pi-daddy 0.22.0 → 0.24.0

package/src/daily-view.ts

@@ -0,0 +1,152 @@
+import { createHash } from "node:crypto";
+import { projectWorkLedger, parseWorkLedgerText, type WorkProjectionContext, type WorkFrozen, type RevisionRef } from "./work-ledger.ts";
+import { canonicalWorkJson, copyWorkJson } from "./work-ledger-json.ts";
+import { readDailySnapshot, parseArchiveProjection, freezeDaily, type ArchiveExecution } from "./daily-view-input.ts";
+
+export const DAILY_VIEW_VERSION = "pi-daddy-daily-view-v1" as const;
+export interface DailyViewOptions {
+  archiveProjectionPath?: string; workLedgerPath?: string;
+  /** Explicit retained adapter bytes; never authority. Mutually exclusive with the corresponding path. */
+  archiveBytes?: Uint8Array; workBytes?: Uint8Array;
+  sourceManifestBytes?: Readonly<Record<string, Uint8Array>>;
+  /** Genuine independently selected host authority only. Never populated from P03 or a context file. */
+  workContext?: WorkFrozen<WorkProjectionContext>;
+  /** Policy-authorized exact paths keyed by expected raw-manifest SHA256. No producer paths followed. */
+  sourceManifestFiles?: Readonly<Record<string, string>>;
+}
+export interface DailyAttempt {
+  executionId: string; logicalChildId: string | null; intentRuntime: string;
+  archive: ArchiveExecution | null; sourceAvailability: Array<{ sha256: string; state: "available" | "missing" | "mismatch" | "error" }>;
+  issues: string[]; activeBranch: null;
+}
+export interface DailyObligation {
+  key: string; intent: RevisionRef; obligation: RevisionRef; policy: RevisionRef;
+  acceptance: "accepted-under-supplied-authority" | "unaccepted" | "unresolved";
+  artifactCoverage: string; evidenceCoverage: string; receiptIds: string[]; claimReferences: string[];
+  attempts: string[]; activity: "unstarted" | "attempts-attached"; obstacles: string[];
+}
+export interface DailyView {
+  version: typeof DAILY_VIEW_VERSION; readOnly: true; freshness: "snapshot-unknown";
+  model: "not-consulted-connectivity-unknown"; continuity: "initial-snapshot" | "resnapshot" | "reconnected-gap";
+  scopeChanged: boolean; scope: RevisionRef | null; selectedSnapshot: WorkProjectionContext["selectedSnapshot"];
+  scopeState: string; progress: { accepted: number; total: number } | null;
+  authority: "supplied-host-context" | "unavailable" | "stale-for-selection"; coverage: "partial";
+  sources: { archive: string; work: string; archiveSha256: string | null; workSha256: string | null };
+  obligations: DailyObligation[]; attempts: DailyAttempt[]; issues: string[]; narrative: string;
+}
+const refKey = (r: WorkFrozen<RevisionRef>) => `${r.kind}:${r.id}:${r.revision}:${r.digest}`;
+const sorted = (values: readonly string[]) => [...new Set(values)].sort();
+function contextCopy(value: DailyViewOptions["workContext"]): WorkProjectionContext {
+  const copied = JSON.parse(canonicalWorkJson(copyWorkJson(value ?? { selectedSnapshot: null, authority: null }))) as WorkProjectionContext;
+  if (projectWorkLedger("", copied).errors.some(e => e.code === "WORK_CONTEXT_INVALID")) throw new TypeError("invalid independent P01 context");
+  return copied;
+}
+const readers = new WeakSet<object>();
+/** Only actual factory readers may carry continuity state through the dashboard; not arbitrary callbacks. */
+export function isDailyViewReader(value: unknown): value is ReturnType<typeof createDailyViewReader> {
+  return typeof value === "function" && readers.has(value);
+}
+/** Each read starts from complete bounded snapshots. The tracker holds only gap/scope metadata, not authority. */
+export function createDailyViewReader() {
+  let seen = false, gap = false, lastSelection = "";
+  const read = async (options: DailyViewOptions): Promise<DailyView> => {
+    try {
+    const archivePath = options.archiveProjectionPath, workPath = options.workLedgerPath;
+    const context = contextCopy(options.workContext);
+    const files = Object.fromEntries(Object.entries(options.sourceManifestFiles ?? {}));
+    if (Object.keys(files).length > 128 || Object.entries(files).some(([key, value]) => !/^[a-f0-9]{64}$/.test(key) || typeof value !== "string")) throw new TypeError("bounded explicit source file map required");
+    const snapshot = (bytes: Uint8Array | undefined, path: string | undefined, limit: number) => {
+      if (bytes === undefined) return readDailySnapshot(path, limit);
+      if (path !== undefined || !(bytes instanceof Uint8Array) || bytes.length > limit) throw new TypeError("bounded exclusive retained snapshot required");
+      const copy=Buffer.from(bytes); return { status: "read" as const, bytes: copy, sha256: createHash("sha256").update(copy).digest("hex") };
+    };
+    const entries=Object.entries(options.sourceManifestBytes??{});if(entries.length>128)throw Error("source byte map bound");
+    const manifestBytes=Object.fromEntries(entries.map(([key,bytes])=>{
+      if(!/^[a-f0-9]{64}$/.test(key)||!(bytes instanceof Uint8Array)||bytes.length>65536)throw Error("bounded source bytes required");return [key,Buffer.from(bytes)];
+    }));
+    const [archiveRead, workRead] = await Promise.all([snapshot(options.archiveBytes,archivePath, 2*1024*1024), snapshot(options.workBytes,workPath, 16 * 1024 * 1024)]);
+    let archiveStatus: string = archiveRead.status, workStatus: string = workRead.status;
+    let archive: ArchiveExecution[] = [], work = projectWorkLedger("", context), workText = "";
+    const issues: string[] = [];
+    if (archiveRead.status === "read") {
+      try { archive = parseArchiveProjection(new TextDecoder("utf-8", { fatal: true }).decode(archiveRead.bytes)).executions; }
+      catch { archiveStatus = "error"; issues.push("archive-invalid-or-unsupported-version"); }
+    }
+    if (workRead.status === "read") {
+      try { workText = new TextDecoder("utf-8", { fatal: true }).decode(workRead.bytes); work = projectWorkLedger(workText, context); }
+      catch { workStatus = "error"; issues.push("work-input-invalid"); }
+      if (work.errors.length) { workStatus = "error"; issues.push("work-projection-errors"); }
+    }
+    const selection = JSON.stringify(context.selectedSnapshot), scopeChanged = seen && selection !== lastSelection;
+    const unavailable = archiveStatus !== "read" || ((Boolean(workPath) || options.workBytes !== undefined) && workStatus !== "read");
