,
+  and into a path. A package shipping a directory called `a,tool:bash` produced
+  `PI_GRANTS_GRANT="agent:a,tool:bash,…"` — `tool:bash` in an operator's grant, declared by no definition.
+  Names are now whitelisted at discovery and a refusal is printed with its reason.
+
+- **Fixed before release: `npx pi-daddy init` printed nothing and exited 0 for every installed copy** (R-73).
+  npm installs a bin as a symlink, so `process.argv[1]` is the link and the entry-point guard compared it
+  against the real file's URL. Caught by the smoke test, which now runs the installed bin — the same class of
+  defect as the `exports` map that worked in the tree and threw for every consumer, and the second time that
+  script has caught it.
+
 ## 0.13.0 — the approvals file gets the lock the ledger already had, and two silences end
 
 Closing the last items that were open rather than out of scope, then **red-teaming the result**: an

package/README.md

@@ -193,12 +193,13 @@ A chain's handoff is wrapped in a labelled, **nonce-delimited** fence, so the pr
 data — and because the nonce is minted after that agent finished, it cannot forge a closing delimiter to escape its
 own fence. The label itself is framing and this README will not pretend otherwise; the nonce is the mechanism.
 
-A chain is **gated upfront**: every step is planned first, and every approval it needs is asked for *before the
-first step starts* — together, rather than interrupting a running pipeline. One dialog per capability *and*
-definition, each naming the step that needs it, because an approval for one definition must never satisfy another.
-Decline any of them and nothing runs. A step that could never run refuses the chain **before** anyone is asked, and
-`Allow once` covers exactly one step. A failed step stops the rest, and you still get everything that
-completed. Each step spends one unit of the fan-out budget, so a seven-step pipeline wants `PI_GRANTS_FANOUT=12`.
+A legacy uncorrelated chain is **gated upfront**: every step is planned first, and every approval it needs is
+asked for before the first step starts. Exact correlated steps gate only after their composed task exists;
+binding a template and spending it on different generated instructions would be false assurance. One dialog
+per capability and definition names the step that needs it. Decline an upfront gate and nothing runs. A step
+that could never run refuses before anyone is asked; `Allow once` covers exactly the step it named. A failed
+step stops the rest, and you still get everything completed—except `BLOCKED_CRITICAL_ASSURANCE`, which
+remains a failed tool call. Each step spends one unit of the fan-out budget.
 
 ### Two executors, one plan
 
@@ -269,11 +270,10 @@ cannot make the next legitimate write destroy every other entry.
 
 **Other properties worth knowing:**
 
-- **An approval rides down the tree with the grant**, intersected with what each child actually receives at
-  every hop, so `approved ⊆ grant` holds at every level. An approval unblocks part of a grant; it can never
-  widen one. `once` is **dropped** on inheritance — the most conservative answer a human can give must not
-  produce the least conservative outcome — and the subject is **kept**, so a `<delegate>` approval no longer
-  matches any subject one hop down.
+- **Legacy session/always approvals ride down the tree with the grant**, intersected with what each child
+  actually receives, so `approved ⊆ grant` holds at every level. `once` is dropped. A correlated approval
+  instead binds the exact definition, task, requested/effective sets, workspace/context and parent, and
+  never crosses a delegation boundary — approval for one probe cannot become subtree authority.
 - **Concurrent callers share one dialog per `capability@subject`, but only share the *answer* when it was
   about more than one spawn.** `session`, `always`, a decline and an error answer everyone; **a `once` is
   consumed by exactly one caller** and the rest are asked their own question. Measured before the fix: four
@@ -320,6 +320,28 @@ Seven further tests in that file cost no model tokens and cover the reload and e
 transcripts in `docs/probes/approval-ux` describe an interceptor path that no longer exists — they are kept
 as the record of that run and are not a description of this version.
 
+## Runtime enforcement for external controllers (0.18.0)
+
+All fields are optional; existing callers behave unchanged.
+
+- `correlation` carries join-only run/task/workspace/context IDs, opaque policy metadata, base/head/tree SHAs
+  and sequence floors. Supplied IDs/digests never authorize; trusted digests are computed separately.
+- `workspace: {workspace_id, access}` resolves through `PI_GRANTS_WORKSPACE_REGISTRY`, validates a canonical
+  Git worktree root, and sets initial CWD. A caller cannot label a write-capable grant read-only. Kernel
+  util-linux `flock` allows one **pi-daddy-governed** writer per canonical root; `setpriv --pdeathsig` plus
+  helper attachment stops the writer process or herdr tab on parent death before release. This does not confine paths or exclude unrelated writers; `bash` remains an escape.
