pi-daddy 0.22.0 → 0.24.0

package/CHANGELOG.md

@@ -12,6 +12,46 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.24.0 — declared daily work and concurrent variants (2026-09-11)
+
+- Add `pi-daddy work add --id <id> --outcome <text>`: retain a digest-only selected obligation, reject changed redelivery and unsupported destinations, and join ordinary governed attempts without storing outcome prose. Runtime completion remains distinct from acceptance.
+- Add the production `/grants host <fresh-id>|stop` lifecycle backed by the loaded skill-harness source bridge. The original process owns child handles, private socket transport and native validators; no authority is recovered from PID, pane labels or disk state.
+- Publish frozen `pause-new-dispatch`, `resume-dispatch` and `refresh-current-work` dashboard actions. Pause changes only new ordinary admission, running children keep their original caller/result, refresh advances the existing source checkpoint explicitly, and stop never cancels a child.
+- Add explicit bounded thinking selection to child argv and Work-v4 labels. Requested effort records selection only and is not proof of provider-internal reasoning.
+- Add opt-in `delegate_all` primary return with eventual original-owner shadow accounting. Existing calls still wait for all; shadow failure or cancellation cannot replace or delay the selected primary, and invalid primary selection refuses before any child starts.
+- Derive only exact retained scope, obligation and coverage when declared facts are absent. Deadlines, violations, prior acceptance, reopen history and unavailable artifact coverage are never inferred.
+- Candidate-installed bridge/host startup, live busy-child pause/resume, same-host refresh/reconnect and primary-before-shadow settlement were observed. These are path/lifecycle checks, not acceptance or efficacy measurements.
+
+## 0.23.0 — bounded factory control and retained evidence (2026-09-11)
+
+- Add an opt-in work-ledger v4 contract, strict builders/readers, deterministic fixtures and explicit
+  authority-scoped projection. Ledger v3 remains the default governance format; existing v2/v3 paths and
+  behavior are unchanged.
+- Add opt-in execution retention for exact available process, Herdr and native-session evidence without
+  converting runtime completion into acceptance or claiming unavailable bytes.
+- Add one fixed `linux-bwrap-digest-v1` effect profile with durable aggregate attempt/input/concurrency
+  accounting. It executes package-owned digest/hold code only; arbitrary shell/model profiles, shared
+  writable destinations and aggregate CPU/memory/money enforcement remain unsupported.
+- Add versioned resource dispatch and work-intent controls, bounded experiments and factory orders. Exact
+  authority, CAS, quiescence, reservation and acknowledgement boundaries fail closed; unknown ownership is
+  never replayed, refunded or inferred as success.
+- Add read-only daily projections, retained blind debrief/checkpoint adapters and an explicit dashboard host
+  transport over a private bounded socket. Presentation, steering and cancellation require independently
+  supplied exact authority; refresh remains read-only and does not authenticate a human or module.
+- Retain original ordinary-child cancellation handles and intent admission holds without replacing caller
+  lifetimes. Best-effort terminal observation failure stays visible but no longer permanently poisons a
+  known-settled boundary; required failure, unknown ownership and late coverage still refuse quiescence.
+- Reject benign stale dashboard CAS and immutable-ID mismatches without poisoning the host before any
+  claim/effect. Attempted or uncertain effects retain the existing failed/unknown stop.
+- Remove each newly owned native-profile probe fixture after all probe children settle, on success and
+  failure, without sweeping historical or caller-selected directories.
+- CI now provisions bubblewrap on its ephemeral Ubuntu 26.04 preview runners, records bounded runtime
+  diagnostics and stages a verified job-owned Node runtime. These observations do not establish a general
+  sandbox or a new supported-host guarantee.
+- Add public subpath exports and versioned artifacts for the new work-ledger, resource, experiment,
+  factory-order, effect-profile, retention, debrief and dashboard-host APIs. The workspace root remains
+  private; `pi-daddy` is the only published package. No dependency ranges changed.
+
 ## 0.22.0 — fail-closed audit follow-ups (2026-09-04)
 