+    if (unavailable) gap = true;
+    const continuity = seen ? gap && !unavailable ? "reconnected-gap" : "resnapshot" : "initial-snapshot";
+    seen = true; lastSelection = selection;
+    if (scopeChanged) issues.push("scope-selection-changed; prior acceptance not carried forward");
+    if (gap) issues.push("observation-gap; resnapshot is not continuity");
+    if (archiveStatus !== "read") issues.push(`archive-${archiveStatus}`);
+    if (workStatus !== "read") issues.push(`work-${workStatus}`);
+    // Authority snapshot and selected work snapshot inhabit different identity namespaces.
+    // Applicability comes from P01's exact claim/selection/receipt validation, never ID equality.
+    const stale = !work.claims.some(c => c.matchedReceiptIds.length) && work.claims.some(c =>
+      c.applicability === "superseded" || c.problems.some(p => p.code === "RECEIPT_MISMATCH"));
+    const authority: DailyView["authority"] = !context.authority ? "unavailable" : stale ? "stale-for-selection" : "supplied-host-context";
+    if (authority !== "supplied-host-context") issues.push(`host-authority-${authority}`);
+    const events = workText && work.scopeState === "valid" ? parseWorkLedgerText(workText).events : [];
+    const selected = events.find(e => e.event === "work_snapshot" && e.eventId === context.selectedSnapshot?.event.eventId && e.digest === context.selectedSnapshot.event.digest);
+    const scope = selected?.event === "work_snapshot" ? selected.payload.snapshot.scope : null;
+    const available = new Map<string, DailyAttempt["sourceAvailability"][number]["state"]>();
+    const requested = sorted(archive.flatMap(e => e.sourceReferences));
+    for (const sha256 of requested) {
+      if (manifestBytes[sha256]) { available.set(sha256,createHash("sha256").update(manifestBytes[sha256]).digest("hex")===sha256?"available":"mismatch"); continue; }
+      if (!files[sha256]) { available.set(sha256, "missing"); continue; }
+      const source = await readDailySnapshot(files[sha256], 64 * 1024);
+      available.set(sha256, source.status === "read" ? source.sha256 === sha256 ? "available" : "mismatch" : source.status === "error" ? "error" : "missing");
+    }
+    const attempts = new Map<string, DailyAttempt>();
+    for (const attempt of work.runtime?.attempts ?? []) attempts.set(attempt.executionId, {
+      executionId: attempt.executionId, logicalChildId: attempt.childId, intentRuntime: attempt.state, archive: null,
+      sourceAvailability: [], issues: attempt.problems.map(p => `P01:${p.code}`), activeBranch: null,
+    });
+    for (const entry of archive) {
+      const a = attempts.get(entry.executionId) ?? { executionId: entry.executionId, logicalChildId: null, intentRuntime: "unknown",
+        archive: null, sourceAvailability: [], issues: [], activeBranch: null } as DailyAttempt;
+      a.archive = entry; a.issues.push(...entry.issues.map(i => `P03:${i}`));
+      a.sourceAvailability = entry.sourceReferences.map(sha256 => ({ sha256, state: available.get(sha256) ?? "missing" }));
+      if (!entry.sourceReferences.length) a.issues.push("source-hashes-absent");
+      if (a.sourceAvailability.some(r => r.state !== "available")) a.issues.push("source-bytes-unavailable-or-mismatched");
+      const intent = work.runtime?.attempts.find(r => r.executionId === entry.executionId);
+      if (intent && (entry.parentExecutionIds.length !== 1 || entry.parentExecutionIds[0] !== intent.parentExecutionId)) a.issues.push("P01-P03-parent-disagreement");
+      if (intent && intent.state === "running" && entry.runtime === "terminal") a.issues.push("P01-P03-runtime-disagreement");
+      a.issues = sorted(a.issues); attempts.set(a.executionId, a);
+    }
+    const obligations: DailyObligation[] = work.obligations.map(o => {
+      const attached = (work.runtime?.attempts ?? []).filter(a => a.bindings.some(b => scope && refKey(b.scope) === refKey(scope) && refKey(b.obligation) === refKey(o.binding.obligation)));
+      return {
+        key: canonicalWorkJson(copyWorkJson(o.binding)), intent: o.binding.intent, obligation: o.binding.obligation, policy: o.binding.policy,
+        acceptance: authority === "supplied-host-context" ? o.acceptance : "unresolved", artifactCoverage: o.artifactCoverage.state,
+        evidenceCoverage: o.evidenceCoverage.state,
+        receiptIds: sorted(work.claims.filter(c => o.claims.some(r => r.eventId === c.claim.eventId && r.digest === c.claim.digest)).flatMap(c => [...c.matchedReceiptIds])),
+        claimReferences: o.claims.map(c => `${c.eventId}:${c.digest}`).sort(), attempts: attached.map(a => a.executionId).sort(),
+        activity: attached.length ? "attempts-attached" : "unstarted", obstacles: sorted(o.problems.map(p => `P01:${p.code}`)),
+      };
+    });
+    obligations.sort((a, b) => {
+      const left = `${a.obligation.id}:${a.key}`, right = `${b.obligation.id}:${b.key}`;
+      return left < right ? -1 : left > right ? 1 : 0;
+    });
+    const progress = authority === "supplied-host-context" && workStatus === "read" ? work.progress : null;
+    issues.push(...work.problems.map(p => `P01:${p.code}`));
+    const view: DailyView = { version: DAILY_VIEW_VERSION, readOnly: true, freshness: "snapshot-unknown", model: "not-consulted-connectivity-unknown",
+      continuity, scopeChanged, scope, selectedSnapshot: context.selectedSnapshot, scopeState: work.scopeState,
+      progress, authority, coverage: "partial",
+      sources: { archive: archiveStatus, work: workStatus, archiveSha256: archiveRead.status === "read" ? archiveRead.sha256 : null, workSha256: workRead.status === "read" ? workRead.sha256 : null },
+      obligations, attempts: [...attempts.values()].sort((a, b) => a.executionId < b.executionId ? -1 : a.executionId > b.executionId ? 1 : 0), issues: sorted(issues),
+      narrative: `${obligations.length} scoped obligation(s); ${progress ? `${progress.accepted}/${progress.total} accepted under supplied P01 authority` : "acceptance unresolved"}; ${attempts.size} distinct attempt(s). Runtime exits do not establish acceptance. Snapshot freshness unknown.`,
+    };
+    return freezeDaily(view);
+    } catch (error) { gap = true; seen = true; throw error; }
+  };
+  readers.add(read); return read;
+}
+export const readDailyView = (options: DailyViewOptions): Promise<DailyView> => createDailyViewReader()(options);