+- Refusals retain current prose and add stable codes such as `CAPABILITY_ESCALATION`,
+  `GATED_UNAPPROVED`, `APPROVAL_SCOPE_MISMATCH`, and `WORKSPACE_WRITE_CONFLICT`.
+- Ledger v2 adds joinable capability, lease, lifecycle and check-receipt events while reading legacy lines.
+- `pi-daddy/check-runner` selects an operator-named absolute executable+argv definition, never a shell
+  command string. It strips sensitive inherited environment, enforces timeout/output caps, executes a
+  private copy of the exact executable bytes it hashed, and pre/post-verifies Git head/candidate-tree
+  identity under an exclusive coordination lease. The executable remains arbitrary code; no filesystem or
+  network sandbox is claimed.
+
+Public subpaths: `pi-daddy/correlation`, `pi-daddy/refusals`, `pi-daddy/workspace`,
+`pi-daddy/check-runner`.
+
 ## Running it
 
 ```bash
@@ -485,8 +507,10 @@ everything below it.
 | `PI_GRANTS_APPROVED` | unset | Inherited `capability@subject#sha256` entries; set by the parent, clamped to the child's own grant, and honoured only against the definition body the child itself loaded (ADR-0022). |
 | `PI_GRANTS_APPROVAL_TIMEOUT` | `120` (seconds) | How long a dialog waits. `0` or an unreadable value means **no timeout**: waiting forever denies nothing, so it is the safe reading of a value we do not understand. |
 | `PI_GRANTS_LEDGER` | unset → not recording | **Setting this makes the ledger load-bearing** — see below. |
+| `PI_GRANTS_WORKSPACE_REGISTRY` | unset | Operator-owned `{version:1, workspaces:{id:{path}}}` file, required only for workspace-routed spawns. |
+| `PI_GRANTS_WORKSPACE_LEASE_DIR` | under `$PI_CODING_AGENT_DIR/pi-daddy/` | Kernel writer locks and ownership metadata. |
 | `PI_GRANTS_CHILD_TIMEOUT` | `600` (seconds) | Wall-clock limit for a child. Inherited by descendants — an operator preference, deliberately *not* attenuating state. |
-| `PI_GRANTS_FANOUT` | `8` | **Subtree budget**: total descendants this session may create. Attenuates downward like depth. Malformed or `0` falls back to the default — a bound a typo can switch off is not a bound. |
+| `PI_GRANTS_FANOUT` | `8` | Per-call width and downward subtree budget; not a session-total counter. Malformed or `0` falls back to the default. |
 | `PI_GRANTS_PARENT_ID` | `d0` | This session's ledger id; set by the parent. Makes sibling records joinable into a tree. |
 | `PI_GRANTS_HERDR` | unset ⇒ **probe** | Three-state. Unset probes for a reachable herdr and uses panes if one answers; `1` demands panes and refuses every delegation if herdr is unreachable; `0` demands captured subprocesses. Never detected from `herdr` merely being on `PATH`. |
 | `PI_GRANTS_HERDR_WORKSPACE` | the parent's `HERDR_WORKSPACE_ID` | herdr workspace for spawned panes. Defaults to the workspace this session is in, so a child is a tab away rather than a workspace away. |
@@ -508,7 +532,10 @@ is broken after 10s.
 
 ## The ledger
 
-Append-only JSONL. One record per governed decision, **including refusals**, which are the interesting ones.
+Append-only JSONL. Version 2 records capability decisions plus workspace-lease, child-lifecycle and
+check-receipt events. Every per-child capability decision is present, **including refusals**; call-level
+schema/cardinality rejections that create no child ID are not capability events. The reader still accepts
+legacy grant-only lines.
 
 Ids are hierarchical and derived: a child of `d0` is `d0.1`, its own second child `d0.1.2`. Ancestry reads
 from the id alone with no join, and it is reproducible, so two runs of the same fan-out produce a diffable
@@ -516,9 +543,10 @@ ledger. `denied` non-empty is the one designated escalation signal — **an agen
 hold is an escalation attempt, and it is invisible without a record.**
 
 **Privacy is a property of this file, and the boundary is exact: capability ids, counts and identifiers only
-— never prompts, tool arguments or results.** The `definitionDigest` is on the identifier side of that line:
-it names a version of operator-authored text already committed to a repository. The **task** is on the other
-side and is never recorded, in any field.
