pi-daddy 0.22.0 → 0.23.0

package/contracts/debrief/v2/README.md

@@ -0,0 +1,71 @@
+# Explicit work-signal and durable blind host integration
+
+Additive P08 integration; v1/manual case-v2 remains unchanged by default. No provider, automatic
+worker prompt, attention hook, Herdr control, model evaluation, routing or acceptance is introduced.
+
+## Actual host boundary
+
+`pi-daddy/debrief-host` (also root exports) accepts a trusted host's loaded harness modules:
+`createWorkCaseReviewer`, `createWorkSignalReviewer`, `retainBlindIntervention`, `openBlindIntervention`.
+The actual tested source is skill-harness638494af0a0058edf9a9b1b02e57af894ab46ed6. Exact source bodies,
+SHA256 pins and ordinary isolated compilation are in test/fixtures/debrief-durable-host; upstream
+contracts are retained beside this README. No dependency install, dynamic worker module loader,
+replacement archive/decision ledger, cached permission or fake authenticated operator is supplied.
+The structural DebriefHarness interface is NOT runtime module authentication: loading/provenance and
+independent host authorization remain host obligations. No caller pin string can authorize a writer.
+
+```ts
+// Explicit host action, with independently configured author and private archive.
+const blind = retainDebriefBlind(harnessPorts, archiveRoot,
+  { manifest, evidence, qualification }, author);
+// Retain blind.comparisonId AND author independently before reconnect/exposure.
+const preview = openDebriefBlindPreview(harnessPorts, archiveRoot, blind);
+// preview has ONLY view/readArtifact/quality, never archive metadata/choose/reveal.
+const presenter = createRetainedDebrief(harnessPorts, {
+  archiveRoot, author, blind, scope: retainedAttentionScope, persistence: hostAttentionCAS,
+  cases: { version: 'work-signals-v1', batchId, observationId }, offset: 0,
+});
+await presenter.open({mode:'manual', userPresent:true});
+// Existing dashboard presenter/actions, after explicit manual requests:
+await presenter.choose({kind:'one', labels:[opaqueLabel]});
+await presenter.reveal();
+```
+
+Retention freezes private inputs through the actual adapter, including independent private random seed.
+It is never implicit during open/reconnect. Reconnect binds the original comparison ID/author and reads
+`quality()`, NOT `reveal()`, to discover an existing vote. The adapter re-reads original inputs/artifacts
+on every access; missing/corrupt input or immutable choice refuses. Different choices remain refused
+across presenter/process restarts. Same-choice replay does not create another vote. A required write/sync
+failure remains failure even when complete choice bytes subsequently exist; explicit reopen may observe
+those original bytes without another writer call or automatic reveal. No crash durability is inferred.
+
+Only opaque labels, verified artifact previews and explicit quality state reach the pre-reveal blind card.
+Private seed, raw roles, costs/configuration and archive metadata do not. Arbitrary artifact content can
+still disclose identity; this is not universal redaction or a real blind study. The existing bounded
+consumer supports2..4 arms, up to4 artifacts/card and64KiB/artifact, with320-character previews. Larger
+producer comparisons are refused, not silently truncated into a qualified study.
+
+## Signal cases and attention
+
+`cases.version:'work-signals-v1'` explicitly invokes createWorkSignalReviewer. Its page includes the exact
+independent observation ID and issues, even with ZERO cards. Counts are SELECTED BATCH counts (<=1024),
+not all live work or calibration denominators. Pages are<=5. Case-v3 reasons/metrics/IDs are validated
+against the pinned formula; case-v2 coverage issues remain coverage, not defect labels. Existing v2
+reviewer/batches are not silently reinterpreted. `work-case-v2` explicitly selects the old route.
+
+The signal reader rederives exact case membership from the original retained observation; foreign cases,
+old/wrong batch, malformed/missing input and stale author/CAS cannot become labels or promotion. Labels
+use the existing durable decision writer/history and exact evidence/author/prior decision digest.
+Skip, uncertainty, deferred/busy/absent context and unselected cards remain unresolved.
+
+One blind question consumes ONE of FIVE TOTAL slots, normally four cases plus one blind. Answers, skip,
+close/reopen and reconnect do not refill slots. No next page is inferred automatically. New explicit
+host scope/offset and independent selection are required for another page.
+
+Signals or durable blind binding opt into `debrief-checkpoint-v2`: original v1 fields plus bindingDigest
+of the independently configured signal batch/observation and blind comparison/author. A changed/old
+checkpoint refuses, including zero-card batch switches. Checkpoints retain attention/request transport
+only; canonical case/quality decisions remain in harness storage. Loss/rollback-safe attention storage,
+authenticated human identity and live pause policy remain host qualification, not properties inferred
+from a file, a supplied identity string or a caller-present flag. Frame freshness stays snapshot-unknown,
+automatic presentation unqualified and acceptance not-assessed.

