pi-daddy 0.21.1 → 0.22.0

package/CHANGELOG.md

@@ -12,12 +12,31 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.22.0 — fail-closed audit follow-ups (2026-09-04)
+
+- **BREAKING — invalid project stores now fail closed.** Malformed, unsupported, unreadable and wrong-directory
+  stores never restore the ungoverned wildcard; `GRANT_STORE_INVALID` records the safety stop. Repair the store
+  or deliberately rerun `/grants init` rather than relying on invalid state being treated as absent.
+- **BREAKING — explicit delegation models are resolved before any side effect.** Models absent from pi's session
+  catalogue refuse as `MODEL_UNRESOLVED`. Register custom models with pi, or deliberately set the operator
+  escape hatch `PI_GRANTS_ALLOW_UNRESOLVED_MODELS=1`.
+- **BREAKING — correlation inputs are narrower.** `schema_version`, when present, must be exactly `"1.0"`, and
+  `assurance_scope` must use the closed entire-run/selectors union instead of arbitrary JSON. Strict ledger-v3
+  consumers must re-pin to the regenerated schema and fixtures, which also add `GRANT_STORE_INVALID` and
+  `MODEL_UNRESOLVED` to the refusal enum.
+- Supplied `tree_sha` and `last_change_seq` now narrow exact approval reuse. `@types/node >=22` is declared as
+  a peer because the public declarations use `NodeJS.*`.
+- Primary operation errors are preserved when Herdr, named-check, Git-index, or init cleanup also fails. Every
+  finalizer still runs and its failures remain visible; an attached Herdr close failure still retains the
+  workspace writer lease.
+- CI runs the model-free, Herdr-free real-pi integration tier.
+
 ## 0.21.1 — twenty-minute default child timeout (2026-09-02)
 
 - Raise the default per-child wall-clock limit from 600 to 1200 seconds. Explicit
   `PI_GRANTS_CHILD_TIMEOUT` values remain unchanged and inherited by descendants.
 
-## 0.21.0 — one project init enables its ledger (2026-09-01)
+## 0.21.0 — one project init enables its ledger (2026-09-02)
 
 - `/grants init` now atomically persists one project choice containing both the capability grant and default
   `.pi/grants.jsonl`, then adopts both after that write succeeds. Future plain `pi` starts load both, so

package/README.md

@@ -141,7 +141,7 @@ A delegator that legitimately holds `fabric_exec` and knowingly wants a child to
 that child. `assertNarrowing`'s `allowUniversal` flag exists but is deliberately not plumbed through; the
 first real need for that override is the evidence it should be added.
 