+— never prompts, task text, tool arguments or results.** Trusted `definitionDigest` and `taskDigest` values
+identify the exact operator body and task. A predictable task can be guessed from SHA-256, so its digest is
+sensitive/linkable metadata, not anonymization. Caller-supplied digest-looking values remain under
+`correlation` and never authorize.
 
 ## Propagation is race-free by construction
 
@@ -655,12 +683,12 @@ every in-repo test passed. `npm run test:smoke` packs a tarball, installs it int
 ## Testing
 
 ```bash
-npm test                   # 353 unit tests. Fast, pure, no pi, no network.
+npm test                   # 587 unit tests. Fast, pure, no pi, no network.
 npm run typecheck          # src + extensions + tests + integration tests
-npm run test:integration   # 28 tests against a REAL pi process. ~40s, no model tokens.
+npm run test:integration   # 44 tests against a REAL pi process. ~55s, no model tokens.
 npm run test:smoke         # pack, install into a scratch project, import and use it — and run the
                            # installed `pi-daddy init` bin, which is how R-73 was found
-PI_GRANTS_IT_MODEL=1 npm run test:integration   # + 4 end-to-end tests with a real model. ~60s, costs money.
+PI_GRANTS_IT_MODEL=1 npm run test:integration   # + 10 end-to-end tests with a real model. Costs money.
 ```
 
 The resolver is a pure function, which is deliberate: it is the only place an escalation could be
@@ -685,15 +713,16 @@ its own author the day after it was added: rather than raise the cap, `delegatio
 
 ## Status
 
-**0.14.0 — usable, and honest about scope.** What exists and is verified against real pi: the resolver, the
-ledger with an integrity reader, the spawn planner, `SKILL.md` definitions with `allowed-tools` as an
-enforced ceiling, `delegate` and `delegate_all` with a subtree budget, two executors, and human approval for
-gated capabilities (once / session / always, inheritable down the tree, persisted for `always` and pinned to
-both the tools and the instructions).
+**0.18.0 — generic runtime enforcement, still honest about scope.** The governed spawn path now includes
+optional correlation, exact task-bound approvals, registered-worktree CWD validation, OS-backed governed
+writer leases, structured refusals, lifecycle/lease ledger events, and a no-shell named-check subpath. All
+new spawn fields are optional; legacy callers retain their behavior.
 
 Known gaps, stated because a gap nobody wrote down is the one that surprises somebody:
 
-- **`bash` escapes governance.** Out of scope by decision (ADR-0012).
+- **`bash` escapes governance.** Out of scope by decision (ADR-0012); workspace routing and leases do not contain it.
+- **A workspace lease coordinates only pi-daddy-governed writers.** It is not a filesystem sandbox and cannot stop unrelated processes. The measured writer path currently requires util-linux `flock`.
+- **A named check is arbitrary code without shell interpolation.** It may write, use the network, invoke a shell or leave descendants; no OS containment is claimed.
 - **`subagents:rpc:spawn` bypasses the tripwire.** Unfixable from here.
 - **The ledger is verified at session start** when one is configured: a damaged trail announces itself, an intact one stays quiet.
