pi-daddy 0.22.0 → 0.23.0

package/contracts/ledger/v4/fixtures/work-acceptance.json

@@ -0,0 +1,57 @@
+{
+  "ledgerVersion": 4,
+  "event": "work_acceptance",
+  "eventId": "acceptance",
+  "ts": "2026-09-06T12:00:00.000Z",
+  "payload": {
+    "authorityId": "authority",
+    "binding": {
+      "intent": {
+        "kind": "goal",
+        "id": "goal",
+        "revision": 1,
+        "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      },
+      "obligation": {
+        "kind": "obligation",
+        "id": "obligation",
+        "revision": 1,
+        "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      },
+      "artifact": {
+        "kind": "artifact",
+        "id": "artifact",
+        "revision": 1,
+        "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      },
+      "policy": {
+        "kind": "policy",
+        "id": "policy",
+        "revision": 1,
+        "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      },
+      "scope": {
+        "kind": "scope",
+        "id": "scope",
+        "revision": 1,
+        "digest": "191d991431d5dcbd940304f916579e57540e0d555e263f6d22a0e8aa4e416233"
+      },
+      "snapshot": {
+        "id": "snapshot",
+        "digest": "6fe1623dda96511e95e862b1f2714f9f909e2bf2b585dbd10af1ff52f3f7b5f8"
+      },
+      "artifactDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "evidence": [
+        {
+          "id": "evidence",
+          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "event": {
+            "eventId": "occurrence",
+            "digest": "36935a3a42473122ebfb359371131311270253b0959101e047f8f5d75dbf639d"
+          }
+        }
+      ]
+    }
+  },
+  "digest": "219fc728cd50368d7679f3d0db9bdb217c1fac06db6bde07373750a3671a0877"
+}

package/contracts/ledger/v4/fixtures/work-occurrence.json

@@ -0,0 +1,44 @@
+{
+  "ledgerVersion": 4,
+  "event": "work_occurrence",
+  "eventId": "occurrence",
+  "ts": "2026-09-06T12:00:00.000Z",
+  "payload": {
+    "scope": {
+      "kind": "scope",
+      "id": "scope",
+      "revision": 1,
+      "digest": "191d991431d5dcbd940304f916579e57540e0d555e263f6d22a0e8aa4e416233"
+    },
+    "obligation": {
+      "kind": "obligation",
+      "id": "obligation",
+      "revision": 1,
+      "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    },
+    "executionId": "exec:00000000-0000-4000-8000-000000000001",
+    "parentExecutionId": null,
+    "childId": null,
+    "variantId": null,
+    "artifact": {
+      "kind": "artifact",
+      "id": "artifact",
+      "revision": 1,
+      "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    },
+    "provenance": "observed",
+    "state": "completed",
+    "labels": {
+      "sessionId": null,
+      "branchLeafId": null,
+      "toolCallId": null,
+      "taskId": null,
+      "workspaceId": null,
+      "definitionDigest": null,
+      "configurationDigest": null,
+      "modelId": null,
+      "effortId": null
+    }
+  },
+  "digest": "36935a3a42473122ebfb359371131311270253b0959101e047f8f5d75dbf639d"
+}

package/contracts/ledger/v4/fixtures/work-revision.json

@@ -0,0 +1,26 @@
+{
+  "ledgerVersion": 4,
+  "event": "work_revision",
+  "eventId": "revision",
+  "ts": "2026-09-06T12:00:00.000Z",
+  "payload": {
+    "revision": {
+      "kind": "scope",
+      "id": "scope",
+      "scopeId": "scope",
+      "revision": 1,
+      "predecessor": null,
+      "contentDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "parent": null,
+      "dependencies": [],
+      "ownerId": "owner",
+      "permittedEffects": [
+        "read",
+        "write"
+      ],
+      "policy": null,
+      "digest": "191d991431d5dcbd940304f916579e57540e0d555e263f6d22a0e8aa4e416233"
+    }
+  },
+  "digest": "166a77a5c489dd37a350c6f0faa1058ea8ca4e764f35d8d21a19a083c6291c0a"
+}