package/src/dashboard-cli.ts

@@ -1,10 +1,33 @@
 #!/usr/bin/env node
+import { connectDashboardHost, isDashboardConnection, ENV_DASHBOARD_HOST_SOCKET, type DashboardConnection } from "./dashboard-host-transport.ts";
+import { dashboardHostRequest, type DashboardHostRequest } from "./dashboard-host.ts";
+export { ENV_DASHBOARD_HOST_SOCKET } from "./dashboard-host-transport.ts";
 import { realpathSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseDashboardLedger } from "./dashboard-projection.ts";
 import { renderDashboard } from "./dashboard-render.ts";
+import { createDailyViewReader, isDailyViewReader, readDailyView, type DailyViewOptions } from "./daily-view.ts";
+import { renderDailyView } from "./daily-view-render.ts";
+import { projectWorkLedger, type WorkProjectionContext } from "./work-ledger.ts";
+import { parseRetentionJson } from "./retention-json.ts";
+import { createInterface } from "node:readline";
+import { isDebriefPresenter, type DebriefPresenter } from "./debrief.ts";
+import { renderDebrief, debriefAction } from "./debrief-render.ts";
+import { createFixtureDebrief } from "./debrief-fixture.ts";
+export const ENV_DEBRIEF_FIXTURE = "PI_DADDY_DEBRIEF_FIXTURE";
+export { debriefAction as dashboardDebriefAction } from "./debrief-render.ts";
+
+export const ENV_DAILY_ARCHIVE = "PI_DADDY_ARCHIVE_PROJECTION";
+export const ENV_DAILY_WORK = "PI_DADDY_WORK_LEDGER";
+export const ENV_DAILY_SELECTION = "PI_DADDY_WORK_SNAPSHOT";
+function dailySelection(text: string | undefined): WorkProjectionContext["selectedSnapshot"] {
+  if (!text) return null;
+  const selection = parseRetentionJson(text) as WorkProjectionContext["selectedSnapshot"];
+  if (projectWorkLedger("", { selectedSnapshot: selection, authority: null }).errors.some(e => e.code === "WORK_CONTEXT_INVALID")) throw new TypeError("invalid P01 snapshot selection");
+  return selection;
+}
 
 export const DASHBOARD_PROTOCOL_VERSION = 1 as const;
 export const ENV_DASHBOARD_LEDGER = "PI_DADDY_LEDGER";
@@ -20,6 +43,19 @@ export interface DashboardFrameOptions {
   width?: number;
   details?: boolean;
   now?: Date;
+  dailyView?: DailyViewOptions;
+  dailyReader?: ReturnType<typeof createDailyViewReader>;
+  dailyJson?: boolean;
+  debrief?: DebriefPresenter;
+  debriefJson?: boolean;
+  connected?: DashboardConnection;
+}
+export async function dashboardHostAction(host:DashboardConnection,line:string){
+  if(!isDashboardConnection(host)||Buffer.byteLength(line)>60000)throw Error("genuine bounded dashboard connection required");
+  const command=line.trim();
+  if(command.startsWith("{"))return host.action(dashboardHostRequest(parseRetentionJson(command,60000) as DashboardHostRequest));
+  if(!/^[a-zA-Z0-9:_-]{1,64}$/.test(command))throw Error("dashboard action must be a listed command key");
+  return host.humanAction(command);
 }
 