 - **A pane outlives its tool call only if its child settled.** A child that answered keeps its pane so you can

package/dist/approval-prompt.d.ts

@@ -26,8 +26,10 @@ export interface PromptRequest {
     /** Agent type name, or `DELEGATE_SUBJECT` on the delegate path. */
     subject: string;
     path: ApprovalPath;
-    /** Shown to the human for context. Never part of a key. */
+    /** Shown to the human for context. Never itself part of a key. */
     task?: string;
+    /** Trusted exact-scope identity; bound requests single-flight only with an identical binding. */
+    bindingKey?: string;
     signal?: AbortSignal;
 }
 /**

package/dist/approval-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-prompt.d.ts","sourceRoot":"","sources":["../src/approval-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAA8B,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAClG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAChD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,eAAO,MAAM,UAAU,SAAS,CAAC;AAEjC,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAItD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC;AAEzF,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,iBAAiB,CAAC;IACxB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,UAAU,CAAC;IACf,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzD;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK5E;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,IAAI,CAAC,OAAO,EAAE,mBAAmB,KAAK,YAAY,CAG3F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,GAAE,iBAA6B,GACtC,YAAY,CAwEd"}
+{"version":3,"file":"approval-prompt.d.ts","sourceRoot":"","sources":["../src/approval-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAA8B,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAClG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAChD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,eAAO,MAAM,UAAU,SAAS,CAAC;AAEjC,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAItD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC;AAEzF,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,iBAAiB,CAAC;IACxB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,UAAU,CAAC;IACf,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzD;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK5E;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,IAAI,CAAC,OAAO,EAAE,mBAAmB,KAAK,YAAY,CAG3F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,GAAE,iBAA6B,GACtC,YAAY,CAwEd"}

package/dist/approval-prompt.js

@@ -95,7 +95,7 @@ export function createApprovalGate(options, inFlight = new Map()) {
                         `(mode: ${options.mode}). Pre-approve it in an interactive session, or drop it from the request.`,
                 };
             }
-            const key = approvalKey(request.capability, request.subject);
+            const key = `${approvalKey(request.capability, request.subject)}${request.bindingKey ? `#${request.bindingKey}` : ""}`;
             // R-29. Join an in-flight dialog, but only *keep* its answer if that answer was about more than one
             // spawn. A `once` belongs to whichever caller the human was actually looking at — the title shows
             // that caller's task — so anyone else who joined must ask their own question rather than ride a yes

package/dist/approval-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-prompt.js","sourceRoot":"","sources":["../src/approval-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAyC,MAAM,eAAe,CAAC;AAalG,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,wBAAwB;IACjC,MAAM,EAAE,wCAAwC;CACjD,CAAC;AAsDF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,OAAO,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,MAAuB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAuBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,QAAQ,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC9C,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA4B,EAC5B,WAA8B,IAAI,GAAG,EAAE;IAEvC,MAAM,GAAG,GAAG,KAAK,EAAE,OAAsB,EAA0B,EAAE;QACnE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,GACT,mBAAmB,OAAO,CAAC,UAAU,QAAQ,OAAO,CAAC,OAAO,GAAG;YAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAEpD,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC3F,OAAO,EAAE,OAAO,CAAC,SAAS;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4FAA4F;YAC5F,gEAAgE;YAChE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACtG,CAAC;QAED,gGAAgG;QAChG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,OAAO,CAAC,UAAU,gBAAgB,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,wBAAwB,EAAE,CAAC;QAClG,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3G,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAsB;YAClC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,gGAAgG;gBAChG,oEAAoE;gBACpE,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,IAAI,EAAE,OAAO;oBACb,MAAM,EACJ,GAAG,OAAO,CAAC,UAAU,8DAA8D;wBACnF,UAAU,OAAO,CAAC,IAAI,2EAA2E;iBACpG,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAE7D,oGAAoG;YACpG,kGAAkG;YAClG,oGAAoG;YACpG,gGAAgG;YAChG,2FAA2F;YAC3F,SAAS,CAAC;gBACR,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,MAAM;gBACrB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;gBAC/B,kGAAkG;gBAClG,gGAAgG;gBAChG,mGAAmG;gBACnG,iGAAiG;gBACjG,oGAAoG;gBACpG,kFAAkF;gBAClF,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM;oBAAE,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACpE,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"approval-prompt.js","sourceRoot":"","sources":["../src/approval-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAyC,MAAM,eAAe,CAAC;AAalG,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,wBAAwB;IACjC,MAAM,EAAE,wCAAwC;CACjD,CAAC;AAwDF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,OAAO,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