package/contracts/ledger/v4/fixtures/work-snapshot.json

@@ -0,0 +1,73 @@
+{
+  "ledgerVersion": 4,
+  "event": "work_snapshot",
+  "eventId": "snapshot",
+  "ts": "2026-09-06T12:00:00.000Z",
+  "payload": {
+    "snapshot": {
+      "snapshotId": "snapshot",
+      "scope": {
+        "kind": "scope",
+        "id": "scope",
+        "revision": 1,
+        "digest": "191d991431d5dcbd940304f916579e57540e0d555e263f6d22a0e8aa4e416233"
+      },
+      "revisions": [
+        {
+          "kind": "artifact",
+          "id": "artifact",
+          "revision": 1,
+          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        {
+          "kind": "goal",
+          "id": "goal",
+          "revision": 1,
+          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        {
+          "kind": "obligation",
+          "id": "obligation",
+          "revision": 1,
+          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        {
+          "kind": "policy",
+          "id": "policy",
+          "revision": 1,
+          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        }
+      ],
+      "bindings": [
+        {
+          "intent": {
+            "kind": "goal",
+            "id": "goal",
+            "revision": 1,
+            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+          },
+          "obligation": {
+            "kind": "obligation",
+            "id": "obligation",
+            "revision": 1,
+            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+          },
+          "artifact": {
+            "kind": "artifact",
+            "id": "artifact",
+            "revision": 1,
+            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+          },
+          "policy": {
+            "kind": "policy",
+            "id": "policy",
+            "revision": 1,
+            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+          }
+        }
+      ],
+      "digest": "6fe1623dda96511e95e862b1f2714f9f909e2bf2b585dbd10af1ff52f3f7b5f8"
+    }
+  },
+  "digest": "28dcb24ddd9d81bee400fd94dc07850794faabdf62419178f3dd64269ab013d8"
+}

