pi-daddy 0.17.0 → 0.18.0

package/dist/approval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,4CAA4C;AAC5C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE1D,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAE9E,sFAAsF;AACtF,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,UAAU,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAIpC,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAS7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,aAAa,EAAE,CAEjE;AAED;;;;;;;;;GASG;AACH,+GAA+G;AAC/G,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,UAAU,CAAC;IACvB,qGAAqG;IACrG,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,CAAC;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAmB/F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAevF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,GACtD,GAAG,CAAC,MAAM,CAAC,CAWb;AAED;qGACqG;AACrG,wBAAgB,SAAS,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,CAElD;AAED,iHAAiH;AACjH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,oGAAoG;IACpG,eAAe,EAAE,UAAU,EAAE,CAAC;IAS9B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,SAAS,GACT,aAAa,GACb,cAAc,GACd,sBAAsB,GACtB,cAAc,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,IAAI,CAAC;IACV,uFAAuF;IACvF,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,YAAY,CAiBpE;AAED,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,wEAAwE;IACxE,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,8EAA8E;IAC9E;;;;;OAKG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,uDAAuD;IACvD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAyBrF"}
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE/E,4CAA4C;AAC5C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE1D,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAE9E,sFAAsF;AACtF,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,UAAU,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAIpC,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAS7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,aAAa,EAAE,CAEjE;AAED;;;;;;;;;GASG;AACH,+GAA+G;AAC/G,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,UAAU,CAAC;IACvB,qGAAqG;IACrG,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,CAAC;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAmB/F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAevF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,GACtD,GAAG,CAAC,MAAM,CAAC,CAWb;AAED;qGACqG;AACrG,wBAAgB,SAAS,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,CAElD;AAED,iHAAiH;AACjH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,oGAAoG;IACpG,eAAe,EAAE,UAAU,EAAE,CAAC;IAS9B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oGAAoG;IACpG,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,SAAS,GACT,aAAa,GACb,cAAc,GACd,sBAAsB,GACtB,cAAc,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,IAAI,CAAC;IACV,uFAAuF;IACvF,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,YAAY,CAiBpE;AAED,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,uGAAuG;IACvG,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/D,iFAAiF;IACjF,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,iEAAiE;IACjE,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,mFAAmF;IACnF,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,uDAAuD;IACvD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,mFAAmF;IACnF,eAAe,EAAE,UAAU,EAAE,CAAC;IAC9B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAwCrF"}

package/dist/approval.js

@@ -9,6 +9,7 @@
  * ADR-0010 records the four decisions encoded here.
  */
 import { WILDCARD } from "./pi-tools.js";
+import { approvalBindingsEqual } from "./correlation.js";
 /**
  * Subject used for delegate-path approvals.
  *
@@ -94,7 +95,7 @@ export function inheritApprovals(approved, grant) {
     const held = new Set(grant);
     return [
         ...new Set(approved
-            .filter((a) => a.scope !== "once" && a.capability !== WILDCARD && held.has(a.capability))
+            .filter((a) => a.scope !== "once" && a.binding === undefined && a.capability !== WILDCARD && held.has(a.capability))
             // A definition subject MUST carry a pin to cross a boundary (ADR-0022, hardened after F1).
             //
             // `verifyInherited` honours an unpinned entry by decision — `<delegate>` names no file and a
@@ -220,25 +221,44 @@ export function resolveApprovals(input) {
     const inherited = input.inherited ?? new Set();
     const approved = [];
     const needsPrompt = [];
-    const sources = {};
+    const scopeMismatched = [];
+    const expired = [];
+    const sources = {}, scopes = {};
+    const expiresAt = {};
     for (const capability of [...new Set(input.gated)].sort()) {
         const key = approvalKey(capability, input.subject);
-        if (inherited.has(key)) {
+        const expected = input.expectedBinding;
+        const sessionBinding = input.sessionApprovalBindings?.get(key);
+        const persisted = input.persisted.get(key);
+        const inheritedApplies = expected === undefined && inherited.has(key);
+        const legacySessionApplies = expected === undefined && input.sessionApprovals.has(key);
+        const boundSessionApplies = expected !== undefined && approvalBindingsEqual(sessionBinding, expected);
+        const persistedApplies = persisted !== undefined && (expected === undefined ? persisted.binding === undefined : approvalBindingsEqual(persisted.binding, expected));
+        if (inheritedApplies) {
             approved.push(capability);
             sources[capability] = "inherited";
+            scopes[capability] = "session";
         }
-        else if (input.sessionApprovals.has(key)) {
+        else if (legacySessionApplies || boundSessionApplies) {
             approved.push(capability);
             sources[capability] = "session";
+            scopes[capability] = "session";
         }
-        else if (input.persisted.has(key)) {
+        else if (persistedApplies) {
             approved.push(capability);
             sources[capability] = "persisted";
+            scopes[capability] = "always";
+            expiresAt[capability] = persisted.expiresAt;
         }
         else {
             needsPrompt.push(capability);
+            if (input.expiredKeys?.has(key))
+                expired.push(capability);
+            else if (expected !== undefined && (sessionBinding !== undefined || persisted !== undefined || input.sessionApprovals.has(key))) {
+                scopeMismatched.push(capability);
+            }
         }
     }
-    return { approved, needsPrompt, sources };
+    return { approved, needsPrompt, scopeMismatched, expired, sources, scopes, expiresAt };
 }
 //# sourceMappingURL=approval.js.map