-## The two tools
+## The three tools
 
 ```
 delegate({ task: "summarise src/", agent: "docs-writer" })     // preferred: an operator-authored definition
@@ -156,7 +156,7 @@ delegate_all({ children: [ {…}, {…}, {…} ] })                  // several
 - **Spawning is itself a capability.** Grant `delegate` and the child can sub-delegate; withhold it and the
   child is a leaf — the extension is only passed to children that hold it, so the machinery isn't even
   present. `PI_GRANTS_MAX_DEPTH` remains a backstop.
-- **A refusal is a tool *error*, not an answer.** Both tools throw, because `AgentToolResult` has **no
+- **A refusal is a tool *error*, not an answer.** All three tools throw, because `AgentToolResult` has **no
   `isError` field** — pi sets it only when `execute` throws, and a normal return is hardcoded
   `isError: false`. Until 0.5.0 the tool returned `isError: true`, which was silently discarded, so every
   refusal this package made was recorded by pi as a **successful** tool call. Found by the integration suite
@@ -593,6 +593,7 @@ everything below it.
 | `PI_GRANTS_WORKSPACE_REGISTRY` | unset | Operator-owned `{version:1, workspaces:{id:{path}}}` file, required only for workspace-routed spawns. |
 | `PI_GRANTS_WORKSPACE_LEASE_DIR` | under `$PI_CODING_AGENT_DIR/pi-daddy/` | Kernel writer locks and ownership metadata. |
 | `PI_GRANTS_CHILD_TIMEOUT` | `1200` (seconds) | Wall-clock limit for a child. Inherited by descendants — an operator preference, deliberately *not* attenuating state. |
+| `PI_GRANTS_ALLOW_UNRESOLVED_MODELS` | unset | Exact `1` lets pi attempt custom model resolution; otherwise an explicit provider/id missing from pi's session catalogue refuses before lease, approval or spawn. |
 | `PI_GRANTS_FANOUT` | `8` | Per-call width and downward subtree budget; not a session-total counter. Malformed or `0` falls back to the default. |
 | `PI_GRANTS_PARENT_ID` | `d0` | Readable logical tree position; set by the parent and allowed to repeat across calls. |
 | `PI_GRANTS_EXECUTION_ID` | unset at a root | Unique governed execution occurrence; set by the parent. Lifecycle/lease joins use this, never `PI_GRANTS_PARENT_ID`. |
@@ -601,7 +602,9 @@ everything below it.
 | `PI_GRANTS_HERDR_KEEP_PANE` | unset | `1` keeps each child's pane for inspection, and no sweep closes it. Off by default: a fan-out would flood the workspace. |
 | `PI_CODING_AGENT_DIR` | `~/.pi/agent` | pi's own variable, not ours — but it decides where stored project grants/ledger consent and persisted approvals live. |
 
-**A malformed value disables spawning; it never falls back to a default.** An unreadable
+**A malformed value disables spawning; it never falls back to a default.** Stored grants are likewise
+tri-state: only a missing file is opt-out; malformed, unsupported-version, unreadable or wrong-cwd state is a
+loud empty-grant session with a `GRANT_STORE_INVALID` ledger line. An unreadable
 `PI_GRANTS_MAX_DEPTH` or `PI_GRANTS_DEPTH` yields `maxDepth: 0` and a startup warning naming the
 variable. Before 0.5.0 these were read with `parseInt`, which accepts numeric prefixes (`"2abc"` → `2`)
 and otherwise gives `NaN` — and since every comparison against `NaN` is false, a typo did not tighten the
@@ -632,8 +635,10 @@ timed out. A pending running append always lands before a terminal event. `denie
 is invisible without a record.**
 
 Workflow facts are identifier-only and mark `planned`, `observed`, or `controller_validated`; they can never
-claim pi-daddy enforcement. Capability/lifecycle records are the enforced class. Correlation remains a
-caller-declared label; fields eligible for display must use the v3 ASCII identifier grammar rather than prose.
+claim pi-daddy enforcement. Capability/lifecycle records are the enforced class. Correlation remains
+caller-declared: optional `schema_version` is exactly `1.0`, and `assurance_scope` is either entire-run with an
+empty selector list or selectors with one or more non-empty strings. Fields eligible for display use the v3
+ASCII identifier grammar rather than prose.
 
 **Privacy is a property of this file, and the boundary is exact: capability ids, counts and identifiers only
 — never prompts, task text, tool arguments or results.** Trusted `definitionDigest` and `taskDigest` values
@@ -784,9 +789,9 @@ every in-repo test passed. `npm run test:smoke` packs a tarball, installs it int
 ## Testing
 
 ```bash
-npm test                   # 719 unit tests. Fast, pure, no pi, no network.
+npm test                   # 741 unit tests. Fast, pure, no pi, no network.
 npm run typecheck          # src + extensions + tests + integration tests
-npm run test:integration   # 45 tests against a REAL pi process. ~55s, no model tokens.
+npm run test:integration   # 48 tests against a REAL pi process/Herdr server, no model tokens.
 npm run test:smoke         # pack/install; exercise library exports, both bins, the v2/v3 contracts,
                            # bundled Herdr plugin, dashboard, and `pi-daddy init`
 PI_GRANTS_IT_MODEL=1 npm run test:integration   # + 10 end-to-end tests with a real model. Costs money.