package/contracts/debrief/v2/input-pin.json

@@ -0,0 +1,66 @@
+{
+  "repository": "https://github.com/mojomanyana/skill-harness",
+  "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+  "sources": [
+    {
+      "source": "packages/core/src/work-capture.ts",
+      "target": "work-capture.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "a258861619e92d5b41336ee83d41c42fec33212643c22b7d6ace8e55561b98ea"
+    },
+    {
+      "source": "packages/core/src/work-signals.ts",
+      "target": "work-signals.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "5e14a6069bcecfd358b5e3d034a78ee896c6f7f646c8208d8233cb9dd751dca4"
+    },
+    {
+      "source": "packages/core/src/intervention.ts",
+      "target": "intervention.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "05377d1045942334016e7154bb092cf2fdeb4d95c86c2c4170b321f11d9d0312"
+    },
+    {
+      "source": "packages/adapters/src/evidence-archive.ts",
+      "target": "evidence-archive.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "f41fd69daa4326cefad673fbf4eee2e0c44aa12de595d8a9c4deec209fe38807"
+    },
+    {
+      "source": "packages/adapters/src/work-case-archive.ts",
+      "target": "work-case-archive.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "6998556f29c068ae8d5f383b76e913f429235aa90bb6f50e34a20785d870d4a6"
+    },
+    {
+      "source": "packages/adapters/src/work-case-review.ts",
+      "target": "work-case-review.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "d7b374c80f182b20367a3968d9815fffae8ca70a452a5c6f246e7678158c7a7a"
+    },
+    {
+      "source": "packages/adapters/src/work-signal-cases.ts",
+      "target": "work-signal-cases.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "947dc22f35e8f40510e8a37c5630fd38afe2400c112993f322e2bce8af4f467f"
+    },
+    {
+      "source": "packages/adapters/src/work-signal-observation.ts",
+      "target": "work-signal-observation.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "b97b727f2c90634f977abbba837411d01b96eb24c85430ea129c97956b48efac"
+    },
+    {
+      "source": "packages/adapters/src/blind-intervention.ts",
+      "target": "blind-intervention.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "9b73d85927cc3386b9ab2fae7e647793929e360e5fda892e4db2ab692ab756e4"
+    },
+    {
+      "source": "packages/adapters/src/work-candidates.ts",
+      "target": "work-candidates.ts.txt",
+      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
+      "sha256": "2b0bd7188b9da6951f050e9889ed3fdf5adafbd4b5cc5a81ec417a14fac20117"
+    }
+  ]
+}

package/contracts/debrief/v2/intervention-upstream.md

@@ -0,0 +1,40 @@
+# Frozen intervention comparison primitives — P12 partial, P08 fixture input
+
+This is a SEPARATE family from existing fixed-model `buildComparison`/`compare`. Their same-model/judge/input guards are unchanged. No model is launched here.
+
+`freezeIntervention` binds an investigation digest, common scenario/rubric/fixture/held-out/harness/judge-policy inputs, mode, repetition/criterion/critical thresholds, resource metric and explicit candidate axes. Undeclared model/effort/skill/prompt/configuration changes reject. Multiple changed axes are a package intervention, not evidence of one variable's causal effect. LLM sampling is not claimed deterministic.
+
+`assertInterventionRoles` is a pre-spend check over independently resolved HOST context. Missing roles and proposer/judge/subject canonical identity conflicts refuse. Same subjects may repeat across arms. It does not resolve providers, authenticate arbitrary context or qualify a delivery route. Do not derive qualification or expected evidence digests from incoming arm claims.
+
+`assessIntervention` checks exact host-confirmed evidence digests and frozen input/cell policy. Delivery NOT-MEASURED/ERROR and missing/unknown/suspect cells keep the comparison incomplete; objective failure prevents judging/eligibility. Votes are retained per criterion. Actual output bytes must match per-cell/arm hashes; digests alone are missing evidence. Retained bytes are copied for later blind reads. Cheap failed arms cannot become eligible. Cheapest eligible is only a conditional measurement; routingDefault is always null and adoptionAuthorized false.
+
+`interventionEvidenceFromResults` uses existing schema3 validation and retains complete source results/votes beside the summary. It requires recorded `source_hashes['intervention:manifest']` and `['intervention:inputs']`, matching model/mode/judge/plan, and supplied output bytes. It never stamps missing bindings onto historical runs. Multi-judge conversion is not yet supported rather than choosing a convenient panel vote. The orchestrator that records these bindings and qualifies actual execution remains integration work.
+
+## Blind view API
+
+```ts
+const blind = createBlindComparison(manifest, recomputedAssessment);
+const view = blind.view(); // opaque labels + artifact hashes + explicit clue limitation; no configuration/cost
+const bytes = blind.readArtifact(label, artifactHash); // only retained bytes admitted to that label
+blind.choose({kind:'one'|'tie'|'none'|'insufficient', labels:[/* opaque labels, or [] */]});
+const revealed = blind.reveal(); // refuses before choice; different choice refuses after reveal
+```
+
+An optional private seed supports fixtures/host-controlled restoration; real independent views need fresh private randomness, not a public fixed seed. Public view omits identity metadata, but arbitrary artifact text may reveal clues. The host must enforce user/judge identity, persist quality/seed/reveal state before exposure, and expose only the public view/read methods before choice. This in-memory API is not durable human authentication or proof a host did not leak the assessment/configuration. P08 must keep its total five-card budget and real pause/exposure boundaries.
+
+`fixtures/` is generated by actual code from fixed synthetic evidence, retained Layout A/B bytes, fixture role identities and a public zero seed. It is NOT live qualification, real human blinding, efficacy or casting evidence. It supplies a concrete UI contract: blind-view.json before choice; choice.json; reveal.json only afterward.
+
+## Durable local blind review
+
+`retainBlindIntervention(root, manifest, evidence, qualification, author)` explicitly retains a private comparison and returns its immutable archive ID. It checks the actual supplied output bytes and complete assessment before retention; roles remain independently supplied host declarations, not authentication. An independent random seed is retained privately with each new comparison. `openBlindIntervention(root, id, author)` reopens exactly that comparison. Each `view`, `quality`, `readArtifact`, `choose` and `reveal` re-reads verified archive inputs and recomputes the assessment and label mapping; no stored eligibility verdict is trusted. Artifact loss blocks access, including reveal.
+
+The durable adapter intentionally commits ONE immutable initial quality choice, stricter than the in-memory primitive's editable pre-reveal choice. `quality()` reads it without revealing identity/cost; `reveal()` refuses until it exists. Same-choice resubmission is read-only and idempotent; a different choice refuses even after process restart. An atomic directory claim admits one initial writer; a competing writer may observe a conflict or incomplete claim, never overwrite it. Partial/missing/malformed claimed records require explicit recovery, not automatic deletion or another vote. A write/fsync error can follow a committed choice: retain unknown acknowledgement and inspect that same comparison. No automatic retry or filesystem cleanup occurs.
+
+Private archive ownership is required. This is not protection against a malicious same-UID owner deleting/rewriting an archive or creating a separate comparison, remote user authentication, automatic exposure, a claim that artifact content cannot disclose identity, or crash-durability proof beyond successful file/directory synchronization. Choice files live under `blind-decisions/<comparison-id>/choice.json`; archive metadata (including seed/roles/cost) is operator-private, never a dashboard payload. Only the restricted view/artifact/quality methods go to a pre-reveal client. Records are bounded (2MiB input JSON, 8MiB per artifact/64MiB aggregate, 4096 artifacts, 16KiB choice read). No provider call, routing default or adoption is introduced.
+
+Remaining P12: qualified model-backed orchestration, complete panel/authenticated blind workflow, verified role/receipt integration, applicable casting rows/uncertainty/revalidation and live P08 demonstration. Full acceptance and any routing/adoption default remain pending.
+
+```sh
+node scripts/generate-intervention-fixture.mjs --check
+node node_modules/vitest/vitest.mjs run packages/core/test/intervention.test.ts packages/core/test/intervention-results.test.ts packages/core/test/comparison.test.ts
+```