package/dist/approval.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval.js","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAYzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,UAAsB,EAAE,OAAe;IACjE,OAAO,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,oGAAoG;IACpG,6FAA6F;IAC7F,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,OAAO,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACrF,CAAC;AAyBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA+B,EAAE,KAAmB;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO;QACL,GAAG,IAAI,GAAG,CACR,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACzF,2FAA2F;YAC3F,EAAE;YACF,6FAA6F;YAC7F,gGAAgG;YAChG,8FAA8F;YAC9F,kGAAkG;YAClG,oGAAoG;YACpG,mGAAmG;YACnG,yBAAyB;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;aACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC/F;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,mGAAmG;QACnG,kFAAkF;QAClF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/C,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,iEAAiE;QACvG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA+C,EAC/C,UAAuD;IAEvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;qGACqG;AACrG,MAAM,UAAU,SAAS,CAAC,UAAgB;IACxC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;AACnF,CAAC;AA2DD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,+FAA+F;IAC/F,kGAAkG;IAClG,+BAA+B;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IAClD,+FAA+F;IAC/F,yCAAyC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC;IAChD,sGAAsG;IACtG,+EAA+E;IAC/E,IAAI,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,sBAAsB,CAAC;IAC3F,OAAO,OAAO,CAAC;AACjB,CAAC;AA2BD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,qGAAqG;IACrG,6CAA6C;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,GAAG,EAAU,CAAC;IACvD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAuC,EAAE,CAAC;IAEvD,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;QAClC,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAwB,MAAM,kBAAkB,CAAC;AAW/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,UAAsB,EAAE,OAAe;IACjE,OAAO,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,oGAAoG;IACpG,6FAA6F;IAC7F,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,OAAO,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACrF,CAAC;AA8BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA+B,EAAE,KAAmB;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO;QACL,GAAG,IAAI,GAAG,CACR,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACpH,2FAA2F;YAC3F,EAAE;YACF,6FAA6F;YAC7F,gGAAgG;YAChG,8FAA8F;YAC9F,kGAAkG;YAClG,oGAAoG;YACpG,mGAAmG;YACnG,yBAAyB;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;aACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC/F;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,mGAAmG;QACnG,kFAAkF;QAClF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/C,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,iEAAiE;QACvG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA+C,EAC/C,UAAuD;IAEvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;qGACqG;AACrG,MAAM,UAAU,SAAS,CAAC,UAAgB;IACxC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;AACnF,CAAC;AA6DD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,+FAA+F;IAC/F,kGAAkG;IAClG,+BAA+B;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IAClD,+FAA+F;IAC/F,yCAAyC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC;IAChD,sGAAsG;IACtG,+EAA+E;IAC/E,IAAI,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,sBAAsB,CAAC;IAC3F,OAAO,OAAO,CAAC;AACjB,CAAC;AAqCD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,qGAAqG;IACrG,6CAA6C;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,GAAG,EAAU,CAAC;IACvD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAuC,EAAE,EAAE,MAAM,GAAsC,EAAE,CAAC;IACvG,MAAM,SAAS,GAA+B,EAAE,CAAC;IAEjD,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC;QACvC,MAAM,cAAc,GAAG,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,gBAAgB,GAAG,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,oBAAoB,GAAG,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,mBAAmB,GAAG,QAAQ,KAAK,SAAS,IAAI,qBAAqB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACtG,MAAM,gBAAgB,GAAG,SAAS,KAAK,SAAS,IAAI,CAClD,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC9G,CAAC;QAEF,IAAI,gBAAgB,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;YAAC,MAAM,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;QAC/F,CAAC;aAAM,IAAI,oBAAoB,IAAI,mBAAmB,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YAAC,MAAM,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;QAC7F,CAAC;aAAM,IAAI,gBAAgB,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;YAAC,MAAM,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;YAC5F,SAAS,CAAC,UAAU,CAAC,GAAG,SAAU,CAAC,SAAS,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;iBACrD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAChI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC"}