package/contracts/ledger/v3/fixtures/capability-decision.json

@@ -24,11 +24,10 @@
     "policy_label": "policy-contract",
     "assurance_source": "policy",
     "assurance_scope": {
-      "kind": "changed-files",
-      "paths": [
+      "type": "selectors",
+      "selectors": [
         "src/**"
-      ],
-      "include_untracked": true
+      ]
     },
     "activated_at": "2026-08-20T12:00:00.000Z",
     "plan_digest": "1111111111111111111111111111111111111111111111111111111111111111",

package/contracts/ledger/v3/fixtures/check-receipt.json

@@ -21,11 +21,10 @@
     "policy_label": "policy-contract",
     "assurance_source": "policy",
     "assurance_scope": {
-      "kind": "changed-files",
-      "paths": [
+      "type": "selectors",
+      "selectors": [
         "src/**"
-      ],
-      "include_untracked": true
+      ]
     },
     "activated_at": "2026-08-20T12:00:00.000Z",
     "plan_digest": "1111111111111111111111111111111111111111111111111111111111111111",

package/contracts/ledger/v3/fixtures/child-lifecycle.json

@@ -24,11 +24,10 @@
     "policy_label": "policy-contract",
     "assurance_source": "policy",
     "assurance_scope": {
-      "kind": "changed-files",
-      "paths": [
+      "type": "selectors",
+      "selectors": [
         "src/**"
-      ],
-      "include_untracked": true
+      ]
     },
     "activated_at": "2026-08-20T12:00:00.000Z",
     "plan_digest": "1111111111111111111111111111111111111111111111111111111111111111",

package/contracts/ledger/v3/fixtures/workflow-fact.json

@@ -20,11 +20,10 @@
     "policy_label": "policy-contract",
     "assurance_source": "policy",
     "assurance_scope": {
-      "kind": "changed-files",
-      "paths": [
+      "type": "selectors",
+      "selectors": [
         "src/**"
-      ],
-      "include_untracked": true
+      ]
     },
     "activated_at": "2026-08-20T12:00:00.000Z",
     "plan_digest": "1111111111111111111111111111111111111111111111111111111111111111",

package/contracts/ledger/v3/fixtures/workspace-lease.json

@@ -22,11 +22,10 @@
     "policy_label": "policy-contract",
     "assurance_source": "policy",
     "assurance_scope": {
-      "kind": "changed-files",
-      "paths": [
+      "type": "selectors",
+      "selectors": [
         "src/**"
-      ],
-      "include_untracked": true
+      ]
     },
     "activated_at": "2026-08-20T12:00:00.000Z",
     "plan_digest": "1111111111111111111111111111111111111111111111111111111111111111",

package/contracts/ledger/v3/ledger-event.schema.json

@@ -28,10 +28,10 @@
     },
     "correlation": {
       "type": "object",
-      "description": "Opaque, non-authoritative controller metadata. String and aggregate byte limits are additionally enforced by the runtime and cannot be represented exactly in JSON Schema.",
+      "description": "Non-authoritative controller metadata under the pinned 1.0 contract. String and aggregate byte limits are additionally enforced by the runtime and cannot be represented exactly in JSON Schema.",
       "properties": {
         "schema_version": {
-          "$ref": "#/$defs/ledgerCorrelationIdentifier"
+          "const": "1.0"
         },
         "run_id": {
           "$ref": "#/$defs/ledgerCorrelationIdentifier"
@@ -63,19 +63,42 @@
         "assurance_scope": {
           "oneOf": [
             {
-              "type": "object"
-            },
-            {
-              "type": "array"
-            },
-            {
-              "type": "string"
-            },
-            {
-              "type": "number"
+              "type": "object",
+              "properties": {
+                "type": {
+                  "const": "entire-run"
+                },
+                "selectors": {
+                  "type": "array",
+                  "maxItems": 0
+                }
+              },
+              "required": [
+                "type",
+                "selectors"
+              ],
+              "additionalProperties": false
             },
             {
-              "type": "boolean"
+              "type": "object",
+              "properties": {
+                "type": {
+                  "const": "selectors"
+                },
+                "selectors": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                }
+              },
+              "required": [
+                "type",
+                "selectors"
+              ],
+              "additionalProperties": false
             }
           ]
         },
@@ -150,6 +173,8 @@
         "DEPTH_EXCEEDED",
         "FANOUT_EXCEEDED",
         "EXECUTOR_UNAVAILABLE",
+        "MODEL_UNRESOLVED",
+        "GRANT_STORE_INVALID",
         "CHILD_TIMED_OUT",
         "CHILD_CANCELLED",
         "CHILD_EXIT_NONZERO",