package/contracts/debrief/v2/work-signals-upstream.md

@@ -0,0 +1,22 @@
+# Frozen work signals and explicit review bridge — v1
+
+Additive adapter APIs, not a reinterpretation of `contracts/work-capture/v2`.
+
+1. `retainWorkSignalObservation(root, snapshot, facts)` validates closed bounded host declarations and retains canonical `work-signal-observation-v1` bytes. Returns `{manifestId,inputSha256}`.
+2. `readWorkSignalObservation(root, manifestId)` reopens verified bytes and rederives `work-signals-v1` cases. It rejects missing/corrupt/mismatched/unsupported input; unknown scope stays an explicit issue, not an empty success claim.
+3. `captureWorkSignalCases(root, observationId)` creates immutable case references and a selected batch. Case parser `work-signal-case`/`1` stores `{version:'work-signal-case-v1',observationId,caseId}`; no cached verdict. Batch parser `work-signal-batch`/`1` stores `{version:'work-signal-batch-v1',observationId,candidateIds,visibility:'silent',promotion:'not-authorized'}`. Both source identities bind the referenced observation/case.
+4. `createWorkSignalReviewer(root,batchId,operatorAuthor)` exposes `list(offset=0,limit=5)`, `history(caseManifestId)` and `decide({caseManifestId,priorDecisionId,disposition,note})`. Decisions use the existing durable lock/CAS/history writer and `decision_schema:1`. No new history engine or worker control path.
+
+Each selected case is rederived from its original input on access, including immediately before decision storage. Case membership in the exact observation is checked; a valid case from a different observation cannot be substituted. Missing original input blocks decisions. `list` additionally returns `observationId` and observation `issues`, so unresolved scope with zero cards is not hidden. Counts describe the selected batch, not exhaustive live work or calibration denominators.
+
+Defect cards have `capture_schema:3` and explicit `overdue_checkpoint`, `reopened_acceptance`, or `intent_conflict` reason/metrics. Coverage issues retain `capture_schema:2`. Both remain silent/unresolved/causal-not-established nominations. The old `createWorkCaseReviewer` accepts only its original v2 batch contract and REFUSES these new batches. A UI must opt into this bridge and these card versions; existing pi-daddy pinned v2 clients are not upgraded by this library addition.
+
+`operatorAuthor` and supplied facts are conditional host declarations, not authentication. Retained inputs do not prove the truth/availability of external referenced evidence, active branch, an authenticated human pause or authority to expose/promote/adopt. Live source capture, actual dashboard version selection, privacy/role authority and automatic pause/exposure policy remain integration work.
+
+Limits: closed input arrays at most256 entries, input bytes at most1MiB, selected batch at most1024 unique case manifest IDs, batch/case payload reads at most128KiB, pages at most5. Existing non-expiring decision locks and1MiB history bound remain. Trusted local archive integrity is not hostile same-UID containment, rollback resistance or a storage quota.
+
+`captureArchivedWorkSignals(root,workManifestId,independentWorkContext,facts)` additionally consumes the pinned real Work-v4 reader. It derives scope, binding identities, coverage and acceptance from the actual projection rather than accepting replacement fields from the signal caller. Its `archived-work-signals-v1` link retains the raw source identity, producer pin, full projection, frozen observation and review batch references. Missing/malformed/unselected work refuses. Missing authority remains coverage, even when a supplied objective fact says FAIL.
+
+This adapter's `work-v4-revision-digests-v1` binding profile uses obligation/intent/policy/artifact REVISION digests, not artifact content digests; prior-acceptance facts must use the same profile. A valid P01 selection with multiple bindings for the same obligation digest is currently refused by the narrower signal profile, never collapsed. The retained full projection preserves detailed coverage/problems; the signal projection remains conservative. Supplied checkpoint/outcome facts and Work context still need independent host provenance/authorization. No live collection or authentication is created by this mapping. Original work bytes are verified at capture; the case reader subsequently verifies its retained input, not every external artifact mentioned in that input.
+
+Changing rule semantics requires a new explicit observation format/reader. Preserve old inputs, outcomes and decision corrections; never silently relabel a saved nomination or erase an unknown result.