package/contracts/ledger/v4/ledger-event.schema.json

@@ -0,0 +1,162 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/mojomanyana/pi-daddy/contracts/ledger/v4/ledger-event.schema.json",
+  "title": "pi-daddy candidate ledgerVersion 4 work event",
+  "description": "One closed work-v4 event, not a grant or authority receipt. Strict text ingestion additionally verifies duplicate members, exact numeric tokens, canonical sets, digests and byte/depth limits. Projection separately resolves graphs and explicit host authority; schema conformance never proves acceptance.",
+  "oneOf": [
+    { "$ref": "#/$defs/workRevisionEvent" },
+    { "$ref": "#/$defs/workSnapshotEvent" },
+    { "$ref": "#/$defs/workOccurrenceEvent" },
+    { "$ref": "#/$defs/workAcceptanceEvent" }
+  ],
+  "$defs": {
+    "id": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]{0,127}$" },
+    "digest": { "type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[0-9a-f]{64}$" },
+    "revisionNumber": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 },
+    "timestamp": {
+      "type": "string", "format": "date-time", "minLength": 24, "maxLength": 24,
+      "pattern": "^(?!0000)[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\\.[0-9]{3}Z$",
+      "$comment": "The runtime always verifies the calendar date, independently of a schema validator's format support."
+    },
+    "executionId": {
+      "type": "string", "minLength": 41, "maxLength": 41,
+      "pattern": "^[eE][xX][eE][cC]:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+    },
+    "revisionKind": { "enum": ["scope", "goal", "node", "obligation", "artifact", "policy"] },
+    "occurrenceProvenance": { "enum": ["declared", "observed"] },
+    "occurrenceState": { "enum": ["unknown", "starting", "running", "completed", "failed"] },
+    "identity": {
+      "type": "object", "additionalProperties": false, "required": ["id", "digest"],
+      "properties": { "id": { "$ref": "#/$defs/id" }, "digest": { "$ref": "#/$defs/digest" } }
+    },
+    "eventRef": {
+      "type": "object", "additionalProperties": false, "required": ["eventId", "digest"],
+      "properties": { "eventId": { "$ref": "#/$defs/id" }, "digest": { "$ref": "#/$defs/digest" } }
+    },
+    "revisionRef": {
+      "type": "object", "additionalProperties": false, "required": ["kind", "id", "revision", "digest"],
+      "properties": {
+        "kind": { "$ref": "#/$defs/revisionKind" }, "id": { "$ref": "#/$defs/id" },
+        "revision": { "$ref": "#/$defs/revisionNumber" }, "digest": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "scopeRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "const": "scope" } } }] },
+    "intentRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "enum": ["goal", "node"] } } }] },
+    "goalParentRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "enum": ["scope", "goal"] } } }] },
+    "obligationRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "const": "obligation" } } }] },
+    "artifactRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "const": "artifact" } } }] },
+    "policyRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "const": "policy" } } }] },
+    "inventoryRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "enum": ["goal", "node", "obligation", "artifact", "policy"] } } }] },
+    "workRevision": {
+      "type": "object", "additionalProperties": false,
+      "required": ["kind", "id", "revision", "scopeId", "predecessor", "contentDigest", "parent", "dependencies", "ownerId", "permittedEffects", "policy", "digest"],
+      "properties": {
+        "kind": { "$ref": "#/$defs/revisionKind" }, "id": { "$ref": "#/$defs/id" }, "revision": { "$ref": "#/$defs/revisionNumber" },
+        "scopeId": { "$ref": "#/$defs/id" }, "predecessor": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/revisionRef" }] },
+        "contentDigest": { "$ref": "#/$defs/digest" }, "parent": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/revisionRef" }] },
+        "dependencies": { "type": "array", "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/obligationRef" } },
+        "ownerId": { "$ref": "#/$defs/id" },
+        "permittedEffects": { "type": "array", "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/id" } },
+        "policy": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/policyRef" }] }, "digest": { "$ref": "#/$defs/digest" }
+      },
+      "allOf": [
+        {
+          "if": { "type": "object", "properties": { "revision": { "const": 1 } } },
+          "then": { "type": "object", "properties": { "predecessor": { "type": "null" } } },
+          "else": { "type": "object", "properties": { "predecessor": { "$ref": "#/$defs/revisionRef" } } }
+        },
+        { "oneOf": [
+          { "type": "object", "properties": { "kind": { "const": "scope" }, "parent": { "type": "null" }, "dependencies": { "type": "array", "maxItems": 0 }, "policy": { "type": "null" } } },
+          { "type": "object", "properties": { "kind": { "const": "goal" }, "parent": { "$ref": "#/$defs/goalParentRef" }, "dependencies": { "type": "array", "maxItems": 0 }, "policy": { "type": "null" } } },
+          { "type": "object", "properties": { "kind": { "const": "node" }, "parent": { "$ref": "#/$defs/intentRef" }, "dependencies": { "type": "array", "maxItems": 0 }, "policy": { "type": "null" } } },
+          { "type": "object", "properties": { "kind": { "const": "obligation" }, "parent": { "$ref": "#/$defs/intentRef" }, "policy": { "$ref": "#/$defs/policyRef" } } },
+          { "type": "object", "properties": { "kind": { "enum": ["artifact", "policy"] }, "parent": { "type": "null" }, "dependencies": { "type": "array", "maxItems": 0 }, "permittedEffects": { "type": "array", "maxItems": 0 }, "policy": { "type": "null" } } }
+        ] }
+      ],
+      "$comment": "Runtime also requires scopeId=id for scope, same kind/id and exact predecessor revision+1, canonical list ordering, and own digest equality. Graph scope/history checks require the complete event snapshot."
+    },
+    "obligationBinding": {
+      "type": "object", "additionalProperties": false, "required": ["intent", "obligation", "artifact", "policy"],
+      "properties": {
+        "intent": { "$ref": "#/$defs/intentRef" }, "obligation": { "$ref": "#/$defs/obligationRef" },