package/dist/check-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-runner.d.ts","sourceRoot":"","sources":["../src/check-runner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AASlF,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,eAAe,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAKD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,eAAe,EAC3B,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,MAAM,CAAC,UAAU,CAWnB;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC,CA8ND"}
+{"version":3,"file":"check-runner.d.ts","sourceRoot":"","sources":["../src/check-runner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUlF,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,eAAe,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAKD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,eAAe,EAC3B,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,MAAM,CAAC,UAAU,CAWnB;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC,CAyOD"}

package/dist/check-runner.js

@@ -3,6 +3,7 @@ import { chmod, mkdtemp, readFile, realpath, rm, stat, writeFile } from "node:fs
 import { tmpdir } from "node:os";
 import { basename, isAbsolute, join } from "node:path";
 import { normaliseCorrelation } from "./correlation.js";
+import { runWithFinalizers } from "./finalization.js";
 import { appendLedgerEvent, buildCheckReceiptLedgerEvent, buildWorkspaceLeaseEvent, } from "./ledger.js";
 import { computeGitCandidateIdentity } from "./git-identity.js";
 import { runChild } from "./run-child.js";
@@ -77,173 +78,184 @@ export async function runNamedCheck(input) {
     /** Failures of best-effort RECORDS, reported alongside whatever actually happened — never instead of it. */
     const notes = [];
     let releaseReason = "failed";
-    try {
+    return runWithFinalizers(async () => {
         try {
-            lease = await acquireWorkspaceLease({
-                workspace: input.workspace, access: leaseAccess, leaseDir: input.leaseDir ?? defaultWorkspaceLeaseDir(),
-                ownerId, signal: input.signal,
+            try {
+                lease = await acquireWorkspaceLease({
+                    workspace: input.workspace, access: leaseAccess, leaseDir: input.leaseDir ?? defaultWorkspaceLeaseDir(),
+                    ownerId, signal: input.signal,
+                });
+            }
+            catch (error) {
+                if (input.ledgerPath)
+                    await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+                        executionId, parentExecutionId,
+                        childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                        outcome: "refused",
+                        correlation, now: new Date(),
+                        ...(error instanceof GovernanceRefusal
+                            ? { refusal: { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) } }
+                            : {}),
+                    }));
+                throw error;
+            }
+            if (input.ledgerPath) {
+                try {
+                    await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+                        executionId, parentExecutionId,
+                        childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                        outcome: leaseAcquisitionOutcome(leaseAccess, lease.recovered), recovered: lease.recovered,
+                        correlation, now: new Date(),
+                    }));
+                }
+                catch (error) {
+                    await lease.release("ledger-failed");
+                    lease = undefined;
+                    throw error;
+                }
+            }
+            const before = await computeGitCandidateIdentity(input.workspace);
+            for (const [name, supplied, actual] of [
+                ["head_sha", correlation?.head_sha, before.headSha], ["tree_sha", correlation?.tree_sha, before.treeSha],
+            ]) {
+                if (supplied && supplied !== actual)
+                    throw new GovernanceRefusal(refusal("CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} ${name} does not match the validated workspace`, { check_id: input.checkId, supplied, actual }));
+            }
+            const executableBytes = await readFile(executable);
+            const executableSha256 = createHash("sha256").update(executableBytes).digest("hex");
+            stagedDir = await mkdtemp(join(tmpdir(), "pi-daddy-check-exec-"));
+            const stagedExecutable = join(stagedDir, basename(executable));
+            await writeFile(stagedExecutable, executableBytes, { mode: 0o700 });
+            await chmod(stagedExecutable, 0o700);