 - **BREAKING — invalid project stores now fail closed.** Malformed, unsupported, unreadable and wrong-directory

package/README.md

@@ -165,12 +165,12 @@ delegate_all({ children: [ {…}, {…}, {…} ] })                  // several
   (`PI_GRANTS_CHILD_TIMEOUT`, default 1200s) with `SIGTERM` → `SIGKILL` escalation so a child cannot ignore
   its way past it, an abort is honoured even if it arrived before the spawn, and a child that exits
   non-zero, times out or is cancelled comes back as a **tool error naming which** — not as an answer.
-- **Fan-out is synchronous and bounded.** At most 8 children per call, and the subtree budget bounds the
-  total across the whole tree. Every child goes through the same plan-gate-audit path as a single
-  `delegate`; `delegate_all` adds only cardinality and sibling identity. **There is deliberately no
-  background mode** (ADR-0015): fan-out carried most of the value and background carries nearly all of the
-  lifecycle holes, and because the turn still owns its children the parent cannot exit before them, the
-  tool-call signal is still live, and there are no ids to dangle across a compaction.
+- **Fan-out stays bounded and waits for all by default.** At most 8 children per call, and the subtree budget
+  bounds the whole tree. Every child uses the same plan-gate-audit path. The opt-in
+  `completion:"primary", primary:N` form returns when that one-based child settles while the original
+  session retains bounded role/outcome accounting for its shadows; `/grants variants` displays it. Shadow
+  failure or later cancellation cannot replace/delay the primary result. This is not detached job recovery:
+  process exit ends ownership, and there is no retry, acceptance, winner selection or result-text store.
 - **One child can be refused while its siblings succeed**, and every outcome is reported. A fan-out that
   hid its refusals would let an orchestrator summarise four reviews when only three happened.
 