 function shellQuote(value: string): string {
@@ -57,6 +93,31 @@ export async function dashboardFrame(options: DashboardFrameOptions): Promise<st
   if (options.protocol !== undefined && options.protocol !== DASHBOARD_PROTOCOL_VERSION) {
     return incompatibleFrame(options.protocol);
   }
+  if(options.connected){
+    if(!isDashboardConnection(options.connected))throw Error("original dashboard connection required");
+    let view:Awaited<ReturnType<DashboardConnection["frame"]>>;
+    try{view=await options.connected.frame();}catch{return "PI-DADDY — CONNECTED HOST UNAVAILABLE\nNo prior acceptance, presentation or continuity substituted. No action retried.";}
+    if(options.dailyJson||options.debriefJson)return JSON.stringify(view);
+    const source=view.source as {daily?:Parameters<typeof renderDailyView>[0]}|null;
+    const actions=(view.actions as {key:string;label:string}[]|undefined)??[];
+    return ["PI-DADDY — CONNECTED HOST (snapshot; identity/acceptance not authenticated)",source?.daily?renderDailyView(source.daily,options.width):"Source unavailable; no previous acceptance substituted.",
+      view.debrief?renderDebrief(view.debrief as Parameters<typeof renderDebrief>[0],options.width):"Debrief deferred/closed. No implicit presentation or steering.",
+      `Attention reserved ${view.attention.attentionUsed}/5 (not proof of delivery). Tip ${view.tip}.`,
+      actions.length?`ACTIONS — type one command and Enter\n${actions.map(action=>`  ${action.key} — ${action.label}`).join("\n")}`:"ACTIONS — none currently authorized; refresh never acts."].join("\n\n");
+  }
+  if (options.debrief || options.debriefJson) {
+    if (!isDebriefPresenter(options.debrief)) return "PI-DADDY — DEBRIEF UNAVAILABLE: genuine presenter/host missing";
+    const view = options.debrief.view(); return options.debriefJson ? JSON.stringify(view) : renderDebrief(view, options.width);
+  }
+  if (options.dailyView) {
+    try {
+      if (options.dailyReader !== undefined && !isDailyViewReader(options.dailyReader)) throw new TypeError("untrusted daily reader callback");
+      const view = await (options.dailyReader ?? readDailyView)(options.dailyView);
+      return options.dailyJson ? JSON.stringify(view) : renderDailyView(view, options.width);
+    } catch {
+      return "PI-DADDY — DAILY VIEW UNAVAILABLE\nInvalid or unavailable read-only input. No previous acceptance or continuity was substituted.";
+    }
+  }
   if (!options.ledgerPath) return setupFrame(options.cwd);
 
   const ledgerPath = resolve(options.cwd, options.ledgerPath);
@@ -90,25 +151,43 @@ interface CliOptions {
   details: boolean;
   color: boolean;
   ledgerPath?: string;
+  archivePath?: string;
+  workPath?: string;
+  selection?: string;
+  dailyJson: boolean;
+  debriefFixture: boolean;
+  debriefJson: boolean;
+  hostSocket?: string;
 }
 
 function parseArgs(argv: string[]): CliOptions {
   let once = false;
   let details = false;
   let color = process.stdout.isTTY;
-  let ledgerPath: string | undefined;
+  let ledgerPath: string | undefined, archivePath: string | undefined, workPath: string | undefined, selection: string | undefined;
+  let dailyJson = false, debriefFixture = false, debriefJson = false;let hostSocket:string|undefined;
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (arg === "--once") once = true;
     else if (arg === "--details") details = true;
     else if (arg === "--no-color") color = false;
     else if (arg === "--ledger") ledgerPath = argv[++index];
+    else if (arg === "--daily-json") dailyJson = true;
+    else if (arg === "--debrief-fixture") debriefFixture = true;
+    else if (arg === "--debrief-json") debriefJson = true;
+    else if(arg === "--host-socket"){hostSocket=argv[++index];if(!hostSocket||hostSocket.startsWith("--"))throw Error("explicit host socket required");}
+    else if (["--archive-projection", "--work-ledger", "--work-snapshot"].includes(arg)) {
+      const value = argv[++index]; if (!value || value.startsWith("--")) throw new Error("missing daily view argument");
+      if (arg === "--archive-projection") archivePath = value;
+      else if (arg === "--work-ledger") workPath = value;
+      else selection = value;
+    }
     else throw new Error(`unknown dashboard argument ${JSON.stringify(arg)}`);
   }
-  return { once, details, color, ledgerPath };
+  return { once, details, color, ledgerPath, archivePath, workPath, selection, dailyJson, debriefFixture, debriefJson, hostSocket };
 }
 
-export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.ProcessEnv = process.env): Promise<void> {
+export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.ProcessEnv = process.env, host: { debrief?: DebriefPresenter; connected?:DashboardConnection } = {}): Promise<void> {
   const cli = parseArgs(argv);
   const cwd = process.cwd();
   const ledgerPath = cli.ledgerPath ?? (env[ENV_DASHBOARD_LEDGER]?.trim() || undefined);
@@ -117,6 +196,22 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
   const key = env[ENV_DASHBOARD_KEY]?.trim();
   process.title = `pi-daddy-dashboard${key ? `:${key.slice(0, 12)}` : ""}`;
 