+        "artifact": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/artifactRef" }] }, "policy": { "$ref": "#/$defs/policyRef" }
+      }
+    },
+    "workSnapshot": {
+      "type": "object", "additionalProperties": false, "required": ["snapshotId", "scope", "revisions", "bindings", "digest"],
+      "properties": {
+        "snapshotId": { "$ref": "#/$defs/id" }, "scope": { "$ref": "#/$defs/scopeRef" },
+        "revisions": { "type": "array", "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/inventoryRef" } },
+        "bindings": { "type": "array", "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/obligationBinding" } },
+        "digest": { "$ref": "#/$defs/digest" }
+      },
+      "$comment": "Runtime orders bindings by obligation ref, rejects duplicate obligation keys, and checks digests. Projection validates unique selected entities, exact bindings, same-scope ancestors, predecessors and dependencies."
+    },
+    "occurrenceLabels": {
+      "type": "object", "additionalProperties": false,
+      "required": ["sessionId", "branchLeafId", "toolCallId", "taskId", "workspaceId", "definitionDigest", "configurationDigest", "modelId", "effortId"],
+      "properties": {
+        "sessionId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
+        "branchLeafId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
+        "toolCallId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
+        "taskId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
+        "workspaceId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
+        "definitionDigest": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/digest" }] },
+        "configurationDigest": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/digest" }] },
+        "modelId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
+        "effortId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] }
+      }
+    },
+    "occurrencePayload": {
+      "type": "object", "additionalProperties": false,
+      "required": ["scope", "obligation", "executionId", "parentExecutionId", "childId", "variantId", "artifact", "provenance", "state", "labels"],
+      "properties": {
+        "scope": { "$ref": "#/$defs/scopeRef" }, "obligation": { "$ref": "#/$defs/obligationRef" }, "executionId": { "$ref": "#/$defs/executionId" },
+        "parentExecutionId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/executionId" }] },
+        "childId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] }, "variantId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
+        "artifact": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/artifactRef" }] },
+        "provenance": { "$ref": "#/$defs/occurrenceProvenance" }, "state": { "$ref": "#/$defs/occurrenceState" }, "labels": { "$ref": "#/$defs/occurrenceLabels" }
+      },
+      "$comment": "Runtime rejects self-parent execution identity. Provenance is wire evidence, never acceptance authority."
+    },
+    "evidenceRef": {
+      "type": "object", "additionalProperties": false, "required": ["id", "digest", "event"],
+      "properties": { "id": { "$ref": "#/$defs/id" }, "digest": { "$ref": "#/$defs/digest" }, "event": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/eventRef" }] } }
+    },
+    "acceptanceBinding": {
+      "type": "object", "additionalProperties": false,
+      "required": ["snapshot", "scope", "intent", "obligation", "artifact", "artifactDigest", "policy", "evidence"],
+      "properties": {
+        "snapshot": { "$ref": "#/$defs/identity" }, "scope": { "$ref": "#/$defs/scopeRef" }, "intent": { "$ref": "#/$defs/intentRef" },
+        "obligation": { "$ref": "#/$defs/obligationRef" }, "artifact": { "$ref": "#/$defs/artifactRef" }, "artifactDigest": { "$ref": "#/$defs/digest" },
+        "policy": { "$ref": "#/$defs/policyRef" }, "evidence": { "type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/evidenceRef" } }
+      }
+    },
+    "acceptancePayload": {
+      "type": "object", "additionalProperties": false, "required": ["authorityId", "binding"],
+      "properties": { "authorityId": { "$ref": "#/$defs/id" }, "binding": { "$ref": "#/$defs/acceptanceBinding" } }
+    },
+    "revisionPayload": {
+      "type": "object", "additionalProperties": false, "required": ["revision"], "properties": { "revision": { "$ref": "#/$defs/workRevision" } }
+    },
+    "snapshotPayload": {
+      "type": "object", "additionalProperties": false, "required": ["snapshot"], "properties": { "snapshot": { "$ref": "#/$defs/workSnapshot" } }
+    },
+    "workRevisionEvent": {
+      "type": "object", "additionalProperties": false, "required": ["ledgerVersion", "event", "eventId", "ts", "payload", "digest"],
+      "properties": { "ledgerVersion": { "const": 4 }, "event": { "const": "work_revision" }, "eventId": { "$ref": "#/$defs/id" }, "ts": { "$ref": "#/$defs/timestamp" }, "payload": { "$ref": "#/$defs/revisionPayload" }, "digest": { "$ref": "#/$defs/digest" } }
+    },
+    "workSnapshotEvent": {
+      "type": "object", "additionalProperties": false, "required": ["ledgerVersion", "event", "eventId", "ts", "payload", "digest"],
+      "properties": { "ledgerVersion": { "const": 4 }, "event": { "const": "work_snapshot" }, "eventId": { "$ref": "#/$defs/id" }, "ts": { "$ref": "#/$defs/timestamp" }, "payload": { "$ref": "#/$defs/snapshotPayload" }, "digest": { "$ref": "#/$defs/digest" } }
+    },
+    "workOccurrenceEvent": {
+      "type": "object", "additionalProperties": false, "required": ["ledgerVersion", "event", "eventId", "ts", "payload", "digest"],
+      "properties": { "ledgerVersion": { "const": 4 }, "event": { "const": "work_occurrence" }, "eventId": { "$ref": "#/$defs/id" }, "ts": { "$ref": "#/$defs/timestamp" }, "payload": { "$ref": "#/$defs/occurrencePayload" }, "digest": { "$ref": "#/$defs/digest" } }
+    },
+    "workAcceptanceEvent": {
+      "type": "object", "additionalProperties": false, "required": ["ledgerVersion", "event", "eventId", "ts", "payload", "digest"],
+      "properties": { "ledgerVersion": { "const": 4 }, "event": { "const": "work_acceptance" }, "eventId": { "$ref": "#/$defs/id" }, "ts": { "$ref": "#/$defs/timestamp" }, "payload": { "$ref": "#/$defs/acceptancePayload" }, "digest": { "$ref": "#/$defs/digest" } }
+    }
+  }
+}