package/contracts/dispatch-control/v1/README.md

@@ -0,0 +1,109 @@
+# P05 bounded dispatch control v1 — contract for P15
+
+Later local continuation: [actual P01 intent application](../../intent-control/v1/README.md) supplies
+scope/priority/alternative adapters under a separate v3 resource binding and intent protocol. The matrix
+below remains the contract for **this v1 dispatch-only protocol**, not a permanent claim of external blockers.
+
+Implemented local candidate; overall review and formal acceptance pending. This is **not general live
+worker steering**. No new dashboard authority database, model judgment, worker prompt, terminal typing,
+Herdr control call or background reconciler is introduced. P04 status remains read-only and unchanged.
+
+## Exact action matrix
+
+| Request | Supported target/boundary | Result |
+| --- | --- | --- |
+| `pause-dispatch` | One independently bound **v2 resource budget**; application only under the reservation lock with zero active reservations | Pause future reservations; never interrupt admitted work |
+| `resume-dispatch` | Same exact budget and zero-reservation boundary | Re-enable only its original fixed limits; no scope/effect expansion |
+| Busy pause/resume | Same budget, original live permits still outstanding | Pending; admission barrier blocks new reservations; explicit authorized reconciliation after settlement |
+| `cancel-execution` | No atomic durable request-to-live-executor cancellation primitive implemented | Explicit unsupported/not-applied, never ordinary steering or terminal fallback |
+| `revise-scope`, `reprioritize`, `select-alternative` | No supported atomic P01 revision application adapter supplied | Explicit unsupported/not-applied; work-v4 remains sole intent source |
+| Targeted live pi/Herdr steering | No verified atomic session/target/safe-boundary mechanism established | BLOCKED; pane/title/PID/idle/last-entry facts are not authority |
+| Arbitrary bash/model/shared-write or alternative budget/lease stores | Outside the partial P06 profile | BLOCKED; no global dispatch/containment claim |
+
+The useful demonstrated route is `prepareDigestProfile(v2Binding)` / `runDigestProfile`: its actual existing
+reservation seam obeys the gate. Preparation probes are not workload dispatch and are not disabled by the
+workload gate. Other budgets and executors that do not use this binding are not governed. The boundary is
+**verified reservation quiescence**, not global process silence or an authenticated live-pi safe point.
+P06's original live owner settles its own permit after executor finalization; orphan reservations remain
+active across restart. There is no PID/TTL/receipt-based recovery or general worker-state inference.
+
+## Authority and revision
+
+The host retains the independently created budget binding and supplies independent `DispatchAuthority`
+declarations: its exact authority digest plus at most 128 approved request digests. These are trusted host
+inputs, not request metadata, authentication credentials or a wire-authority loader. A host must not derive
+approval from an incoming request/claimed result or merely copy its identifiers. Defaults are denied.
+No mutable approval list is persisted. Existing trusted-store/same-UID/rollback limitations still apply;
+this library is not a remote authentication boundary or a revocable distributed authority service.
+
+`DispatchRequest` has a closed version `1.0`, immutable request ID, exact `bindingDigest`, expected **dispatch
+revision**, action and nullable execution target. That revision is operational budget state, **not a P01
+scope revision**. Requests cannot rewrite P01 intent or claim acceptance. `targetExecutionId` is non-null
+only for the distinct unsupported cancellation route. Wire input uses `parseDispatchRequest` (4096-byte
+limit, duplicate-aware/exact numeric parsing); `request.schema.json` describes the decoded closed shape.
+Do not first round lossy numeric tokens through JSON.parse and call them validated original wire bytes.
+
+Use `dispatchRequestDigest` over the complete canonical request to join independent approval. Missing/wrong
+authority refuses; then unsupported route, stale revision and another pending decision refuse. One approved
+request advances dispatch revision immediately, including when busy; stale UI cannot supersede it. A busy
+admission barrier prevents new reservations while existing work drains. The application itself waits for
+zero active reservations under the same non-stale-recoverable lock used by reserve/settle. A barrier is not
+a claim that pause has already applied, or that the active worker stopped.
+
+```ts
+import { createDispatchBudget, openResourceBudget } from 'pi-daddy/resource-budget';
+import { parseDispatchRequest } from 'pi-daddy/dispatch-control';
+// One-time host creation under an explicitly owned private parent; persist binding independently.
+const binding = await createDispatchBudget({ directory, authorityDigest, limits });
+const budget = openResourceBudget(binding);
+const controls = budget.controls(independentHostDeclarations); // or null: no authority
+const request = parseDispatchRequest(operatorRequestBytes);