package/dist/chain.d.ts

@@ -26,7 +26,7 @@
  * How much of a step's output crosses to the next step.
  *
  * A child may return up to `DEFAULT_MAX_OUTPUT_BYTES` (1 MiB); pasting that into a task would spend most of the
- * next child's context on its predecessor's transcript. 64 KiB is a generous summary and a poor transcript, which
+ * next child's context on its predecessor's transcript. 32 KiB is a generous summary and a poor transcript, which
  * is the right side of that line for a handoff.
  */
 export declare const HANDOFF_MAX_BYTES: number;
@@ -78,6 +78,11 @@ export interface ChainStep {
     agent?: string;
     tools?: string[];
     model?: string;
+    correlation?: import("./correlation.ts").CorrelationMetadata;
+    workspace?: {
+        workspace_id: string;
+        access: import("./workspace.ts").WorkspaceAccess;
+    };
 }
 /**
  * Build the spec for one step — the operator's step plus the composed task.

package/dist/chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,SAAU,CAAC;AAEtC,qHAAqH;AACrH,eAAO,MAAM,WAAW,eAAe,CAAC;AAkCxC;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA2BnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAWtF;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEtF"}
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,SAAU,CAAC;AAEtC,qHAAqH;AACrH,eAAO,MAAM,WAAW,eAAe,CAAC;AAkCxC;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA2BnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAWtF;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,mBAAmB,CAAC;IAC7D,SAAS,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,eAAe,CAAA;KAAE,CAAC;CACxF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEtF"}

package/dist/chain.js

@@ -27,7 +27,7 @@ import { randomBytes } from "node:crypto";
  * How much of a step's output crosses to the next step.
  *
  * A child may return up to `DEFAULT_MAX_OUTPUT_BYTES` (1 MiB); pasting that into a task would spend most of the
- * next child's context on its predecessor's transcript. 64 KiB is a generous summary and a poor transcript, which
+ * next child's context on its predecessor's transcript. 32 KiB is a generous summary and a poor transcript, which
  * is the right side of that line for a handoff.
  */
 export const HANDOFF_MAX_BYTES = 32 * 1024;

package/dist/chain.js.map

@@ -1 +1 @@
-{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,qHAAqH;AACrH,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,IAAI,GAAG,IAAI,GAAG,MAAM;YAAE,MAAM;QAChC,IAAI,IAAI,IAAI,CAAC;QACb,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,wGAAwG;IACxG,4GAA4G;IAC5G,+GAA+G;IAC/G,cAAc;IACd,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,aAAa,KAAK,0DAA0D,iBAAiB,YAAY;YACzG,GAAG,IAAI,sDAAsD;QAC/D,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,6GAA6G;QAC7G,gGAAgG;QAChG,sGAAsG;QACtG,yBAAyB,KAAK,KAAK;QACnC,IAAI;QACJ,MAAM,CAAC,SAAS,EAAE;QAClB,UAAU,KAAK,KAAK;KACrB;SACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,QAA4B;IAC5E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,mHAAmH;IACnH,+GAA+G;IAC/G,mHAAmH;IACnH,kHAAkH;IAClH,kHAAkH;IAClH,gGAAgG;IAChG,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1F,OAAO,GAAG,QAAQ,OAAO,MAAM,EAAE,CAAC;AACpC,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,QAA4B;IACzE,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;AACjE,CAAC"}
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,qHAAqH;AACrH,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,IAAI,GAAG,IAAI,GAAG,MAAM;YAAE,MAAM;QAChC,IAAI,IAAI,IAAI,CAAC;QACb,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,wGAAwG;IACxG,4GAA4G;IAC5G,+GAA+G;IAC/G,cAAc;IACd,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,aAAa,KAAK,0DAA0D,iBAAiB,YAAY;YACzG,GAAG,IAAI,sDAAsD;QAC/D,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,6GAA6G;QAC7G,gGAAgG;QAChG,sGAAsG;QACtG,yBAAyB,KAAK,KAAK;QACnC,IAAI;QACJ,MAAM,CAAC,SAAS,EAAE;QAClB,UAAU,KAAK,KAAK;KACrB;SACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,QAA4B;IAC5E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,mHAAmH;IACnH,+GAA+G;IAC/G,mHAAmH;IACnH,kHAAkH;IAClH,kHAAkH;IAClH,gGAAgG;IAChG,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1F,OAAO,GAAG,QAAQ,OAAO,MAAM,EAAE,CAAC;AACpC,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,QAA4B;IACzE,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/check-runner.d.ts