package/contracts/ordinary-control/v1/README.md

@@ -0,0 +1,59 @@
+# Ordinary original-child control v1 — explicit local host integration
+
+Package-root `ordinaryChildrenFor(originalExtensionAPI)` returns the port associated during actual grants
+extension factory registration. The original owning bootstrap must retain that object; a copy/name/path
+cannot look it up. Call BEFORE ordinary children run. Late opt-in is allowed but permanently labels missed
+original lifetimes; empty rows then cannot certify quiescence. Defaults stay untracked/ephemeral unless
+separately enabled (native file retention and cancellation capture are distinct opt-ins).
+
+The actual shared execute-child wrapper retains an original AbortController per execution and composes
+it with caller and lease signals. It never replaces the caller promise, primary result or existing process/
+Herdr timer/close path. No model tool schema exposes this port. No peer process or PID/pane is recovered.
+`inspect()` is process-local read-only status, NOT persisted authority or a clean durability acknowledgement.
+`quiescent()` additionally refuses unknown ownership, required control failure or unretained history. A
+best-effort terminal lifecycle/lease observation failure remains visible as `control:failed` beside the
+worker outcome, but does not turn a known-settled child into a permanent execution boundary. A boundary
+already known to be unavailable refuses an intent hold before installing it; it never blocks unrelated
+ordinary admission while claiming reconciliation could make progress.
+
+Cancellation shape:
+
+```
+{ version: "ordinary-cancel-v1", requestId, bindingDigest, expectedRevision,
+  target: { executionId, parentExecutionId, toolCallId } }
+```
+
+Use actual execution UUIDs and nullable original parent UUID / actual tool-call ID (bounded256 characters),
+never logical child position. `ordinaryCancellation` validates/detaches; `ordinaryCancellationDigest` hashes
+the closed request. Independently supply `{bindingDigest, requestDigests}`. Approved digest is not inferred
+from request shape, worker output or the port's existence. Synchronous CAS precedes original abort; result
+`abort-requested` means completion is still owned by the original caller, not certified terminated.
+Exact duplicate reads original result without effect or needing new authority. Different bytes under the
+same request ID, stale revision, changed target, missing original handle and copied ports refuse.
+
+Opted-in controllers retain up to1024 occurrence records and1024 requests. Capacity is non-refunding;
+failed admission uses original workspace finalization. Ordinary successful worker output survives terminal
+observation failure, which is separately marked failed. An executor exception remains unknown. Neither
+unknown nor full bytes grants retry/recovery permission. Large transport frames may refuse their existing
+byte bound rather than truncate a purported complete registry.
+
+Existing dashboard config may ADD `ordinaryDigest: port.bindingDigest`; old configs/hashes remain unchanged.
+Pass that original port as `open/createDashboardHost({ordinary:port,...})`. Approval additionally needs
+`authority.ordinary`; operation `ordinary-cancel` carries the exact request above through the existing
+manual `dashboardHostAction`/socket. The existing host claim/result journal binds request ID/tip/selection
+and blocks failed-ack replay. No new persistent cancellation/decision database. Reconnect without the
+original port can inspect other retained state but cannot cancel; process restart never restores handles.
+
+For approved intent changes, the existing host additionally takes an original admission hold (at most32,
+revision-changing). Busy direction waits in the existing host journal; original children continue. New
+ordinary execution refuses at its original admission seam. The hold spans native asynchronous application
+and any native resource pending state, and releases only after explicit successful native/host readback.
+Unknown/failed host acknowledgement never releases it. This is not an expiry/unlock/recovery API; do not
+run an older host writer against a new pending ordinary operation. Guide reconciliation does not mandate
+generic entity/topology/opaque-policy editing; those unsupported extensions need concrete scope/semantics.
+
+A failed final host sync can coexist with actual abort, charged effects and a later readable result. The
+host stays failed/unknown and duplicate request is readback only. Caller cancellation still works and a
+completed fanout sibling remains in the original result. Manual presentation refuses known nonquiescence,
+but this does not establish an atomic deployed TUI pause, source completeness, human/module authentication,
+P01 acceptance or hostile same-UID confinement. Wider live host association requires separate B/C evidence.