+  const archivePath = cli.archivePath ?? env[ENV_DAILY_ARCHIVE];
+  const workPath = cli.workPath ?? env[ENV_DAILY_WORK];
+  const selectedSnapshot = dailySelection(cli.selection ?? env[ENV_DAILY_SELECTION]);
+  const dailyView = archivePath || workPath || selectedSnapshot || cli.dailyJson ? {
+    archiveProjectionPath: archivePath ? resolve(cwd, archivePath) : undefined,
+    workLedgerPath: workPath ? resolve(cwd, workPath) : undefined,
+    workContext: { selectedSnapshot, authority: null },
+  } : undefined;
+  const socket=cli.hostSocket??env[ENV_DASHBOARD_HOST_SOCKET];const connected=host.connected??(socket?connectDashboardHost(socket):undefined);
+  if(connected&&(host.debrief||cli.debriefFixture||env[ENV_DEBRIEF_FIXTURE]==="1"))throw Error("connected host and separate debrief are exclusive");
+  const debrief = host.debrief ?? (cli.debriefFixture || env[ENV_DEBRIEF_FIXTURE] === "1" ? await createFixtureDebrief() : undefined);
+  if (debrief) {
+    if (!isDebriefPresenter(debrief)) throw new Error("invalid debrief presenter");
+    if (!host.debrief) await debrief.open({ mode: "manual", userPresent: true }); // Explicit CLI fixture only; never override a host deferral.
+  }
+  const dailyReader = createDailyViewReader();
   let previous = "";
   const draw = async (clear: boolean): Promise<void> => {
     const frame = await dashboardFrame({
@@ -126,6 +221,7 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
       color: cli.color,
       width: process.stdout.columns || 80,
       details: cli.details,
+      dailyView, dailyReader, dailyJson: cli.dailyJson, debrief, debriefJson: cli.debriefJson, connected,
     });
     if (frame === previous && !clear) return;
     previous = frame;
@@ -143,11 +239,19 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
     drawing = true;
     void draw(true).finally(() => { drawing = false; });
   };
+  const input = debrief || connected ? createInterface({ input: process.stdin, terminal: false }) : null;
+  let acting = false;
+  input?.on("line", line => {
+    if (acting) return;
+    acting = true;
+    void (connected?dashboardHostAction(connected,line):debriefAction(debrief!, line)).catch(() => { process.stderr.write("Debrief action refused or acknowledgement unknown; inspect/reconcile explicitly.\n"); })
+      .finally(() => { acting = false; redraw(); });
+  });
   const timer = setInterval(redraw, DASHBOARD_REFRESH_MS);
   process.on("SIGWINCH", redraw);
   await new Promise<void>((settle) => {
     const stop = () => {
-      clearInterval(timer);
+      clearInterval(timer); input?.close();
       process.off("SIGWINCH", redraw);
       settle();
     };