,MAAuB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAuBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,QAAQ,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC9C,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA4B,EAC5B,WAA8B,IAAI,GAAG,EAAE;IAEvC,MAAM,GAAG,GAAG,KAAK,EAAE,OAAsB,EAA0B,EAAE;QACnE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,GACT,mBAAmB,OAAO,CAAC,UAAU,QAAQ,OAAO,CAAC,OAAO,GAAG;YAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAEpD,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC3F,OAAO,EAAE,OAAO,CAAC,SAAS;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4FAA4F;YAC5F,gEAAgE;YAChE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACtG,CAAC;QAED,gGAAgG;QAChG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,OAAO,CAAC,UAAU,gBAAgB,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,wBAAwB,EAAE,CAAC;QAClG,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3G,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAsB;YAClC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,gGAAgG;gBAChG,oEAAoE;gBACpE,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,IAAI,EAAE,OAAO;oBACb,MAAM,EACJ,GAAG,OAAO,CAAC,UAAU,8DAA8D;wBACnF,UAAU,OAAO,CAAC,IAAI,2EAA2E;iBACpG,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAEvH,oGAAoG;YACpG,kGAAkG;YAClG,oGAAoG;YACpG,gGAAgG;YAChG,2FAA2F;YAC3F,SAAS,CAAC;gBACR,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,MAAM;gBACrB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;gBAC/B,kGAAkG;gBAClG,gGAAgG;gBAChG,mGAAmG;gBACnG,iGAAiG;gBACjG,oGAAoG;gBACpG,kFAAkF;gBAClF,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM;oBAAE,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACpE,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/approval-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-store.d.ts","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAOH,OAAO,EAAgB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAO1G,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASjD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAmED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,IAAI,CAAC;IACV,UAAU,EAAE,aAAa,CAAC;CAC3B;AAED,sFAAsF;AACtF,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAwB5E;AA4CD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,aAAa,EACpB,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErE,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7D"}
+{"version":3,"file":"approval-store.d.ts","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAOH,OAAO,EAAgB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAQ1G,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASjD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAqED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,IAAI,CAAC;IACV,UAAU,EAAE,aAAa,CAAC;CAC3B;AAED,sFAAsF;AACtF,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAwB5E;AA4CD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,aAAa,EACpB,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErE,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7D"}

package/dist/approval-store.js

@@ -35,6 +35,7 @@ import { withFileLock } from "./file-lock.js";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { entryVerdict } from "./approval.js";
+import { isApprovalBinding } from "./correlation.js";
 /**
  * Where persisted approvals live — **outside the governed workspace** (ADR-0014).
  *
@@ -121,7 +122,8 @@ function isValidEntryShape(entry) {
     return (typeof obj.approvedAt === "string" &&
         typeof obj.expiresAt === "string" &&
         typeof obj.cwd === "string" &&
-        Array.isArray(obj.grantAtApproval));
+        Array.isArray(obj.grantAtApproval) &&
+        (obj.binding === undefined || isApprovalBinding(obj.binding)));
 }
 /**
  * Project every entry through its DECLARED fields on the way out (ADR-0021).
@@ -143,6 +145,7 @@ function sanitise(valid) {
             cwd: e.cwd,
             grantAtApproval: e.grantAtApproval,
             ...(e.bodyAtApproval !== undefined ? { bodyAtApproval: e.bodyAtApproval } : {}),
+            ...(e.binding !== undefined ? { binding: structuredClone(e.binding) } : {}),
         },
     ]));
 }

package/dist/approval-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-store.js","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAA+D,MAAM,eAAe,CAAC;AAqB1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,yGAAyG;IACzG,gGAAgG;IAChG,sGAAsG;IACtG,kGAAkG;IAClG,6FAA6F;IAC7F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,uBAAuB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;AACnD,CAAC;AAED,qGAAqG;AACrG,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,QAAQ,CAAC,KAAiC;IACjD,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG;QACH;YACE,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QACjF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,GAAG,MAA+B,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;QAC9F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAQD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,gGAAgG;QAChG,2FAA2F;QAC3F,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,KAAK;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;;YAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,IAAkB;IAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,+EAA+E;IAC/E,EAAE;IACF,sGAAsG;IACtG,qGAAqG;IACrG,sGAAsG;IACtG,sGAAsG;IACtG,yGAAyG;IACzG,uGAAuG;IACvG,yBAAyB;IACzB,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,+FAA+F;QAC/F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,GAAW,EACX,KAAoB,EACpB,UAAyB,EACzB,GAAS;IAET,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,0GAA0G;QAC1G,yGAAyG;QACzG,sCAAsC;QACtC,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,GAAW,EACX,UAAyB,EACzB,GAAS;IAET,OAAO,SAAS,CAAgB,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACrC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzG,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,SAAS,CAAI,GAAW,EAAE,MAAS,EAAE,OAAU,EAAE,IAAsB;IACpF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,2FAA2F;IAC3F,sGAAsG;IACtG,oGAAoG;IACpG,wGAAwG;IACxG,oGAAoG;IACpG,gDAAgD;IAChD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,sGAAsG;QACtG,mGAAmG;QACnG,mGAAmG;QACnG,mFAAmF;QACnF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE;YACrD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,0FAA0F;QAC1F,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;AACH,CAAC"}