+const result = await controls.request(request);
+const observed = await controls.inspect(); // read-only; never calls request/reconcile
+// Only an explicit authorized controller operation may apply pending work:
+const reconciled = await controls.reconcile(request.requestId);
+```
+
+## Durable request / decision / application / outcome
+
+No parallel intent store: controls extend the existing pinned `budget.jsonl` transaction and reservation
+replay. **Explicit binding/header version 2.0** opts into these semantics; unchanged `createResourceBudget`
+still creates v1.0 and retains its v1 static return type. Old v1 readers reject a v2 binding rather than
+silently skipping controls. No conversion/reset/in-place upgrade API exists.
+
+- `control-request` atomically records the exact request and its approved/refused decision. Approved state
+  starts pending with boundary-pending outcome; refusals are not-applied/refused. Each ID occupies one slot.
+- `control-apply` records application of the one approved pending request and projects its paused/enabled
+  outcome. It is invalid when reservations are active. No transport callback or caller-supplied receipt
+  may mark application. `reserve` replays and enforces both committed pause and the pending barrier.
+- `DispatchSnapshot` version `dispatch-control-snapshot-v1` includes exact binding digest, revision, paused
+  flag, **admission: blocked-pending|paused|enabled**, immutable records and `acceptance:not-assessed`.
+  Freshness is `snapshot-unknown`. Readback is not work acceptance or new host authorization.
+- An exact duplicate ID/digest only reads the existing result, including pending. It never applies, emits
+  another record or repeats an effect. Reusing an ID for another digest rejects. Reconciliation explicitly
+  names one exact request ID and rechecks its independently supplied approval and boundary; another ID
+  cannot reconcile the pending request. Repeated reconciliation is idempotent.
+- No acknowledgement or a thrown I/O/cleanup error means the caller must retain **unknown application**;
+  it must not assume success or silently retry a new ID. A complete append may precede an error, including
+  fsync/close/lock-cleanup failure: this is not a no-write/no-effect-on-error guarantee. Inspect/reconcile
+  the exact ID in the bound store. A pending record is not application; a complete current application
+  record is readback, not proof of crash durability, authenticated remote delivery or live worker state.
+
+Mandatory failures reject, including after bytes were written. Partial/invalid/replaced journals refuse
+further admission; no truncation, alternate store or recovery credit is attempted. Capacity is bounded by
+128 request records and at most 128 applications in addition to the existing attempt/settlement limits,
+2305 total v2 lines and 2 MiB. Cumulative attempts/bytes are never refunded. Read-only inspections use
+O_RDONLY, no lock creation, bounded descriptor/path consistency checks and no write/control callbacks.
+Concurrent changes can make an inspection fail; no old state is substituted.
+
+## Evidence and exclusions
+
+Ordinary owned fixtures exercise real file locking, cross-process duplicate delivery, exact independent
+fixture declarations, busy original permits, stale revisions, missing authority, mandatory-sync failure,
+source replacement/partial data, read-only byte/directory preservation and actual probed fixed-digest
+execution behind the gate. They do not qualify hostile same-UID writers, rollback resistance, complete
+controller-crash cleanup or installed/live pi/Herdr operation. No native/model test messages were sent.
+
+P02 native branch/availability gaps, P04 unqualified live freshness/transport, and P06 arbitrary-effect and
+aggregate CPU/memory/PID/disk/provider-money limitations remain. P15 must preserve this exact bounded matrix,
+unknown acknowledgements, independent approval, request identity and acceptance separation.

package/contracts/dispatch-control/v1/request.schema.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "P05 bounded dispatch request v1 (not authority)",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "requestId", "bindingDigest", "expectedRevision", "action", "targetExecutionId"],
+  "properties": {
+    "version": { "const": "1.0" },
+    "requestId": { "type": "string", "pattern": "^[a-zA-Z0-9:_-]{1,128}$" },
+    "bindingDigest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "expectedRevision": { "type": "integer", "minimum": 0, "maximum": 128 },
+    "action": { "enum": ["pause-dispatch", "resume-dispatch", "cancel-execution", "revise-scope", "reprioritize", "select-alternative"] },
+    "targetExecutionId": { "anyOf": [{ "type": "null" }, { "type": "string", "pattern": "^[a-zA-Z0-9:_-]{1,128}$" }] }
+  },
+  "anyOf": [
+    { "properties": { "action": { "const": "cancel-execution" }, "targetExecutionId": { "type": "string" } } },
+    { "properties": { "action": { "enum": ["pause-dispatch", "resume-dispatch", "revise-scope", "reprioritize", "select-alternative"] }, "targetExecutionId": { "type": "null" } } }
+  ]
+}