package/src/dashboard-harness.ts

@@ -0,0 +1,37 @@
+import { constants } from "node:fs";
+import { lstat,realpath,open,mkdir,mkdtemp,writeFile,symlink } from "node:fs/promises";
+import { dirname,join,isAbsolute } from "node:path";
+import { pathToFileURL } from "node:url";
+import { dataDigest,byteDigest,detached,sha } from "./debrief-contract.ts";
+import { DASHBOARD_HARNESS_PIN,type DashboardHarness } from "./dashboard-host-contract.ts";
+export interface DashboardHarnessArtifact {version:"dashboard-harness-artifact-v1";sourceCommit:typeof DASHBOARD_HARNESS_PIN;files:Record<string,string>;typeboxRoot:string;typeboxPackageSha256:string}
+const loaded=new WeakMap<object,string>();
+export const DASHBOARD_HARNESS_BRIDGE_SOURCE="127b349310dd8f28e5d6b12148a063fce66a77dd";
+const bridgeFunctions=["learningJournal","createTrustLifecycle","openTrustLifecycle","trustPolicyDigest","archivePolicyBinding","ingestPolicySource","readArchiveCheckpoint","readArchiveSource","retainArchiveSource","captureArchivedWorkSignals","readRetainedExecution","projectRetainedExecutions","createWorkCaseReviewer","createWorkSignalReviewer","retainBlindIntervention","openBlindIntervention"] as const;
+/** Adopt the API published by the already-loaded skill-harness extension. Same-process source identity is not human authentication. */
+export function adoptDashboardHarnessBridge(input:unknown):DashboardHarness{
+ const value=input as {version?:unknown;sourceCommit?:unknown;api?:unknown};
+ if(!value||typeof value!=="object"||Object.keys(value).sort().join()!=="api,sourceCommit,version"||value.version!=="skill-harness-dashboard-bridge-v1"||value.sourceCommit!==DASHBOARD_HARNESS_BRIDGE_SOURCE)throw Error("exact supported harness bridge required");
+ const api=value.api as DashboardHarness;if(!api||typeof api!=="object"||!Object.isFrozen(api)||bridgeFunctions.some(name=>typeof (api as unknown as Record<string,unknown>)[name]!=="function"))throw Error("frozen harness API with required source jobs required");
+ const digest=dataDigest({version:value.version,sourceCommit:value.sourceCommit,functions:bridgeFunctions});loaded.set(api,digest);return api;
+}
+export const loadedDashboardHarnessDigest=(h:unknown):string|null=>typeof h==="object"&&h!==null?loaded.get(h)??null:null;
+async function privateDirectory(path:string){const stat=await lstat(path);if(!isAbsolute(path)||await realpath(path)!==path||!stat.isDirectory()||stat.mode&0o077||stat.uid!==process.getuid?.())throw Error("canonical private owned harness directory required");}
+async function bytes(path:string){if(await realpath(path)!==path)throw Error("harness artifact alias");const fd=await open(path,constants.O_RDONLY|constants.O_NOFOLLOW|constants.O_NONBLOCK);try{const stat=await fd.stat();if(!stat.isFile()||stat.nlink!==1||stat.mode&0o022||stat.size>1048576)throw Error("bounded immutable artifact required");const value=Buffer.alloc(stat.size+1),n=await fd.read(value,0,value.length,0),after=await fd.stat();if(n.bytesRead!==stat.size||after.size!==stat.size||after.mtimeMs!==stat.mtimeMs||after.ctimeMs!==stat.ctimeMs)throw Error("artifact changed during read");return value.subarray(0,n.bytesRead);}finally{await fd.close();}}
+/** Load approved real compiled artifacts into an exclusive private tree, avoiding stale module-cache paths.
+ * Byte identity is NOT human/module authentication or hostile-same-UID confinement. No build/install here.
+ * Typebox is the explicit existing peer; its package metadata is bound, not a whole peer-source attestation. */
+export async function loadDashboardHarness(artifactRoot:string,input:DashboardHarnessArtifact,parent:string){
+ const manifest=detached(input);if(manifest.version!=="dashboard-harness-artifact-v1"||manifest.sourceCommit!==DASHBOARD_HARNESS_PIN||!sha(manifest.typeboxPackageSha256))throw Error("exact supported harness artifact required");
+ const files=Object.entries(manifest.files);if(!files.length||files.length>128||files.some(([p,h])=>!sha(h)||!/^([a-zA-Z0-9_-]+\/)*[a-zA-Z0-9_.-]+\.(js|json)$/.test(p)))throw Error("bounded closed artifact inventory required");
+ await privateDirectory(artifactRoot);await privateDirectory(parent);
+ if(await realpath(manifest.typeboxRoot)!==manifest.typeboxRoot||byteDigest(await bytes(join(manifest.typeboxRoot,"package.json")))!==manifest.typeboxPackageSha256)throw Error("retained typebox peer changed");
+ const content=new Map<string,Buffer>();let total=0;for(const[p,digest]of files){const b=await bytes(join(artifactRoot,p));total+=b.length;if(total>8*1024*1024||byteDigest(b)!==digest)throw Error("harness artifact digest mismatch");content.set(p,b);}
+ if(content.get("package.json")?.toString()!=='{"type":"module"}')throw Error("explicit ESM artifact root required");
+ const directory=await mkdtemp(join(parent,"loaded-harness-"));for(const[p,b]of content){await mkdir(dirname(join(directory,p)),{recursive:true,mode:0o700});await writeFile(join(directory,p),b,{flag:"wx",mode:0o400});}
+ await mkdir(join(directory,"node_modules"));await symlink(manifest.typeboxRoot,join(directory,"node_modules/typebox"));
+ const names=["learning-journal","trust-lifecycle","archive-policy","archive-observer","archive-checkpoint","archived-work","execution-retention-archive","work-case-review","blind-intervention","evidence-archive","work-signal-observation","work-signal-cases","work-case-archive"];
+ const api=Object.assign({},...await Promise.all([...names.map(n=>"packages/adapters/src/"+n+".js"),"core.js"].map(p=>{if(!content.has(p))throw Error("missing genuine harness entry");return import(pathToFileURL(join(directory,p)).href);}))) as DashboardHarness;
+ for(const[p,digest]of files)if(byteDigest(await bytes(join(directory,p)))!==digest)throw Error("loaded harness bytes changed");
+ Object.freeze(api);const digest=dataDigest(manifest);loaded.set(api,digest);return Object.freeze({api,artifactDigest:digest,directory,manifest});
+}

package/src/dashboard-herdr.ts

@@ -6,7 +6,7 @@ import {
   ENV_DASHBOARD_KEY,
   ENV_DASHBOARD_LEDGER,
   ENV_DASHBOARD_PROTOCOL,
-  DASHBOARD_PROTOCOL_VERSION,
+  DASHBOARD_PROTOCOL_VERSION, ENV_DAILY_ARCHIVE, ENV_DAILY_WORK, ENV_DAILY_SELECTION, ENV_DEBRIEF_FIXTURE, ENV_DASHBOARD_HOST_SOCKET,
 } from "./dashboard-cli.ts";
 import { parseReply, type HerdrExec } from "./herdr-cli.ts";
 import { withFileLock } from "./file-lock.ts";
@@ -263,8 +263,12 @@ export async function openOrReuseDashboard(input: DashboardOpenInput): Promise<D
   const exec = input.exec ?? dashboardHerdrExec;
   const ledgerPath = input.ledgerPath.trim() ? resolve(input.cwd, input.ledgerPath) : "";
   const cwd = resolve(input.cwd);
+  // Explicit operator inputs/owned host endpoint only, never an authority file or ambient snapshot.
+  // The endpoint keeps original controller handles in its owning process; it is not TUI attachment.
+  const dailyEnv = [ENV_DAILY_ARCHIVE, ENV_DAILY_WORK, ENV_DAILY_SELECTION, ENV_DEBRIEF_FIXTURE, ENV_DASHBOARD_HOST_SOCKET]
+    .flatMap(name => process.env[name] ? ["--env", `${name}=${process.env[name]}`] : []);
   const key = createHash("sha256")
-    .update(`${input.host.workspaceId}\0${input.host.tabId}\0${ledgerPath}`, "utf8")
+    .update(`${input.host.workspaceId}\0${input.host.tabId}\0${ledgerPath}${dailyEnv.length ? JSON.stringify([cwd, ...dailyEnv]) : ""}`, "utf8")
     .digest("hex");
   await mkdir(dirname(input.statePath), { recursive: true });
 