@@ -0,0 +1,61 @@
+import { type CorrelationMetadata } from "./correlation.ts";
+import { type ValidatedWorkspace, type WorkspaceAccess } from "./workspace.ts";
+export interface CheckDefinition {
+    /** Absolute operator-owned executable. PATH lookup is deliberately not part of the contract. */
+    executable: string;
+    /** Exact argv elements. Never a shell command string. */
+    argv: string[];
+    /** Fixed non-sensitive environment values. */
+    env?: Record<string, string>;
+    /** Explicit inherited names. Sensitive names are still removed. */
+    inherit_env?: string[];
+    timeout_ms?: number;
+    max_output_bytes?: number;
+    /** Checks are assumed capable of writing unless the operator declares read. */
+    workspace_access?: WorkspaceAccess;
+}
+export interface CheckRegistry {
+    version: 1;
+    checks: Record<string, CheckDefinition>;
+}
+export interface CheckReceipt {
+    schema_version: "1.0";
+    receipt_id: string;
+    check_id: string;
+    executable: string;
+    executable_sha256: string;
+    argv: string[];
+    argv_sha256: string;
+    cwd: string;
+    cwd_sha256: string;
+    started_at: string;
+    ended_at: string;
+    exit_code: number | null;
+    signal: NodeJS.Signals | null;
+    timed_out: boolean;
+    aborted: boolean;
+    truncated: boolean;
+    output_sha256: string;
+    workspace_id: string;
+    workspace_access: WorkspaceAccess;
+    head_sha: string;
+    tree_sha: string;
+    correlation?: CorrelationMetadata;
+}
+export declare function buildCheckEnvironment(definition: CheckDefinition, inherited?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function runNamedCheck(input: {
+    checkId: string;
+    registry: CheckRegistry;
+    workspace: ValidatedWorkspace;
+    correlation?: CorrelationMetadata;
+    inheritedEnv?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+    leaseDir?: string;
+    ledgerPath?: string;
+}): Promise<{
+    output: string;
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    receipt: CheckReceipt;
+}>;
+//# sourceMappingURL=check-runner.d.ts.map

package/dist/check-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-runner.d.ts","sourceRoot":"","sources":["../src/check-runner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUlF,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,eAAe,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAKD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,eAAe,EAC3B,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,MAAM,CAAC,UAAU,CAWnB;AA4BD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC,CAqND"}