package/contracts/effect-profile/v1/README.md

@@ -0,0 +1,124 @@
+# P06 local candidate: a fixed digest boundary and durable resource accounting
+
+**Version 1.0, local only; overall review and formal acceptance pending.** This is not a sandbox for pi,
+bash, arbitrary JavaScript, model invocations, or writable workspaces. Existing delegation/check behavior
+is unchanged. The one supported new operation is `linux-bwrap-digest-v1`: hash at most 16 KiB of byte input
+with a fixed trusted worker and return its digest/length on stdout. It is useful for independently checking
+small evidence payloads, not executing an arbitrary factory order. Full P06 remains only partially covered.
+
+The unchanged executable guard checks Linux, resolved Node then exact bwrap/prlimit paths, regular-file
+type, no group/other write bits, and size<=256MiB. Refusals keep the original error message and add exact
+path/details plus RUNTIME_NOT_REGULAR / RUNTIME_WRITABLE / RUNTIME_TOO_LARGE. Independent read-only CI
+telemetry observes all prerequisites; conforms:false is not namespace success and does not skip tests.
+No installation, shared chmod, runner provisioning or host policy weakening is performed. Actual remote
+24.20 predicate remains unknown in the old logs; Node22's missing bwrap remains a provisioning blocker.
+
+## Public API
+
+`pi-daddy/resource-budget`: `createResourceBudget`, `openResourceBudget`, `resourceBindingDigest` and types.
+`pi-daddy/effect-profile`: `prepareDigestProfile`, `runDigestProfile`, `DIGEST_PROFILE` and types.
+Both are also exported from the root. Historical dist is not a build of these exports.
+
+```ts
+const binding = await createResourceBudget({
+  directory: '/operator-private/new-budget', // fresh child of a canonical owner-private directory
+  authorityDigest: independentlySelectedPolicyDigest,
+  limits: { maxAttempts: 8, maxInputBytes: 65536, maxConcurrent: 2 },
+});
+// Persist this detached/frozen binding in the trusted controller, separately from its journal.
+const profile = await prepareDigestProfile(binding); // actual bounded native probes; may reject
+const result = await runDigestProfile(profile, {
+  attempt: { attemptId: 'exec:unique', orderId: 'order:a', experimentId: 'experiment:b',
+    kind: 'primary', parentAttemptId: null },
+  bytes: Buffer.from('evidence'),
+}, signal);
+```
+
+The byte input and identity are detached before asynchronous work. No input is interpreted as code, an
+option, path, command, environment, lease store or destination. Byte input is base64-encoded in process
+argv; this is **not a secret-transport API**. Worker output is just digest/length, not raw input. The
+profile token is process-local and opaque: a JSON roundtrip or receipt-shaped object cannot admit work.
+The public producer validator/retention manifest is not an admission capability or work approval.
+
+## Actual boundary and supported/unsupported matrix
+
+| Route/property | Disposition |
+| --- | --- |
+| Linux bwrap user/mount/PID/network namespace setup | Observed supported on the measured WSL2 host; re-probed per prepared handle |
+| Owned outside-file read/write; mutation of owned read-only mount | Actual fixture attempts denied (`ENOENT`, `EROFS`), allowed fixture read succeeds |
+| Reach host loopback listener | Actual owned listener remains unreachable from the network namespace |
+| Untrusted code / shell / child launch API | Not exposed by this profile; Node permission child-process tripwire also actually denies spawn |
+| Worker cancellation | Existing `runChild` signal/deadline path; actual owned namespace worker/helpers observed stopped |
+| Cgroup aggregate CPU/memory/PID enforcement | Unsupported: no writable delegated cgroup measured |
+| `prlimit` | Per-process CPU/FD tripwire only, not aggregate limits; V8 heap flag is not an OS memory cap |
+| Persistent destinations / writable or shared workspace roots / alternative lease stores | Unsupported; absent from the closed API, no host workspace/store mounted |
+| Arbitrary pi/bash/model profiles; provider-money hard cap | Unsupported before workload launch; no fallback or inferred/posthoc dollar allowance |
+
+The launcher uses existing `/usr/bin/bwrap`, `/usr/bin/prlimit` and the current trusted Node executable.
+It drops capabilities **inside the child**, clears its environment, creates new namespaces and exposes
+only read-only system runtime directories plus the fixed Node binary. No host capability configuration,
+installation, privilege escalation or service/cgroup configuration changes are performed. The preparation
+probe alone mounts a fresh owned read-only fixture. That exact fixture is removed only after every awaited
+probe child has settled, on success and failure; removal failure is loud and does not replace an earlier