@@ -307,6 +311,7 @@ export async function openOrReuseDashboard(input: DashboardOpenInput): Promise<D
       ...(ledgerPath ? ["--env", `${ENV_DASHBOARD_LEDGER}=${ledgerPath}`] : []),
       "--env", `${ENV_DASHBOARD_PROTOCOL}=${DASHBOARD_PROTOCOL_VERSION}`,
       "--env", `${ENV_DASHBOARD_KEY}=${key}`,
+      ...dailyEnv,
       "--no-focus",
     ];
     const opened = parseReply(await exec(args));

package/src/dashboard-host-contract.ts

@@ -0,0 +1,45 @@
+import { dataDigest, detached, freeze, sha } from "./debrief-contract.ts";
+import { controlShape } from "./dispatch-control.ts";
+import type { DebriefHarness, DurableBlindBinding, CaseSelection } from "./debrief-host.ts";
+import type { WorkProjectionContext, WorkFrozen } from "./work-ledger.ts";
+import type { DispatchAuthority } from "./dispatch-control.ts";
+import type { OrdinaryAuthority } from "./ordinary-children.ts";
+import type { ExperimentAuthority } from "./experiment-contract.ts";
+export const DASHBOARD_HARNESS_PIN = "127b349310dd8f28e5d6b12148a063fce66a77dd";
+export interface HostEvent { id: string; prior: string | null; value: Record<string, unknown> }
+export interface HostJournal { read(): HostEvent[]; append(prior: string, value: Record<string, unknown>): HostEvent }
+/** Loaded trusted ports; an interface or caller-supplied pin is NOT module/human authentication. */
+export interface DashboardHarness extends DebriefHarness {
+  learningJournal(path: string, initial?: Record<string, unknown>): HostJournal;
+  openTrustLifecycle(path: string): { history(): HostEvent[]; inspect(now: number): { policyId: string; attentionUsed: number; tip: string; grantExpansion: false }; expose(id: string, now: number): { mode: string; reason: string; replayed: boolean } };
+  createTrustLifecycle(path:string,input:unknown,authorized:readonly string[]):unknown;
+  trustPolicyDigest(input:unknown):string;
+  retainArchiveSource(root:string,input:unknown):{manifestId:string};
+  archivePolicyBinding(path: string, source: string): { policySha256: string; archiveRoot: string };
+  ingestPolicySource(path: string, source: string, previous?: string, expectedPolicy?: string): { checkpointId: string; sourceStatus: string; issues?: string[]; [key: string]: unknown };
+  readArchiveCheckpoint(root: string, checkpoint: string): { checkpoint: { sourceManifestId: string; issues: string[]; [key: string]: unknown } };
+  readArchiveSource(root: string, id: string): { status: string; bytes?: Uint8Array; reference?: { retention: string; sha256: string; [key: string]: unknown } };
+  captureArchivedWorkSignals(root: string, id: string, context: WorkFrozen<WorkProjectionContext>, facts: unknown): { caseBatchId: string; observationId: string; linkageManifestId: string };
+  readRetainedExecution(root: string, id: string): { projection: unknown };
+  projectRetainedExecutions(values: readonly unknown[]): unknown;
+}
+export interface DashboardHostConfig {
+  version: "producer-dashboard-host-v1"; trustDirectory: string; trustPolicyId: string; archiveRoot: string; scope: string; author: string;
+  policyPath: string; policySha256: string; sources: { id: string; kind: "work" | "retention" | "facts" }[];
+  selection: WorkProjectionContext["selectedSnapshot"]; cases: CaseSelection | null; blind: DurableBlindBinding | null;
+  budgetDigest: string; experimentDigest: string | null; harnessArtifactDigest: string;
+  ordinaryDigest?: string;
+}
+export interface DashboardHostRequest { version: "1.0"; requestId: string; hostDigest: string; expectedTip: string; selectionDigest: string; operation: "observe" | "present" | "presented" | "defer" | "debrief" | "dispatch" | "intent" | "cancel" | "dispatch-reconcile" | "intent-reconcile" | "ordinary-cancel"; payload: unknown }
+export interface DashboardHostAuthority {
+  hostDigests: readonly string[]; requestDigests: readonly string[];
+  workContext: WorkFrozen<WorkProjectionContext>; dispatch: DispatchAuthority | null; experiment: ExperimentAuthority | null;
+  ordinary?: OrdinaryAuthority | null;
+}
+export const dashboardHostDigest = (c: DashboardHostConfig): string => dataDigest(c);
+export const dashboardSelectionDigest = (selection: DashboardHostConfig["selection"]): string => dataDigest(selection);
+export function dashboardHostRequest(input: DashboardHostRequest) {
+  const r=detached(input);controlShape(r,["version","requestId","hostDigest","expectedTip","selectionDigest","operation","payload"]);
+  if(r.version!=="1.0"||!/^[a-zA-Z0-9:_-]{1,128}$/.test(r.requestId)||![r.hostDigest,r.expectedTip,r.selectionDigest].every(sha)||!["observe","present","presented","defer","debrief","dispatch","intent","cancel","dispatch-reconcile","intent-reconcile","ordinary-cancel"].includes(r.operation)||Buffer.byteLength(JSON.stringify(r))>60000)throw Error("bounded exact dashboard request required");return freeze(r);
+}
+export const dashboardHostRequestDigest = (r: DashboardHostRequest): string => dataDigest(dashboardHostRequest(r));