+            const leaseAbort = new AbortController();
+            let leaseLost = false;
+            lease.lost.then(() => { leaseLost = true; leaseAbort.abort(); });
+            const checkSignal = input.signal ? AbortSignal.any([input.signal, leaseAbort.signal]) : leaseAbort.signal;
+            const started = new Date();
+            const result = await runChild({
+                command: "setpriv", args: ["--pdeathsig", "KILL", "--", stagedExecutable, ...definition.argv],
+                env: buildCheckEnvironment(definition, input.inheritedEnv), cwd: input.workspace.root,
+                signal: checkSignal, timeoutMs: definition.timeout_ms, maxOutputBytes: definition.max_output_bytes,
+                onSpawn: (pid) => lease.attachProcess(pid),
             });
-        }
-        catch (error) {
+            const ended = new Date();
+            releaseReason = input.signal?.aborted ? "cancelled" : result.timedOut ? "timeout" : result.aborted ? "failed" : "completed";
+            // Every throw below re-stamps this. Without that, a check refused for CHECK_IDENTITY_MISMATCH still
+            // wrote `released / completed` from the `finally` — the LAST lease event for that owner — so the trail
+            // still read like a clean run and `verifyLedger` still counted a clean release. The R-114 fix added a
+            // refusal line beside the misleading one instead of correcting it.
+            if (result.spawnError)
+                throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} could not start its constrained executor`, { check_id: input.checkId }));
+            if (leaseLost)
+                throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease while running`, { check_id: input.checkId }));
+            const after = await computeGitCandidateIdentity(input.workspace);
+            if (leaseLost)
+                throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`, { check_id: input.checkId }));
+            if (before.headSha !== after.headSha || before.treeSha !== after.treeSha) {
+                throw new GovernanceRefusal(refusal("CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} workspace changed while it ran`, { check_id: input.checkId }));
+            }
+            // The candidate is now measured and the process is dead. End the lease before writing the receipt so
+            // lease loss cannot race a blocked ledger append and leave behind evidence from an unprotected run.
+            // Record what release actually DID. This asserted `released` unconditionally and threw the outcome
+            // away, so the evidence path reproduced the very defect the outcome union was added to expose: a lost
+            // or unrecorded handover ledgered as a clean one, with `lease = undefined` stopping the `finally` from
+            // ever noticing (R-100/R-103, found while reviewing the fix for R-99).
+            const releaseOutcome = await lease.release(releaseReason);
+            lease = undefined;
+            if (leaseLost)
+                throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`, { check_id: input.checkId }));
             if (input.ledgerPath)
                 await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
                     executionId, parentExecutionId,
                     childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-                    outcome: "refused",
-                    correlation, now: new Date(),
-                    ...(error instanceof GovernanceRefusal
-                        ? { refusal: { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) } }
-                        : {}),
+                    outcome: leaseReleaseLedgerOutcome(releaseOutcome, releaseReason), releaseReason, correlation, now: new Date(),
                 }));
-            throw error;
-        }
-        if (input.ledgerPath) {
-            try {
-                await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+            const body = {
+                schema_version: "1.0", check_id: input.checkId, executable, executable_sha256: executableSha256,
+                argv: [...definition.argv], argv_sha256: argvSha256, cwd: input.workspace.root, cwd_sha256: cwdSha256,
+                started_at: started.toISOString(), ended_at: ended.toISOString(), exit_code: result.code,
+                signal: result.signal ?? null, timed_out: result.timedOut, aborted: result.aborted, truncated: result.truncated,
+                output_sha256: createHash("sha256").update(result.text, "utf8").digest("hex"),
+                workspace_id: input.workspace.workspaceId, workspace_access: access,
+                head_sha: before.headSha, tree_sha: before.treeSha, ...(correlation ? { correlation } : {}),