+probe failure. Old or caller-selected directories are never cleanup targets. The production worker mounts no user workspace.
+The production Node worker has permission mode enabled; Node permission mode by itself is not claimed
+as a hostile-JavaScript sandbox. Only fixed package code executes, so ungoverned descendants are not an
+admitted operation. Internal Node/helper threads/processes are not separate billable attempts.
+
+The selected binary fingerprints are pinned and rechecked before each workload. The operator/kernel,
+trusted package code, runtime installation and control-owned filesystem are the trust boundary. Runtime
+updates during an invocation, malicious same-UID host writers, rollback of trusted storage, kernel/runtime
+exploits and hostile-process containment are not qualified. Read-only bind mounts do not freeze a host
+administrator's runtime files. This route therefore cannot be relabelled a general shared-root sandbox.
+No user payload launches merely because executables exist or a caller claims a profile name.
+
+## What is actually reserved
+
+One independently retained `BudgetBinding` pins the canonical private directory and journal device/inode,
+external authority digest and closed limits. The budget is **one scope across all orders and experiments**
+using that binding, not a new allowance per logical name. A different binding is a different explicit
+scope, never proof of sharing an aggregate limit. There is exactly one fixed journal/lock location; the
+API offers no alternative lease-store override. Binding/header mismatch or physical replacement fails.
+
+Admission reserves **one cumulative attempt, its full input-byte count, and one active invocation slot**
+before the existing execution seam is called. Those are the only aggregate hard counters claimed. A
+maximum of 1024 attempts, 16 MiB cumulative inputs and 32 active invocations is configurable downward.
+No aggregate CPU, memory, disk, PID or money cap is asserted. Bounded trusted preparation probes are
+control/setup work, not admitted user attempts. There are no provider calls or money estimates.
+
+Primary, retry, shadow and explicitly governed descendant attempts all consume allowance; non-primary
+attempts require an existing parent reference in the same scope. A duplicate attempt ID is rejected,
+including redelivery after completion. Cancellation/failure never refunds attempts or bytes. The live
+controller releases only the active slot, after executor settlement; a mandatory settlement failure still
+rejects even if the worker exited zero. Existing finalization helpers preserve primary errors.
+
+Reopening preserves all outstanding charges/slots. An exited PID, timeout, new controller, late result or
+receipt-shaped data does **not** reclaim an orphan. Only the original live permit can settle its exact
+reservation; exact repeated settlement is idempotent and contradictory late settlement rejects. There is
+no recovery/reclaim API. Exhausted orphan capacity requires a separately designed, authorized quiescent
+reconciliation—not deleting a journal, new lease store, renamed directory or pretending a retry is free.
+
+The private journal is strict bounded JSONL, opened without symlink following, validated against independent
+binding/counters, serialized with the existing no-stale-recovery lock, and fsynced before launch. Incomplete
+writes fail closed without truncation/repair. A completed append can precede a cleanup error: no exactly-once
+blind retry guarantee. Creation is explicit/exclusive; reopening never creates/reset state. This relies on
+a trusted durable filesystem and sole cooperative host protocol, not tamper-proof consensus storage.
+
+Opt-in P02 retention records exact attempt/parent IDs, actual raw/result bytes and runtime outcomes. It is
+still `not-assessed`, and missing native session/branch fields do not become complete evidence.
+
+## Checks and limitations
+
+Direct Node tests (retained dependencies only):
+
+```sh
+node --test packages/pi-daddy/test/resource-budget.test.ts packages/pi-daddy/test/effect-profile.test.ts
+```
+
+These native effect tests require the demonstrated Linux/bwrap/Node primitive and deliberately fail rather
+than silently count unavailable containment as a passing qualification. Arithmetic tests include real
+cross-process contention, duplicate delivery, byte/count exhaustion, cancellation/restart, replaced stores,
+partial journals and immutable authority. Native tests use disposable owned fixtures and a local listener,
+not provider traffic or an untrusted hostile executable. A forwarding spawn observer verifies zero real
+spawn calls for unsupported inputs and a real post-spawn mandatory-accounting failure. No production test
+control, guard bypass, model review/test, installation or mutation machinery is introduced.