package/dist/check-runner.js

@@ -0,0 +1,237 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdtemp, readFile, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, isAbsolute, join } from "node:path";
+import { normaliseCorrelation } from "./correlation.js";
+import { appendLedgerEvent, buildWorkspaceLeaseEvent, LEDGER_VERSION, } from "./ledger.js";
+import { computeGitCandidateIdentity } from "./git-identity.js";
+import { runChild } from "./run-child.js";
+import { GovernanceRefusal, refusal } from "./refusals.js";
+import { acquireWorkspaceLease, defaultWorkspaceLeaseDir, leaseAcquisitionOutcome, leaseReleaseLedgerOutcome, } from "./workspace.js";
+const SAFE_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SENSITIVE_ENV_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH|COOKIE|PRIVATE_KEY|API_KEY)(?:_|$)|^PI_GRANTS_|^(?:AWS|GITHUB|GITLAB|AZURE|GOOGLE)_/i;
+export function buildCheckEnvironment(definition, inherited = process.env) {
+    const env = {};
+    for (const name of definition.inherit_env ?? []) {
+        if (!SAFE_ENV_NAME.test(name) || SENSITIVE_ENV_NAME.test(name))
+            continue;
+        if (inherited[name] !== undefined)
+            env[name] = inherited[name];
+    }
+    for (const [name, value] of Object.entries(definition.env ?? {})) {
+        if (!SAFE_ENV_NAME.test(name) || SENSITIVE_ENV_NAME.test(name))
+            continue;
+        env[name] = value;
+    }
+    return env;
+}
+function validateDefinition(checkId, value) {
+    if (!value) {
+        throw new GovernanceRefusal(refusal("CHECK_NOT_CONFIGURED", `check ${JSON.stringify(checkId)} is not present in operator-owned configuration`, { check_id: checkId }));
+    }
+    if (!isAbsolute(value.executable) || !Array.isArray(value.argv) || value.argv.some((item) => typeof item !== "string")) {
+        throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(checkId)} requires an absolute executable and argv string array`, { check_id: checkId }));
+    }
+    for (const bound of [value.timeout_ms, value.max_output_bytes]) {
+        if (bound !== undefined && (!Number.isInteger(bound) || bound <= 0)) {
+            throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(checkId)} has a non-positive runtime bound`, { check_id: checkId }));
+        }
+    }
+    return value;
+}
+function receiptId(receipt) {
+    return createHash("sha256").update(JSON.stringify(receipt), "utf8").digest("hex");
+}
+export async function runNamedCheck(input) {
+    if (input.registry?.version !== 1 || !input.registry.checks || typeof input.registry.checks !== "object") {
+        throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", "check registry must contain {version:1, checks:{...}}"));
+    }
+    const definition = validateDefinition(input.checkId, input.registry.checks[input.checkId]);
+    let executable;
+    try {
+        executable = await realpath(definition.executable);
+        if (!(await stat(executable)).isFile())
+            throw new Error("not a file");
+    }
+    catch (error) {
+        throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(input.checkId)} executable is not a real file (${String(error)})`, { check_id: input.checkId }));
+    }
+    const argvSha256 = createHash("sha256").update(JSON.stringify(definition.argv), "utf8").digest("hex");
+    const cwdSha256 = createHash("sha256").update(input.workspace.root, "utf8").digest("hex");
+    const access = definition.workspace_access ?? "write";
+    // Evidence checks coordinate exclusively so their pre/post candidate identities cannot overlap another
+    // governed writer. `access` still records what the configured executable is intended to do.
+    const leaseAccess = "write";
+    const ownerId = `check:${input.checkId}:${randomUUID()}`;
+    const correlation = normaliseCorrelation(input.correlation);
+    let lease;
+    let stagedDir;
+    /** Failures of best-effort RECORDS, reported alongside whatever actually happened — never instead of it. */
+    const notes = [];
+    let releaseReason = "failed";
+    try {
+        try {
+            lease = await acquireWorkspaceLease({
+                workspace: input.workspace, access: leaseAccess, leaseDir: input.leaseDir ?? defaultWorkspaceLeaseDir(),
+                ownerId, signal: input.signal,
+            });
+        }
+        catch (error) {
+            if (input.ledgerPath)
+                await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+                    childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                    outcome: "refused",
+                    correlation, now: new Date(),
+                    ...(error instanceof GovernanceRefusal
+                        ? { refusal: { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) } }
+                        : {}),
+                }));
+            throw error;
+        }
+        if (input.ledgerPath) {
+            try {
+                await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+                    childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                    outcome: leaseAcquisitionOutcome(leaseAccess, lease.recovered), recovered: lease.recovered,
+                    correlation, now: new Date(),
+                }));
+            }
+            catch (error) {
+                await lease.release("ledger-failed");
+                lease = undefined;
+                throw error;
+            }
+        }
+        const before = await computeGitCandidateIdentity(input.workspace);
+        for (const [name, supplied, actual] of [
+            ["head_sha", correlation?.head_sha, before.headSha], ["tree_sha", correlation?.tree_sha, before.treeSha],
+        ]) {
+            if (supplied && supplied !== actual)
+                throw new GovernanceRefusal(refusal("CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} ${name} does not match the validated workspace`, { check_id: input.checkId, supplied, actual }));
+        }
+        const executableBytes = await readFile(executable);
+        const executableSha256 = createHash("sha256").update(executableBytes).digest("hex");
+        stagedDir = await mkdtemp(join(tmpdir(), "pi-daddy-check-exec-"));
+        const stagedExecutable = join(stagedDir, basename(executable));
+        await writeFile(stagedExecutable, executableBytes, { mode: 0o700 });
+        await chmod(stagedExecutable, 0o700);
+        const leaseAbort = new AbortController();
+        let leaseLost = false;
+        lease.lost.then(() => { leaseLost = true; leaseAbort.abort(); });
+        const checkSignal = input.signal ? AbortSignal.any([input.signal, leaseAbort.signal]) : leaseAbort.signal;
+        const started = new Date();
+        const result = await runChild({
+            command: "setpriv", args: ["--pdeathsig", "KILL", "--", stagedExecutable, ...definition.argv],
+            env: buildCheckEnvironment(definition, input.inheritedEnv), cwd: input.workspace.root,
+            signal: checkSignal, timeoutMs: definition.timeout_ms, maxOutputBytes: definition.max_output_bytes,
+            onSpawn: (pid) => lease.attachProcess(pid),
+        });
+        const ended = new Date();
+        releaseReason = input.signal?.aborted ? "cancelled" : result.timedOut ? "timeout" : result.aborted ? "failed" : "completed";