+            };
+            const receipt = { receipt_id: receiptId(body), ...body };
+            if (input.ledgerPath) {
+                await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildCheckReceiptLedgerEvent({
                     executionId, parentExecutionId,
-                    childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-                    outcome: leaseAcquisitionOutcome(leaseAccess, lease.recovered), recovered: lease.recovered,
-                    correlation, now: new Date(),
+                    childId: ownerId, receiptId: receipt.receipt_id, workspaceId: input.workspace.workspaceId,
+                    checkId: input.checkId, treeSha: receipt.tree_sha, correlation, now: ended,
                 }));
             }
-            catch (error) {
-                await lease.release("ledger-failed");
-                lease = undefined;
-                throw error;
-            }
-        }
-        const before = await computeGitCandidateIdentity(input.workspace);
-        for (const [name, supplied, actual] of [
-            ["head_sha", correlation?.head_sha, before.headSha], ["tree_sha", correlation?.tree_sha, before.treeSha],
-        ]) {
-            if (supplied && supplied !== actual)
-                throw new GovernanceRefusal(refusal("CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} ${name} does not match the validated workspace`, { check_id: input.checkId, supplied, actual }));
-        }
-        const executableBytes = await readFile(executable);
-        const executableSha256 = createHash("sha256").update(executableBytes).digest("hex");
-        stagedDir = await mkdtemp(join(tmpdir(), "pi-daddy-check-exec-"));
-        const stagedExecutable = join(stagedDir, basename(executable));
-        await writeFile(stagedExecutable, executableBytes, { mode: 0o700 });
-        await chmod(stagedExecutable, 0o700);
-        const leaseAbort = new AbortController();
-        let leaseLost = false;
-        lease.lost.then(() => { leaseLost = true; leaseAbort.abort(); });
-        const checkSignal = input.signal ? AbortSignal.any([input.signal, leaseAbort.signal]) : leaseAbort.signal;
-        const started = new Date();
-        const result = await runChild({
-            command: "setpriv", args: ["--pdeathsig", "KILL", "--", stagedExecutable, ...definition.argv],
-            env: buildCheckEnvironment(definition, input.inheritedEnv), cwd: input.workspace.root,
-            signal: checkSignal, timeoutMs: definition.timeout_ms, maxOutputBytes: definition.max_output_bytes,
-            onSpawn: (pid) => lease.attachProcess(pid),
-        });
-        const ended = new Date();
-        releaseReason = input.signal?.aborted ? "cancelled" : result.timedOut ? "timeout" : result.aborted ? "failed" : "completed";
-        // Every throw below re-stamps this. Without that, a check refused for CHECK_IDENTITY_MISMATCH still
-        // wrote `released / completed` from the `finally` — the LAST lease event for that owner — so the trail
-        // still read like a clean run and `verifyLedger` still counted a clean release. The R-114 fix added a
-        // refusal line beside the misleading one instead of correcting it.
-        if (result.spawnError)
-            throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} could not start its constrained executor`, { check_id: input.checkId }));
-        if (leaseLost)
-            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease while running`, { check_id: input.checkId }));
-        const after = await computeGitCandidateIdentity(input.workspace);
-        if (leaseLost)
-            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`, { check_id: input.checkId }));
-        if (before.headSha !== after.headSha || before.treeSha !== after.treeSha) {
-            throw new GovernanceRefusal(refusal("CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} workspace changed while it ran`, { check_id: input.checkId }));
-        }
-        // The candidate is now measured and the process is dead. End the lease before writing the receipt so
-        // lease loss cannot race a blocked ledger append and leave behind evidence from an unprotected run.
-        // Record what release actually DID. This asserted `released` unconditionally and threw the outcome
-        // away, so the evidence path reproduced the very defect the outcome union was added to expose: a lost
-        // or unrecorded handover ledgered as a clean one, with `lease = undefined` stopping the `finally` from
-        // ever noticing (R-100/R-103, found while reviewing the fix for R-99).
-        const releaseOutcome = await lease.release(releaseReason);