package/src/dashboard-host-transport.ts

@@ -0,0 +1,40 @@
+import { createServer, createConnection, type Socket } from "node:net";
+import { lstat, realpath, chmod } from "node:fs/promises";
+import { dirname, isAbsolute } from "node:path";
+import { parseRetentionJson } from "./retention-json.ts";
+import { isDashboardHost, dashboardHostRequest, type DashboardHost, type DashboardHostRequest } from "./dashboard-host.ts";
+export const ENV_DASHBOARD_HOST_SOCKET="PI_DADDY_HOST_SOCKET";
+export type DashboardConnection={frame:DashboardHost["frame"];action:DashboardHost["action"];humanAction:DashboardHost["humanAction"]};
+const connections=new WeakSet<object>();
+export const isDashboardConnection=(v:unknown):v is DashboardConnection=>isDashboardHost(v)||typeof v==="object"&&v!==null&&connections.has(v);
+async function parent(path:string){if(!isAbsolute(path)||Buffer.byteLength(path)>100||await realpath(dirname(path))!==dirname(path))throw Error("canonical bounded private dashboard socket required");const s=await lstat(dirname(path));if(!s.isDirectory()||s.mode&0o077||s.uid!==process.getuid?.())throw Error("private owned dashboard socket parent required");}
+/** Same original host process. No worker socket, native TUI attach, PID lookup or authority transport. */
+export async function serveDashboardHost(path:string,host:DashboardHost){
+  if(!isDashboardHost(host))throw Error("original dashboard host required");await parent(path);const clients=new Set<Socket>(),tasks=new Set<Promise<void>>();
+  const server=createServer(socket=>{if(clients.size>=4){socket.destroy();return;}clients.add(socket);socket.on("close",()=>clients.delete(socket));socket.on("error",()=>{});socket.setTimeout(5000,()=>socket.destroy());let size=0,used=false;const chunks:Buffer[]=[];
+    socket.on("data",bytes=>{if(used)return;size+=bytes.length;if(size>65536){socket.destroy();return;}chunks.push(bytes);if(bytes.at(-1)!==10)return;used=true;
+      const task=(async()=>{try{const text=new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks));const r=parseRetentionJson(text,65536) as {operation:string;request?:DashboardHostRequest;key?:string};let result:unknown;
+        if(Object.keys(r).join()==="operation"&&r.operation==="frame")result=await host.frame();
+        else if(Object.keys(r).sort().join()==="operation,request"&&r.operation==="action")result=await host.action(dashboardHostRequest(r.request!));
+        else if(Object.keys(r).sort().join()==="key,operation"&&r.operation==="human-action"&&typeof r.key==="string")result=await host.humanAction(r.key);
+        else throw Error("closed dashboard protocol required");
+        const output=JSON.stringify({ok:true,result})+"\n";if(Buffer.byteLength(output)>512*1024)throw Error("dashboard frame bound exceeded");socket.end(output);
+      }catch{socket.end(JSON.stringify({ok:false,error:"refused or acknowledgement unknown; explicit readback only"})+"\n");}})();tasks.add(task);void task.finally(()=>tasks.delete(task));
+    });
+  });
+  await new Promise<void>((resolve,reject)=>{server.once("error",reject);server.listen(path,()=>{server.off("error",reject);resolve();});});
+  try{await chmod(path,0o600);}catch(error){server.close();throw error;}
+  return Object.freeze({path,close:()=>new Promise<void>((resolve,reject)=>{for(const c of clients)c.destroy();server.close(e=>e?reject(e):void Promise.allSettled([...tasks]).then(()=>resolve()));})});
+}
+/** Explicit operator-selected endpoint. Socket ownership is access policy, not module/human authentication. */
+export function connectDashboardHost(path:string):DashboardConnection{
+  const call=async(operation:string,payload:{request?:DashboardHostRequest;key?:string}={})=>{await parent(path);const s=await lstat(path);if(!s.isSocket()||s.mode&0o077||s.uid!==process.getuid?.())throw Error("private original dashboard endpoint unavailable");
+    return new Promise<any>((resolve,reject)=>{const socket=createConnection(path);let size=0,done=false;const chunks:Buffer[]=[];const fail=(e:unknown)=>{if(!done){done=true;socket.destroy();reject(e);}};
+      socket.setTimeout(5000,()=>fail(Error("dashboard acknowledgement timeout; do not repeat action")));socket.on("error",fail);socket.on("connect",()=>socket.write(JSON.stringify({operation,...payload})+"\n"));
+      socket.on("data",b=>{size+=b.length;if(size>512*1024){fail(Error("dashboard frame limit"));return;}chunks.push(b);});
+      socket.on("end",()=>{try{const text=new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks));const r=parseRetentionJson(text,512*1024) as {ok:boolean;result:unknown};if(r.ok!==true)throw Error("dashboard refused or acknowledgement unknown");if(operation==="frame"&&(r.result as {version?:string})?.version!=="producer-dashboard-frame-v1")throw Error("incompatible dashboard host");if(!done){done=true;resolve(r.result);}}catch(e){fail(e);}});
+      socket.on("close",()=>{if(!done)fail(Error("dashboard disconnected; acknowledgement unknown"));});
+    });
+  };
+  const api={frame:()=>call("frame"),action:(r:DashboardHostRequest)=>call("action",{request:dashboardHostRequest(r)}),humanAction:(key:string)=>call("human-action",{key})};connections.add(api);return Object.freeze(api);
+}