+        // Every throw below re-stamps this. Without that, a check refused for CHECK_IDENTITY_MISMATCH still
+        // wrote `released / completed` from the `finally` — the LAST lease event for that owner — so the trail
+        // still read like a clean run and `verifyLedger` still counted a clean release. The R-114 fix added a
+        // refusal line beside the misleading one instead of correcting it.
+        if (result.spawnError)
+            throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} could not start its constrained executor`, { check_id: input.checkId }));
+        if (leaseLost)
+            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease while running`, { check_id: input.checkId }));
+        const after = await computeGitCandidateIdentity(input.workspace);
+        if (leaseLost)
+            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`, { check_id: input.checkId }));
+        if (before.headSha !== after.headSha || before.treeSha !== after.treeSha) {
+            throw new GovernanceRefusal(refusal("CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} workspace changed while it ran`, { check_id: input.checkId }));
+        }
+        // The candidate is now measured and the process is dead. End the lease before writing the receipt so
+        // lease loss cannot race a blocked ledger append and leave behind evidence from an unprotected run.
+        // Record what release actually DID. This asserted `released` unconditionally and threw the outcome
+        // away, so the evidence path reproduced the very defect the outcome union was added to expose: a lost
+        // or unrecorded handover ledgered as a clean one, with `lease = undefined` stopping the `finally` from
+        // ever noticing (R-100/R-103, found while reviewing the fix for R-99).
+        const releaseOutcome = await lease.release(releaseReason);
+        lease = undefined;
+        if (leaseLost)
+            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`, { check_id: input.checkId }));
+        if (input.ledgerPath)
+            await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+                childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                outcome: leaseReleaseLedgerOutcome(releaseOutcome, releaseReason), releaseReason, correlation, now: new Date(),
+            }));
+        const body = {
+            schema_version: "1.0", check_id: input.checkId, executable, executable_sha256: executableSha256,
+            argv: [...definition.argv], argv_sha256: argvSha256, cwd: input.workspace.root, cwd_sha256: cwdSha256,
+            started_at: started.toISOString(), ended_at: ended.toISOString(), exit_code: result.code,
+            signal: result.signal ?? null, timed_out: result.timedOut, aborted: result.aborted, truncated: result.truncated,
+            output_sha256: createHash("sha256").update(result.text, "utf8").digest("hex"),
+            workspace_id: input.workspace.workspaceId, workspace_access: access,
+            head_sha: before.headSha, tree_sha: before.treeSha, ...(correlation ? { correlation } : {}),
+        };
+        const receipt = { receipt_id: receiptId(body), ...body };
+        if (input.ledgerPath) {
+            const event = {
+                ledgerVersion: LEDGER_VERSION, event: "check_receipt", ts: ended.toISOString(), childId: ownerId,
+                receiptId: receipt.receipt_id, workspaceId: input.workspace.workspaceId, checkId: input.checkId,
+                treeSha: receipt.tree_sha, ...(correlation ? { correlation } : {}),
+            };
+            await appendLedgerEvent({ path: input.ledgerPath, strict: true }, event);
+        }
+        return { output: result.text, exitCode: result.code, signal: result.signal ?? null, receipt };
+    }
+    catch (error) {
+        // The run did not complete, so the release must not be recorded as if it had. Without this the
+        // `finally` wrote `released / completed` as the LAST lease event for a refused check, so the trail
+        // still read like a clean run and `verifyLedger` still counted a clean release — the R-114 fix put a
+        // refusal line beside the misleading one instead of correcting it.
+        if (releaseReason === "completed")
+            releaseReason = "refused";
+        // The single most important negative result this feature can produce — CHECK_IDENTITY_MISMATCH, "the
+        // workspace changed while the check ran" — used to leave NO ledger evidence at all, while the
+        // `finally` recorded `released, reason: completed`, so the trail read like a clean run (R-114).
+        if (input.ledgerPath) {
+            await appendLedgerEvent({
+                path: input.ledgerPath,
+                // Best effort, and loud: this records a failure, so it must not replace the failure. A strict
+                // append that threw here would substitute "ledger write failed" for the evidence-integrity
+                // refusal that actually happened (R-115).
+                strict: false,
+                // NOT empty. `onFailure` exists because a non-strict append is a choice not to fail closed and
+                // never a choice to be silent — the comment above says "loud", and an empty callback is the
+                // definition of swallowing. This guards the evidence record itself, so losing it silently is
+                // how a mutated workspace came to leave a trail that read like a clean run.
+                onFailure: (cause) => { notes.push(`check refusal record failed: ${String(cause)}`); },
+            }, buildWorkspaceLeaseEvent({
+                childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                outcome: "refused",
+                refusal: error instanceof GovernanceRefusal
+                    ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
+                    : refusal("CHECK_IDENTITY_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} failed (${String(error)})`),
+                correlation, now: new Date(),
+            }));
+        }
+        throw error;
+    }
+    finally {
+        if (stagedDir)
+            await rm(stagedDir, { recursive: true, force: true });
+        if (lease) {
+            // `release()` cannot throw (R-99), and the record of it is best-effort for the same reason as
+            // above: a `finally` that throws destroys whatever the caller was already returning or raising.
+            const outcome = await lease.release(releaseReason);
+            if (input.ledgerPath)
+                await appendLedgerEvent({
+                    path: input.ledgerPath,
+                    strict: false,
+                    onFailure: (cause) => { notes.push(`check lease release record failed: ${String(cause)}`); },
+                }, buildWorkspaceLeaseEvent({
+                    childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                    outcome: outcome === "lost"
+                        ? "lost"
+                        : outcome === "released-unrecorded"
+                            ? "released-unrecorded"
+                            : releaseReason === "timeout" ? "timeout" : "released",
+                    releaseReason, correlation, now: new Date(),
+                }));
+        }
+    }
+}
+//# sourceMappingURL=check-runner.js.map