package/contracts/producer-ipc/v1/README.md

@@ -0,0 +1,137 @@
+# Producer IPC v1 — local, explicit host integration
+
+This is a **separate opt-in fixed model-free emitter**, not an operation on `linux-bwrap-digest-v1`,
+not a new P11 experiment opcode, and not permission to run a model. Digest/hold operations and their
+null model/effort/skills contract are unchanged. Ordinary pi extensions, tools and runtime-injection
+restrictions are unchanged. No SDK, credentials, provider configuration or networking client is imported.
+Historical `dist` is not this candidate: compile the exact pinned source into a fresh private output.
+
+## Callable API
+
+Exports are available from `pi-daddy` and `pi-daddy/producer-ipc`:
+
+- `producerIpcBinding(value)` validates and detaches/freezes the closed binding below.
+- `producerIpcBindingDigest(binding)` hashes its canonical UTF-8 JSON bytes.
+- `producerIpcDemand(binding)` produces an existing v4 `AttemptDemand`: primary, no parent;
+  attempt ID = execution ID, input digest = binding digest, input bytes = **whole parent binding**.
+- `createProducerIpcHost({ owner, binding, exchange })` creates a single-use original host capability.
+- `startProducerIpc({ owner, permit, binding, host, signal, timeoutMs })` consumes an **already reserved**
+  original permit and returns a `Promise<ProducerIpcRun>`. It never reserves a replacement itself.
+
+```ts
+import {
+  openResourceBudget, resourceBindingDigest, newExecutionId,
+  producerIpcBinding, producerIpcDemand, createProducerIpcHost, startProducerIpc,
+} from 'pi-daddy';
+
+// Existing independently retained v4 budget. Use ONE original module graph and owner object.
+const owner = openResourceBudget(existingExperimentBudget);
+const binding = producerIpcBinding({
+  version: 'producer-ipc-v1', budgetDigest: resourceBindingDigest(existingExperimentBudget),
+  orderId: existingOrderId, experimentId: existingExperimentId, executionId: newExecutionId(),
+  charterSha256: independentlyFrozenHostCharterHash, invocationId: allowedHostInvocationId,
+});
+const [permit] = await owner.reserveBatch([producerIpcDemand(binding)]);
+const port = createProducerIpcHost({ owner, binding,
+  async exchange(frames, context) {
+    // Actual one-use Readable replay of original child stdout, validated after EOF AND child exit.
+    // No parent identity, charter hash, credentials, URL, model payload or host socket in frames.
+    const observation = await trustedHost.exchangeSubscriptionSdk(
+      frames, hostOnlySdkBinding, hostOnlyTransport, context.binding.charterSha256, context.signal,
+    );
+    // Host-owned journal references ONLY, not votes/output/acceptance or transport authentication.
+    return { claimRef: originalClaimReference(observation), responseRef: originalResponseReference(observation) };
+  },
+});
+const run = await startProducerIpc({ owner, permit, binding, host: port,
+  signal: originalCallerAbortController.signal, timeoutMs: 30_000 });
+const observed = await run.result;        // Bounded observation; NEVER release a hold from this.
+const final = await run.completion;       // Waits for original child, invoked host, required accounting.
+const mechanicallyComplete = final.outcome === 'completed' && final.settlement === 'acknowledged';
+// Even mechanicallyComplete is NOT live qualification, model correctness, a grant or P01 acceptance.
+```
+
+`trustedHost`, SDK binding, transport, expiring approval and reference selection are **host-owned**.
+The example's `exchangeSubscriptionSdk(..., sourceSignal?)` is the coordinator-supplied local29a API;
+this producer does not import, ship, execute or authenticate it. The host must independently validate
+its charter/approval and enforce its own journal, invocation uniqueness, request/response/call budgets,
+subscription-only route and source cancellation. Reading this document supplies none of that authority.
+All coding/evaluated model execution remains on the user's existing Codex subscription only; no live call
+was made in these tests. The producer's inert callback fixtures are not a substitute for that host.
+
+## Frame, identity and evidence contracts
+
+`ProducerIpcBinding` has exactly `version, budgetDigest, orderId, experimentId, executionId,
+charterSha256, invocationId`. Hashes are lowercase SHA-256; execution ID is an existing-format `exec:UUID`;
+other IDs are 1..128 ASCII alphanumeric/colon/underscore/hyphen characters. Reordered input properties
+canonicalize to that listed order. Whole binding bytes are charged, **not** provider request/token bytes.
+The independently retained binding plus its persisted reservation digest supplies correlation, not a new
+journal or a recovered permit. Old digest-input reservations cannot be relabelled as IPC reservations.
+
+Child capability/output is exactly UTF-8 `JSON.stringify({id: binding.invocationId, sequence: 1})+'\n'`.
+Sequence 1 is **per invocation**, not the host journal's global claim ordinal. The child gets only that
+base64-encoded frame in argv; this is not secret transport. The parent captures at most 1024 raw bytes,
+requires original stdout EOF and successful original child completion, then checks byte equality, not a