package/contracts/execution-retention/v1/README.md

@@ -0,0 +1,109 @@
+# Execution retention 1.0 — producer contract for P03
+
+Opt-in candidate API: `pi-daddy/execution-retention` (also the root export). This is a new archive
+manifest, **not** ledger v3/v4, a check-receipt schema revision, or acceptance authority. The TypeScript
+wire definition is `src/execution-retention.ts::ExecutionRetentionManifest`.
+
+## Activation and actual wiring
+
+The operator sets `PI_GRANTS_EXECUTION_ARCHIVE` to an absolute, private, operator-owned archive directory.
+No model-facing parameter is added. `delegate`, `delegate_all` and `delegate_chain` carry the actual
+public execute call ID into their shared governed executor. Each launch has its existing unique
+execution ID and parent execution ID; logical child names are NOT join keys. `runNamedCheck` uses the
+same retention writer and also accepts host `retentionDirectory` and `toolCallId` options. Unknown check
+parentage stays null. No correlation claim supplies any of these identities.
+
+The archive is asynchronous observation. Required provisioning/lease/check ledger writes retain their
+previous failure semantics; archive publication is never awaited on the worker path. No extra worker
+turn, prompt, message, extension or Herdr RPC is introduced. Herdr observation reuses existing reads.
+Absent configuration disables archival without changing spawn argv or granting any authority.
+
+## Directory and wire contract
+
+Each admitted observation gets a random archive ID, independent of the logical name and execution ID:
+
+```
+<operator-directory>/<archiveId>/manifest.json
+<operator-directory>/<archiveId>/<kind>-<sha256>.bin
+```
+
+The manifest is a small JSON object plus LF, atomically renamed from `manifest.pending`. Blob paths
+are relative basenames. Existing blobs are not overwritten; unexpected pre-existing blobs fail the
+observation. Completed generations remain readable while a new checkpoint publishes. Superseded blob
+files are retained, not deleted. External archival owns retention duration and garbage collection.
+
+- `version`: exactly `1.0`; reject unknown versions.
+- `identity`: execution/parent/child/public-call identity; executor; task, definition and configuration
+  digests; resolved workspace ID. Configuration hashes the exact plan argv/effective grant/timeout, or
+  the check's explicit executable/argv/access/bounds. It does **not** dump environment or credentials.
+  Task/definition/configuration digests are pins, **not retained instruction bytes**.
+- `native`: actual process PID or actual Herdr pane/tab/launch name. Session ID and branch leaf are null
+  in this slice. An explicitly supplied `--session` path can be recorded, but does not prove existence.
+- `state`: `running` checkpoint or `terminal`; no terminal manifest means observation is incomplete.
+- `outcome`: nullable numeric exit code and signal, timeout/abort/truncation/failure flags. A check whose
+  control record fails can have child exit code 0 and `failed:true`; its required receipt failure still throws.
+- `content`: `stdout`, `stderr`, `paneSnapshot`, `result`, `checkReceipt`, `session`. Every member is either
+  `{status:"missing",path:null,sha256:null,bytes:null}` or
+  `{status:"retained",path:<basename>,sha256:<hex>,bytes:<length>}`. `retained` means the producer wrote those
+  exact bytes before publishing that checkpoint, **not** that an external archive still possesses them.
+- `coverage`: `complete:false` and explicit loss reasons. This slice never claims evidence completeness.
+- `acceptance`: always `not-assessed`. No receipt, tool result, terminal outcome or digest implies acceptance.
+
+`stdout`/`stderr` are separate raw bytes, including available structured JSON output, not parsed into
+trusted facts. Their cross-stream interleaving is not reconstructed. `result` is the exact executor's
+assembled UTF-8 result before delegation display trimming; for checks its digest matches the returned
+receipt's `output_sha256`. `paneSnapshot` replaces prior snapshots and is not a session transcript.
+`checkReceipt` contains **the complete JSON serialization of the actual CheckReceipt plus LF**, including
+all fields, not just `receipt_id`. Available receipt bytes survive later required ledger failure; that
+failure still rejects the check. Absent receipt content stays missing.
+
+## Bounds, loss, and privacy
+
+At most 32 admitted observations are active. Each buffers at most 1 MiB of stream/snapshot data,
+plus separate 1 MiB allowances for an indivisible result and an indivisible receipt. Oversize receipts
+or results are missing, never represented by partial retained bytes. Streams may drop with explicit
+loss reasons. Checkpoints coalesce; this is not an unbounded event queue. Archive errors become `lost`;
+returned tool details may still say `pending` when publication has not completed. Treat pending,
+missing files, invalid hashes, running-only checkpoints and all coverage gaps as incomplete, not success.
+A whole producer-process crash can prevent final publication; this is not an fsync/crash-durability promise.
+External hosts may call `flush()` at quiescence with their own timeout; worker control never does so.
+
+No auth files, ambient environment dump, task text, monitoring state, or native transcript directory is
+harvested. Retained output is untrusted and **can itself contain secrets printed by a worker**; no general
+secret-redaction claim is made. Opt in only at an access-controlled harness archive boundary with an
+appropriate content-handling policy. This is not malicious-filesystem race containment.
+
+## Explicit prerequisite gap
+
+Existing governed plans normally use `--no-session`. Existing Herdr replies used here expose pane/tab
+identity, not a verified pi session ID, session file, or active branch. This slice does not change that
+privacy/control default, read auth/session directories, invent a session join, or infer branch identity
+from output. Therefore native session/transcript retention and verified session/branch TUI joins remain
+**missing** pending a separately agreed native identity/session-export seam. P03 must not treat pane ID,
+logical name, process PID, a requested session path, or output-shaped labels as that seam.
+
+## Public consumer example
+
+After a fresh build (the owner's historical dist is NOT current compiled proof):
+
+```js
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { verifyRetainedBytes } from 'pi-daddy/execution-retention';
+
+const m = JSON.parse(await readFile(manifestPath, 'utf8'));
+if (m.version !== '1.0') throw Error('unsupported retention version');
+const ref = m.content.checkReceipt;
+let bytes;
+if (ref.status === 'retained' && /^checkReceipt-[a-f0-9]{64}\.bin$/.test(ref.path)) {
+  try { bytes = await readFile(join(dirname(manifestPath), ref.path)); } catch { /* missing */ }
+}
+const observed = verifyRetainedBytes(ref, bytes); // retained | missing | mismatch
+// Even retained + terminal is NOT accepted work. Reconstruct independent P01 authority separately.
+```
+
+Apply archive size/path policies before reading untrusted manifests/blobs; never follow arbitrary paths.
+`test/execution-retention.test.ts` supplies ordinary producer/consumer fixtures: real credential-free
+fixture processes through public concurrent tools, interrupted structured bytes, complete real check
+receipt generation with a **synthetic Git identity transport**, and deterministic Herdr replies. These
+are not real pi/model/Herdr integration, real Git candidate assurance, installed smoke or formal acceptance.