package/dist/check-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-runner.js","sourceRoot":"","sources":["../src/check-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAA4B,MAAM,kBAAkB,CAAC;AAClF,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EAExB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EAGxB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AA+CxB,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACjD,MAAM,kBAAkB,GAAG,6IAA6I,CAAC;AAEzK,MAAM,UAAU,qBAAqB,CACnC,UAA2B,EAC3B,YAA+B,OAAO,CAAC,GAAG;IAE1C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACzE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACzE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAkC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,sBAAsB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,iDAAiD,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CACjI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,6BAA6B,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wDAAwD,EACvH,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,6BAA6B,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,OAAyC;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KASnC;IAMC,IAAI,KAAK,CAAC,QAAQ,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzG,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,6BAA6B,EAAE,uDAAuD,CAAC,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,6BAA6B,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,GAAG,EACxH,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,IAAI,OAAO,CAAC;IACtD,uGAAuG;IACvG,4FAA4F;IAC5F,MAAM,WAAW,GAAoB,OAAO,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,KAAK,CAAC,OAAO,IAAI,UAAU,EAAE,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,KAAoE,CAAC;IACzE,IAAI,SAA6B,CAAC;IAClC,4GAA4G;IAC5G,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAG,QAAQ,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBAClC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,wBAAwB,EAAE;gBACvG,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,UAAU;gBAAE,MAAM,iBAAiB,CAC3C,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EACxC,wBAAwB,CAAC;oBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;oBAC3G,OAAO,EAAE,SAAS;oBAClB,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;oBAC5B,GAAG,CAAC,KAAK,YAAY,iBAAiB;wBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;wBACjH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CACH,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,iBAAiB,CACrB,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EACxC,wBAAwB,CAAC;oBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;oBAC3G,OAAO,EAAE,uBAAuB,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1F,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;iBAC7B,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACrC,KAAK,GAAG,SAAS,CAAC;gBAClB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;SAChG,EAAE,CAAC;YACX,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM;gBAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACtE,yBAAyB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,yCAAyC,EAClH,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpF,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,SAAS,CAAC,gBAAgB,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1G,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7F,GAAG,EAAE,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI;YACrF,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,CAAC,gBAAgB;YAClG,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAM,CAAC,aAAa,CAAC,GAAG,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;QACzB,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5H,oGAAoG;QACpG,uGAAuG;QACvG,sGAAsG;QACtG,mEAAmE;QACnE,IAAI,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACxD,sBAAsB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,2CAA2C,EACzG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAChD,uBAAuB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,yCAAyC,EACxG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAChD,uBAAuB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,0CAA0C,EACzG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACzE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,yBAAyB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,iCAAiC,EAClG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACL,CAAC;QACD,qGAAqG;QACrG,oGAAoG;QACpG,mGAAmG;QACnG,sGAAsG;QACtG,uGAAuG;QACvG,uEAAuE;QACvE,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1D,KAAK,GAAG,SAAS,CAAC;QAClB,IAAI,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAChD,uBAAuB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,0CAA0C,EACzG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,iBAAiB,CAC3C,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EACxC,wBAAwB,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;gBAC3G,OAAO,EAAE,yBAAyB,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;aAC/G,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAqC;YAC7C,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB;YAC/F,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS;YACrG,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI;YACxF,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;YAC/G,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7E,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM;YACnE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F,CAAC;QACF,MAAM,OAAO,GAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,KAAK,GAA4B;gBACrC,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO;gBAChG,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;gBAC/F,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;YACF,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+FAA+F;QAC/F,mGAAmG;QACnG,qGAAqG;QACrG,mEAAmE;QACnE,IAAI,aAAa,KAAK,WAAW;YAAE,aAAa,GAAG,SAAS,CAAC;QAC7D,qGAAqG;QACrG,8FAA8F;QAC9F,gGAAgG;QAChG,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,iBAAiB,CACrB;gBACE,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,8FAA8F;gBAC9F,2FAA2F;gBAC3F,0CAA0C;gBAC1C,MAAM,EAAE,KAAK;gBACb,+FAA+F;gBAC/F,4FAA4F;gBAC5F,6FAA6F;gBAC7F,4EAA4E;gBAC5E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aACvF,EACD,wBAAwB,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;gBAC3G,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,KAAK,YAAY,iBAAiB;oBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;oBACpG,CAAC,CAAC,OAAO,CAAC,4BAA4B,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC7G,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;aAC7B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,KAAK,EAAE,CAAC;YACV,8FAA8F;YAC9F,gGAAgG;YAChG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,UAAU;gBAAE,MAAM,iBAAiB,CAC3C;oBACE,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,MAAM,EAAE,KAAK;oBACb,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBAC7F,EACD,wBAAwB,CAAC;oBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;oBAC3G,OAAO,EAAE,OAAO,KAAK,MAAM;wBACzB,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,OAAO,KAAK,qBAAqB;4BACjC,CAAC,CAAC,qBAAqB;4BACvB,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;oBAC1D,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;iBAC5C,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/correlation.d.ts