+permissive JSON parse. Wrong identity/sequence, extra/duplicate fields, whitespace, malformed UTF-8, missing
+LF, repeated or oversized output cannot dispatch. There is no prefix dispatch or response channel to child.
+The host receives a **buffered replay**, not a live bidirectional child pipe. It must consume that original
+stream before acknowledgement; the producer never reconstructs a frame from host identity metadata.
+
+`exchange(frames: Readable, context: { binding, signal }): Promise<{ claimRef, responseRef }>` is called
+at most once per original host port. Both references are 1..128 characters from the same ASCII ID alphabet;
+extra payload/decision fields refuse. They are unverified evidence references, never policy or votes.
+The child has already exited before host exchange starts; the resource hold spans both serial lifetimes.
+This does **not** place the host, SDK or model execution inside the child namespace.
+
+## Lifetime and failures
+
+`run.started` resolves `spawned | not-spawned`; spawn is not readiness. `run.readiness` resolves
+`frame-ready | not-ready` only after original child evidence is available. Both can remain pending during
+unknown underlying I/O. `run.child` is the frozen original `ChildRunResult | null`; null means no executor
+result was obtained, not a successful child. An actual spawn error is `not-spawned`; an exception after
+spawn without an executor result is `unknown` and returns failed/unknown completion **without settlement**.
+Actual code, signal, text, abort/timeout/truncation are retained.
+`run.inspect()` only returns a frozen process-local snapshot; no reopen/retry/reconcile/settlement occurs.
+
+`result` is the first terminal **effect observation**, with `outcome`, closed `reason`, current child/host
+state, frame hash, references and settlement state. It is immutable; it may say child/host/settlement are
+pending. `completion` returns later evidence without upgrading cancelled/timed-out/failed outcome.
+Late valid host references can appear there while the earlier result remains unchanged.
+A completed effect plus `settlement: failed-or-unknown` is **not successful completion**, even if a later
+budget read sees complete settlement bytes or zero active slots. No read repairs this receipt.
+
+Original caller cancellation is composed with a bridge-owned deadline and forwarded to both existing
+`runChild` and host I/O. `timeoutMs` is an integer 50..30000, includes admission/runtime preparation after
+claim, and is checked again at asynchronous control boundaries. It bounds an observation, not blocked
+kernel I/O or synchronous host JavaScript. The fixed child retains its 3000ms/50ms grace/3500ms hard cap,
+1024-byte combined output cap and unchanged binary/namespace/per-process CPU/FD/heap guards.
+There is no security-policy modification, alternate command, fixture mount, environment or fallback API.
+
+Original v4 permits are branded to their creating owner object. Copies, separately reopened owners,
+different bindings, already settled/in-progress settlement and consumed permits refuse. A valid exclusive
+handoff blocks early calls to the old public `permit.settle`; the original private settlement closure is
+held until child and invoked host acknowledge. The original locked admission check rejects a pending/paused
+barrier before launch; a failed admission still settles a charged failure. Claims are process-local and
+single-use even after failure. There is no crash/receipt/PID/path/module-copy recovery.
+
+Cancellation/timeout does not free an unknown lifetime: an uncooperative host or unacknowledged child keeps
+`completion` pending and the active reservation held. When both acknowledge, original accounting releases
+only the active slot. Attempts and whole-binding bytes stay charged on success, failure and cancellation.
+Pending dispatch reconciliation still needs explicit original authority after quiescence. A host port must
+return/reject only after its owned I/O acknowledges termination; the bridge cannot prove remote server
+termination from promise rejection, authenticate journal references, or enforce provider-money/cgroup caps.
+
+## Behavioral evidence / exclusions
+
+`test/producer-ipc.test.ts` uses the actual unchanged namespace launcher for positive stream/correlation
+and real forwarded Node children for malformed/oversized/identity/EOF negatives. Test-only forwarding never
+adds a production alternate launcher. `test/producer-ipc-lifetime.test.ts` forces real process liveness
+under delayed signal delivery, no-readiness cancellation/timeout, host cancellation/late acknowledgement,
+existing admission barriers, persisted-binding mismatch, reuse, spawn/setup errors and mandatory sync/close
+failures after complete bytes. Signal/EOF and
+filesystem fault injection is labelled; it is not evidence that the local kernel naturally lost them.
+
+These are local mechanical tests, not live SDK/Herdr/model operation, human/role authentication, Ubuntu24
+support, the cause of historical namespace denials, or overall/native-P01 acceptance. Original review,
+seq226 and retained/inconclusive P17D remain unchanged. No ordinary model-driven controller choice, full
+factory scheduling, generic mutation, rescue/retry/refund or publication is introduced.