@@ -236,6 +236,10 @@ depth 2 · 1 active
 
 The plugin ships inside pi-daddy and is linked globally only after an explicit **Install and open** choice.
 Literal **Not now** and **Never ask** choices are persisted; dismissing or losing the dialog stores nothing.
+A connected host can publish exact pre-authorized actions as short commands such as `pause-new-dispatch` or `defer-weekly`; the dashboard lists their human labels and accepts the key followed by Enter. The host resolves the key to its current CAS-bound request, so a person does not type JSON or tokens. Unknown/stale keys refuse before effects; raw JSON remains compatibility-only.
+
+With pi-daddy 0.24.0 and skill-harness 0.14.0 loaded, declare work, reload, then run `/grants host <fresh-id>`. This creates one process-owned daily host, captures the current work/facts sources, publishes its private socket to `/grants dashboard`, and lists `pause-new-dispatch` or `resume-dispatch` plus `refresh-current-work`. Refresh is a deliberate action that atomically mirrors the current declared ledger and advances the existing source checkpoint; periodic dashboard redraw remains read-only. Pausing blocks only new governed ordinary children; a child already running keeps its original caller/result. `/grants host stop` closes the host and never cancels a child. Restart uses a fresh id; no PID, JSON/CAS envelope or prior controller is recovered.
+
 `/grants dashboard` never installs silently and prints the exact manual command when the plugin is absent. It
 checks the bundled plugin root and protocol before suggesting that a disabled plugin be enabled. Panes and
 ledgers stay workspace/tab-specific: reuse rechecks the pane's current workspace/tab, a wrong-host open is
@@ -775,6 +779,8 @@ pi install npm:pi-daddy     # as a pi extension
 npm i pi-daddy              # as a library (the resolver, ledger and spawn planner are pure)
 npx pi-daddy init           # as a command: scaffold .pi/skills/ and .pi/grants.env from installed
                             # skill packages — see the worked example above
+npx pi-daddy work add --id daily-1 --outcome "Ship the declared slice"
+                            # select one digest-only obligation; /reload then /grants dashboard
 ```
 
 The package is also the source of the optional Herdr plugin: the extension offers to link the trusted

package/contracts/daily-view/v1/README.md

@@ -0,0 +1,114 @@
+# P04 daily read-model v1 — input for P07/P08
+
+Implemented candidate, local only. Independent overall review and formal acceptance remain pending.
+This is an actual read-only path through the existing `pi-daddy-dashboard` CLI/Herdr plugin, not a control
+API or an accepted-work counter derived from archive exits. P05 targeted control remains unavailable here.
+
+The authority snapshot has its OWN identity namespace, distinct from the selected work snapshot.
+Current/stale applicability derives from actual P01 claim/selection/matched-receipt validation, not equality
+of those IDs/digests. Missing authority and superseded/mismatched receipts cannot carry acceptance forward.
+The real walking P01 fixture with distinct identities is covered; P01 validation itself is unchanged.
+
+## Pinned P03 input, independent P01 authority
+
+`p03/` vendors exact immutable Git blobs from skill-harness
+`a311df8c991108ada7b6f4b901332232a78e9a44`. `p03/provenance.json` records paths/SHA256. Those schema/fixture
+bytes are unchanged. Input version is exactly `execution-archive-projection-v1`; the reader rejects other
+versions, duplicate JSON members/execution identities, contradictory terminal shapes and lossy numeric
+forms. It supports the adapter's emitted integer-token subset. P03 is always partial/not-assessed.
+
+Work intent is rebuilt with existing `projectWorkLedger` from separately configured strict work-v4 bytes.
+Exact selected scope/obligation revisions and occurrence bindings attach attempts by **executionId**, not
+child names, output labels, file tails, sessions or timestamps. Claimed P03 runtime and P01 runtime remain
+separate; disagreements are diagnostic. P03 conflicts neither grant nor revoke independently supplied P01
+acceptance. All active branches remain null, even if P01 labels or P03 reported sessions contain other hints.
+
+Only a genuine host supplies `workContext` to `readDailyView`/`dashboardFrame`. The reader detaches it before
+I/O and invokes P01 validation; it never manufactures decisions/availability from claims or loads authority
+from a file/environment variable. Missing authority or authority for another selection means unresolved
+acceptance, not zero completed work. Accepted results are explicitly **under supplied snapshot authority**,
+not fresh native approval. The host must independently establish availability/authority when resupplying it.
+
+## Existing view path
+
+The existing plugin command still calls `runDashboard`. Operator-only read settings are forwarded by its
+existing open/reuse seam (no new plugin, worker hook or installation flow):
+
+- `PI_DADDY_ARCHIVE_PROJECTION`: exact P03 snapshot file.
+- `PI_DADDY_WORK_LEDGER`: exact separate work-v4 file.
+- `PI_DADDY_WORK_SNAPSHOT`: JSON containing P01's exact `{snapshot:{id,digest},event:{eventId,digest}}` selection.
+  This is selection **only**, never authority. Pane reuse keys include these settings and their CWD.
+
+CLI equivalents are `--archive-projection`, `--work-ledger`, `--work-snapshot`, plus `--once --no-color` or
+`--once --daily-json`. No new files are discovered, installed or written by a status read. Legacy dashboard