@@ -0,0 +1,90 @@
+import type { DefinitionDigest } from "./definitions.ts";
+import type { Capability } from "./resolve.ts";
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * Non-authoritative workflow metadata copied onto runtime and ledger events.
+ *
+ * pi-daddy deliberately does not interpret assurance labels, sources, scope selectors, timestamps or
+ * sequence floors. In particular, a digest-looking value here never substitutes for a digest computed by
+ * the planner. The snake_case names are the wire vocabulary used by external controllers.
+ */
+export interface CorrelationMetadata {
+    schema_version?: string;
+    run_id?: string;
+    task_id?: string;
+    workspace_id?: string;
+    context_id?: string;
+    phase?: string;
+    assurance?: string;
+    assurance_effective?: string;
+    policy_label?: string;
+    assurance_source?: string;
+    assurance_scope?: JsonValue;
+    activated_at?: string;
+    plan_digest?: string;
+    definition_digest?: string;
+    task_digest?: string;
+    base_sha?: string;
+    head_sha?: string;
+    tree_sha?: string;
+    event_seq?: number;
+    last_change_seq?: number;
+    last_authority_seq?: number;
+    check_receipt_id?: string;
+}
+/**
+ * Snapshot bounded JSON metadata so a caller cannot mutate a record after planning, and so nothing
+ * unbounded or undeclared can reach the ledger through it.
+ *
+ * Refuses with a stable code rather than a bare `Error`: this is reachable from a model-facing tool
+ * parameter on all three delegation tools, and it used to throw outside every try, producing a governed
+ * refusal with no code and no ledger line at all (R-112).
+ */
+export declare function normaliseCorrelation(input: CorrelationMetadata | undefined): CorrelationMetadata | undefined;
+export declare function digestTask(task: string): string;
+export declare function digestCapabilities(capabilities: readonly Capability[]): string;
+/** Trusted, internally-computed scope of one gated approval. */
+export interface ApprovalBinding {
+    version: "1";
+    task_sha256: string;
+    requested_sha256: string;
+    effective_sha256: string;
+    requested: Capability[];
+    effective: Capability[];
+    definition_sha256?: string;
+    workspace_id?: string;
+    context_id?: string;
+    parent_id: string;
+}
+/**
+ * Builds the binding from TRUSTED values only. It deliberately does not take a `CorrelationMetadata`.
+ *
+ * It used to read `workspace_id` and `context_id` straight out of caller-supplied correlation into what
+ * the comment above calls the trusted scope, and a bound approval could then be spent outside the
+ * workspace it named (R-110): approve a delegation carrying a real, registry-validated `workspace` spec,
+ * then re-issue the identical task with `correlation.workspace_id` set and NO `workspace` field — no
+ * registry lookup, no lease, the parent's own cwd, and every digest still matching. The guard that would
+ * have caught it can only fire when there is a spec to disagree with.
+ *
+ * `workspaceId` must therefore be the id of a workspace that was actually resolved and leased.
+ * `contextId` is a caller-declared label that nothing validates; it is included because it can only
+ * ever NARROW a binding, and a mismatch fails closed.
+ */
+export declare function buildApprovalBinding(input: {
+    task: string;
+    requested: readonly Capability[];
+    effective: readonly Capability[];
+    definitionSha256?: DefinitionDigest["sha256"] | string;
+    parentId: string;
+    /** Id of a workspace this delegation was actually routed to and holds a lease for. */
+    workspaceId?: string;
+    /** Caller-declared label. Narrows only; never a claim that anything was enforced. */
+    contextId?: string;
+}): ApprovalBinding;
+export declare function approvalBindingDigest(binding: ApprovalBinding): string;
+export declare function isApprovalBinding(value: unknown): value is ApprovalBinding;
+export declare function approvalBindingsEqual(a: ApprovalBinding | undefined, b: ApprovalBinding | undefined): boolean;
+//# sourceMappingURL=correlation.d.ts.map

package/dist/correlation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"correlation.d.ts","sourceRoot":"","sources":["../src/correlation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAiDD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAyD5G;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAG9E;AAED,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,GAAG,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,UAAU,EAAE,CAAC;IACjC,SAAS,EAAE,SAAS,UAAU,EAAE,CAAC;IACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,eAAe,CAelB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CActE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAmB1E;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,eAAe,GAAG,SAAS,EAAE,CAAC,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAI7G"}