-        lease = undefined;
-        if (leaseLost)
-            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`, { check_id: input.checkId }));
-        if (input.ledgerPath)
-            await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
-                executionId, parentExecutionId,
-                childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-                outcome: leaseReleaseLedgerOutcome(releaseOutcome, releaseReason), releaseReason, correlation, now: new Date(),
-            }));
-        const body = {
-            schema_version: "1.0", check_id: input.checkId, executable, executable_sha256: executableSha256,
-            argv: [...definition.argv], argv_sha256: argvSha256, cwd: input.workspace.root, cwd_sha256: cwdSha256,
-            started_at: started.toISOString(), ended_at: ended.toISOString(), exit_code: result.code,
-            signal: result.signal ?? null, timed_out: result.timedOut, aborted: result.aborted, truncated: result.truncated,
-            output_sha256: createHash("sha256").update(result.text, "utf8").digest("hex"),
-            workspace_id: input.workspace.workspaceId, workspace_access: access,
-            head_sha: before.headSha, tree_sha: before.treeSha, ...(correlation ? { correlation } : {}),
-        };
-        const receipt = { receipt_id: receiptId(body), ...body };
-        if (input.ledgerPath) {
-            await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildCheckReceiptLedgerEvent({
-                executionId, parentExecutionId,
-                childId: ownerId, receiptId: receipt.receipt_id, workspaceId: input.workspace.workspaceId,
-                checkId: input.checkId, treeSha: receipt.tree_sha, correlation, now: ended,
-            }));
-        }
-        return { output: result.text, exitCode: result.code, signal: result.signal ?? null, receipt };
-    }
-    catch (error) {
-        // The run did not complete, so the release must not be recorded as if it had. Without this the
-        // `finally` wrote `released / completed` as the LAST lease event for a refused check, so the trail
-        // still read like a clean run and `verifyLedger` still counted a clean release — the R-114 fix put a
-        // refusal line beside the misleading one instead of correcting it.
-        if (releaseReason === "completed")
-            releaseReason = "refused";
-        // The single most important negative result this feature can produce — CHECK_IDENTITY_MISMATCH, "the
-        // workspace changed while the check ran" — used to leave NO ledger evidence at all, while the
-        // `finally` recorded `released, reason: completed`, so the trail read like a clean run (R-114).
-        if (input.ledgerPath) {
-            await appendLedgerEvent({
-                path: input.ledgerPath,
-                // Best effort, and loud: this records a failure, so it must not replace the failure. A strict
-                // append that threw here would substitute "ledger write failed" for the evidence-integrity
-                // refusal that actually happened (R-115).
-                strict: false,
-                // NOT empty. `onFailure` exists because a non-strict append is a choice not to fail closed and
-                // never a choice to be silent — the comment above says "loud", and an empty callback is the
-                // definition of swallowing. This guards the evidence record itself, so losing it silently is
-                // how a mutated workspace came to leave a trail that read like a clean run.
-                onFailure: (cause) => { notes.push(`check refusal record failed: ${String(cause)}`); },
-            }, buildWorkspaceLeaseEvent({
-                executionId, parentExecutionId,
-                childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-                outcome: "refused",
-                refusal: error instanceof GovernanceRefusal
-                    ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
-                    : refusal("CHECK_IDENTITY_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} failed (${String(error)})`),
-                correlation, now: new Date(),
-            }));
+            return { output: result.text, exitCode: result.code, signal: result.signal ?? null, receipt };
         }
-        throw error;
-    }
-    finally {
-        if (stagedDir)
-            await rm(stagedDir, { recursive: true, force: true });
-        if (lease) {
-            // `release()` cannot throw (R-99), and the record of it is best-effort for the same reason as
-            // above: a `finally` that throws destroys whatever the caller was already returning or raising.