+behavior is unchanged when no daily input is configured. Existing core/plugin protocol validation remains.
+Without a programmatic host-authority context the CLI intentionally cannot show authoritative acceptance.
+
+```ts
+import { readDailyView, createDailyViewReader } from 'pi-daddy/daily-view';
+const read = createDailyViewReader(); // session-local gap metadata, not an authority store
+const view = await read({ archiveProjectionPath, workLedgerPath, workContext: independentlyVerifiedP01Context,
+  sourceManifestFiles: policyAuthorizedManifestPathsBySha256 });
+// renderDailyView(view) is exported from the package root; dashboardFrame({cwd, dailyView: options})
+// invokes the same reader/render path. Rendering an arbitrary caller object is not validation.
+```
+
+## Output contract
+
+`version: "pi-daddy-daily-view-v1"`, `readOnly:true`, `freshness:"snapshot-unknown"`, `coverage:"partial"`.
+Public TypeScript types: `DailyView`, `DailyObligation`, `DailyAttempt`, `DailyViewOptions` in `src/daily-view.ts`.
+The deterministic `fixtures/view.json` and `fixtures/view.txt` are emitted by the actual reader/renderer.
+
+- `scope` is an exact P01 revision or null; `selectedSnapshot` retains the exact selection references.
+- `scopeState`, `authority`, and nullable `progress` are independent of runtime counts. Authority is
+  unavailable, stale-for-selection, or supplied-host-context. Obligations include intent/policy revisions,
+  acceptance, unstarted/attached activity, artifact/evidence coverage, matched receipt IDs, claim sources
+  and obstacle codes. IDs are shown because work-v4 has no verified human description text here.
+- `attempts` preserves exact execution identity, P01 logical child/runtime and separate validated P03 row
+  (parents/public calls/archive IDs/reported sessions/outcome/issues). Reused child names stay separate.
+  `activeBranch` is always null. An archive exit0, including failed-control exit0, is never acceptance.
+- `sourceAvailability` requires actual caller-authorized bytes matching each SHA256. No projection-supplied
+  path/URL is read. Missing mappings/deleted files are missing; mismatches/errors are not recovered facts.
+  Raw-manifest availability does not independently revalidate native transcript/check blobs or provenance.
+- Check/evidence detail comes from P01's authority-aware coverage/receipt matching. P03 v1 has no named-check
+  receipt byte payload; that gap is printed, not inferred from a terminal result or an absent issue string.
+- `sources` reports read/missing/error/unconfigured and exact file hashes. `issues` and `narrative` carry
+  deterministic coverage/obstacle explanations. No raw invalid input/error excerpts are rendered.
+
+Reads are bounded regular non-symlink descriptor snapshots (4 MiB P03, 16 MiB work; at most 128 explicitly
+mapped 64 KiB source manifests). Descriptor/path changes during read become errors. Every refresh rereads
+rather than extending a cached execution history. Missing/error frames do not retain old runtime rows.
+Reconnect produces a resnapshot and sticky gap label, never invented continuity. A new process starts with
+an initial snapshot, not recovered history. Mtime is only a consistency check, never freshness or branch
+proof. Rendering strips terminal control characters and caps lines/columns with visible omissions.
+
+## Supported and BLOCKED scope
+
+Supported: deterministic file-backed read-only view, real CLI and freshly isolated compiled plugin-command
+execution, plus fixture transport wiring through the existing plugin open seam. No worker/model/native-gate
+call is needed. Repeated reads preserve session/control bytes and message counts; disconnected/unavailable
+models do not prevent useful status. Model connectivity itself remains unknown, not falsely "connected".
+
+**BLOCKED live qualification:** no deployed P03 live archive policy/subscription or actual passive live
+transport freshness was supplied. No live Herdr pane/worker observation is claimed; no terminal read,
+scroll, monitoring prompt or control message was used. Installed smoke is separate from isolated compiled
+checks. Full native session/active-branch gaps from P02 and P06's arbitrary-shell/shared-write/aggregate
+CPU-memory-PID-money limitations remain. No accepted packet, fresh source, steering, dispatch or recovery
+can be inferred from the daily view. P07/P08 must preserve these distinctions.
+
+## Fixtures and reproduction
+
+The fixture combines three fixed P01 obligations, two independently reconstructed fixture decisions and
+one exited-but-unaccepted obligation with the exact six-row P03 fixture. P01's known branch labels are
+explicit **test-world declarations**, not authentication of P03's unknown live branches. No authority is
+constructed from incoming wire claims. Separate tests cover unstarted work, missing evidence, changed
+scope/stale authority, unavailable sources, reconnect gaps and read-only repeated operation.
+
+```sh
+node --test packages/pi-daddy/test/daily-view.test.ts
+node packages/pi-daddy/scripts/generate-daily-view-fixture.ts --check packages/pi-daddy/contracts/daily-view/v1/fixtures /absolute/owned/scratch-parent
+```
+
+The generator is repository fixture tooling, imports read-only and writes only explicit owned scratch/new
+targets. Check does not change published fixtures; scratch is retained for inspection. No install, model
+call, per-task review loop, mutation machinery or automatic authority/store update is involved.