package/dist/check-runner.d.ts

@@ -1,3 +1,4 @@
+import { type RetentionStatus } from "./execution-retention.ts";
 import { type CorrelationMetadata } from "./correlation.ts";
 import { type ValidatedWorkspace, type WorkspaceAccess } from "./workspace.ts";
 export interface CheckDefinition {
@@ -52,10 +53,14 @@ export declare function runNamedCheck(input: {
     signal?: AbortSignal;
     leaseDir?: string;
     ledgerPath?: string;
+    /** Explicit host archive boundary; defaults to PI_GRANTS_EXECUTION_ARCHIVE, never correlation. */
+    retentionDirectory?: string;
+    toolCallId?: string;
 }): Promise<{
     output: string;
     exitCode: number | null;
     signal: NodeJS.Signals | null;
     receipt: CheckReceipt;
+    retention: RetentionStatus;
 }>;
 //# sourceMappingURL=check-runner.d.ts.map

package/dist/check-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-runner.d.ts","sourceRoot":"","sources":["../src/check-runner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUlF,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,eAAe,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAKD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,eAAe,EAC3B,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,MAAM,CAAC,UAAU,CAWnB;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC,CAyOD"}
+{"version":3,"file":"check-runner.d.ts","sourceRoot":"","sources":["../src/check-runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAyD,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAIvH,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUlF,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,eAAe,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAKD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,eAAe,EAC3B,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,MAAM,CAAC,UAAU,CAWnB;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;CAC5B,CAAC,CAsPD"}