-            const outcome = await lease.release(releaseReason);
-            if (input.ledgerPath)
+        catch (error) {
+            // The run did not complete, so the release must not be recorded as if it had. Without this the
+            // `finally` wrote `released / completed` as the LAST lease event for a refused check, so the trail
+            // still read like a clean run and `verifyLedger` still counted a clean release — the R-114 fix put a
+            // refusal line beside the misleading one instead of correcting it.
+            if (releaseReason === "completed")
+                releaseReason = "refused";
+            // The single most important negative result this feature can produce — CHECK_IDENTITY_MISMATCH, "the
+            // workspace changed while the check ran" — used to leave NO ledger evidence at all, while the
+            // `finally` recorded `released, reason: completed`, so the trail read like a clean run (R-114).
+            if (input.ledgerPath) {
                 await appendLedgerEvent({
                     path: input.ledgerPath,
+                    // Best effort, and loud: this records a failure, so it must not replace the failure. A strict
+                    // append that threw here would substitute "ledger write failed" for the evidence-integrity
+                    // refusal that actually happened (R-115).
                     strict: false,
-                    onFailure: (cause) => { notes.push(`check lease release record failed: ${String(cause)}`); },
+                    // NOT empty. `onFailure` exists because a non-strict append is a choice not to fail closed and
+                    // never a choice to be silent — the comment above says "loud", and an empty callback is the
+                    // definition of swallowing. This guards the evidence record itself, so losing it silently is
+                    // how a mutated workspace came to leave a trail that read like a clean run.
+                    onFailure: (cause) => { notes.push(`check refusal record failed: ${String(cause)}`); },
                 }, buildWorkspaceLeaseEvent({
                     executionId, parentExecutionId,
                     childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-                    outcome: outcome === "lost"
-                        ? "lost"
-                        : outcome === "released-unrecorded"
-                            ? "released-unrecorded"
-                            : releaseReason === "timeout" ? "timeout" : "released",
-                    releaseReason, correlation, now: new Date(),
+                    outcome: "refused",
+                    refusal: error instanceof GovernanceRefusal
+                        ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
+                        : refusal("CHECK_IDENTITY_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} failed (${String(error)})`),
+                    correlation, now: new Date(),
                 }));
+            }
+            throw error;
         }
-    }
+    }, [
+        {
+            label: "staged check cleanup failed",
+            run: async () => {
+                if (stagedDir)
+                    await rm(stagedDir, { recursive: true, force: true });
+            },
+        },
+        {
+            label: "workspace lease finalizer failed",
+            run: async () => {
+                if (!lease)
+                    return;
+                // `release()` cannot throw (R-99), and the record of it is best-effort for the same reason as
+                // above: a finalizer must not destroy whatever the caller was already returning or raising.
+                const outcome = await lease.release(releaseReason);
+                if (input.ledgerPath)
+                    await appendLedgerEvent({
+                        path: input.ledgerPath,
+                        strict: false,
+                        onFailure: (cause) => { notes.push(`check lease release record failed: ${String(cause)}`); },
+                    }, buildWorkspaceLeaseEvent({
+                        executionId, parentExecutionId,
+                        childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                        outcome: outcome === "lost"
+                            ? "lost"
+                            : outcome === "released-unrecorded"
+                                ? "released-unrecorded"
+                                : releaseReason === "timeout" ? "timeout" : "released",
+                        releaseReason, correlation, now: new Date(),
+                    }));
+            },
+        },
+    ]);
 }
 //# sourceMappingURL=check-runner.js.map