+{"version":3,"file":"approval-store.js","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAA+D,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAqBrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,yGAAyG;IACzG,gGAAgG;IAChG,sGAAsG;IACtG,kGAAkG;IAClG,6FAA6F;IAC7F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,uBAAuB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;AACnD,CAAC;AAED,qGAAqG;AACrG,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAClC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,QAAQ,CAAC,KAAiC;IACjD,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG;QACH;YACE,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QACjF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,GAAG,MAA+B,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;QAC9F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAQD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,gGAAgG;QAChG,2FAA2F;QAC3F,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,KAAK;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;;YAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,IAAkB;IAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,+EAA+E;IAC/E,EAAE;IACF,sGAAsG;IACtG,qGAAqG;IACrG,sGAAsG;IACtG,sGAAsG;IACtG,yGAAyG;IACzG,uGAAuG;IACvG,yBAAyB;IACzB,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,+FAA+F;QAC/F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,GAAW,EACX,KAAoB,EACpB,UAAyB,EACzB,GAAS;IAET,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,0GAA0G;QAC1G,yGAAyG;QACzG,sCAAsC;QACtC,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,GAAW,EACX,UAAyB,EACzB,GAAS;IAET,OAAO,SAAS,CAAgB,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACrC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzG,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,SAAS,CAAI,GAAW,EAAE,MAAS,EAAE,OAAU,EAAE,IAAsB;IACpF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,2FAA2F;IAC3F,sGAAsG;IACtG,oGAAoG;IACpG,wGAAwG;IACxG,oGAAoG;IACpG,gDAAgD;IAChD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,sGAAsG;QACtG,mGAAmG;QACnG,mGAAmG;QACnG,mFAAmF;QACnF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE;YACrD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,0FAA0F;QAC1F,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/approval.d.ts

@@ -9,6 +9,7 @@
  * ADR-0010 records the four decisions encoded here.
  */
 import type { Capability, ResolveResult } from "./resolve.ts";
+import { type ApprovalBinding } from "./correlation.ts";
 /** How far a single yes reaches in time. */
 export type ApprovalScope = "once" | "session" | "always";
 /** Where a yes came from, for the ledger. These call for different follow-ups, so they stay distinct. */
@@ -84,6 +85,11 @@ export interface InheritableApproval {
      * no file to hash — and, per ADR-0019, is never persisted or offered `always` for the same reason.
      */
     bodySha256?: string;
+    /**
+     * Exact delegation binding for controllers that supply correlation/workspace context (ADR-0034).
+     * Bound approvals are deliberately not inherited: authority for one task must not become subtree-wide.
+     */
+    binding?: ApprovalBinding;
 }
 /**
  * What a child may inherit, as `capability@subject` keys.
@@ -145,6 +151,8 @@ export interface ApprovalEntry {
      * predates 0.10.0 and cannot be verified, which `entryVerdict` treats as changed: fail closed.
      */
     bodyAtApproval?: string;
+    /** Exact task/grant/workspace/context/parent binding for correlated controller calls (ADR-0034). */
+    binding?: ApprovalBinding;
 }
 export type EntryVerdict = "valid" | "expired" | "foreign-cwd" | "type-changed" | "instructions-changed" | "type-missing";
 /**
@@ -193,9 +201,14 @@ export interface ResolveApprovalsInput {
     subject: string;
     /** Approval KEYS approved for this session, in memory only. */
     sessionApprovals: ReadonlySet<string>;
-    /** Persisted entries by key, ALREADY validity-filtered by the store. */
+    /** Exact bindings for correlated session approvals. Kept separate so legacy keys remain compatible. */
+    sessionApprovalBindings?: ReadonlyMap<string, ApprovalBinding>;
+    /** Persisted entries by key, ALREADY definition/expiry-filtered by the store. */
     persisted: ReadonlyMap<string, ApprovalEntry>;
-    /** Capabilities approved further up the tree and inherited with the grant. */
+    /** When present, only an exact binding may satisfy this gate. */
+    expectedBinding?: ApprovalBinding;
+    /** Same-key persisted entries dropped specifically because their expiry passed. */
+    expiredKeys?: ReadonlySet<string>;
     /**
      * `capability@subject` keys inherited from the delegator (ADR-0014).
      *
@@ -208,7 +221,12 @@ export interface ResolveApprovalsResult {
     approved: Capability[];
     /** Gated capabilities still requiring a live human. */
     needsPrompt: Capability[];
+    /** A same-key approval existed but named another task/workspace/context/parent. */
+    scopeMismatched: Capability[];
+    expired: Capability[];
     sources: Record<Capability, ApprovalSource>;
+    scopes: Record<Capability, ApprovalScope>;
+    expiresAt: Record<Capability, string>;
 }
 /**
  * Satisfy as much of `gated` as possible without asking anyone.