pi-daddy 0.23.0 → 0.24.0

package/extensions/grants.ts

@@ -37,7 +37,8 @@ import { registerDelegationTools } from "./delegation.ts";
 import { grantsCommand } from "./grants-command.ts";
 import { runInit } from "./init-command.ts";
 import { planWithApprovals } from "./run-delegation.ts";
-import { createGrantsSession, loadProjectDefinitions, resolveExecutor, type GrantsSession } from "./session.ts";
+import { createGrantsSession, loadProjectDefinitions, type GrantsSession } from "./session.ts";
+import { resolveExecutor } from "./executor-session.ts";
 import { reportSessionStart } from "./session-report.ts";
 import { SPAWN_TOOLS, tripwireReason } from "./tripwire.ts";
 import { reportGrantStoreRefusal } from "./grant-store-refusal.ts";
@@ -47,7 +48,10 @@ import {
   openDashboardCommand,
 } from "../src/dashboard-handshake.ts";
 
-import { associateOrdinaryHost } from "../src/ordinary-children.ts";
+import { associateOrdinaryHost, ordinaryChildrenFor } from "../src/ordinary-children.ts";
+import { loadDeclaredWork } from "../src/work-command.ts";
+import { createDailyDashboardSession } from "./daily-dashboard-session.ts";
+import { replacePublishedDailyWork, type PublishedDailyWork } from "./daily-work-session.ts";
 export default function (pi: ExtensionAPI) {
   // The path pi loads as the extension, so a child granted `tool:delegate` can be started with `-e <this>`.
   // Only this file can say so about itself, which is why the session takes it rather than deriving it.
@@ -61,6 +65,7 @@ export default function (pi: ExtensionAPI) {
 
   const session = createGrantsSession(extensionPath);
   associateOrdinaryHost(pi,session);
+  const dailyHost=createDailyDashboardSession({ordinary:()=>ordinaryChildrenFor(pi),declared:()=>session.declaredWork,cwd:()=>session.cwd,env:process.env,author:"local-operator"});
   const dashboardPluginRoot = fileURLToPath(new URL("../herdr-plugin/", import.meta.url));
   const dashboardPaths = defaultDashboardPaths(
     process.env.PI_CODING_AGENT_DIR?.trim() || join(homedir(), ".pi", "agent"),
@@ -70,6 +75,7 @@ export default function (pi: ExtensionAPI) {
   // because the hooks below have to be registered before the tools and both need to call it — the tool
   // schemas describe which definitions are spawnable, and nothing knows that until a hook has run (R-39).
   const delegation = { refreshSpawnable: () => {} };
+  const publishedDailyWork: PublishedDailyWork = {};
 
   pi.on("session_start", async (_event, ctx) => {
     session.cwd = ctx.cwd;
@@ -77,6 +83,19 @@ export default function (pi: ExtensionAPI) {
     // execution tree across workspaces. Resolve it once at the root's actual pi cwd; descendants inherit
     // this absolute identity verbatim, and resolve(abs) remains abs at every deeper session start.
     if (session.ledgerPath) session.ledgerPath = resolve(ctx.cwd, session.ledgerPath);
+    try {
+      try {
+        replacePublishedDailyWork(process.env, publishedDailyWork, undefined);
+        session.declaredWork = (await loadDeclaredWork(join(ctx.cwd, ".pi", "work-current.json"))) ?? undefined;
+        replacePublishedDailyWork(process.env, publishedDailyWork, session.declaredWork);
+      } catch (error) {
+        session.declaredWork = undefined;
+        ctx.ui.notify(
+          `grants: declared work is invalid (${error instanceof Error ? error.message : String(error)}); ` +
+            `delegations remain unbound and no previous selection was substituted.`,
+          "error",
+        );
+      }
     // The one case the stored-grant lookup can get wrong (ADR-0030). The factory reads the store keyed by
     // `process.cwd()` because it runs before any hook and therefore before `ctx` exists — and S-5 forces
     // that ordering, since whether `delegate` is registered is decided there. Almost always the two agree.
@@ -95,7 +114,6 @@ export default function (pi: ExtensionAPI) {
         "warning",
       );
     }
-    try {
       try {
         await reportGrantStoreRefusal(session, ctx.ui);
       } catch (error) {
@@ -232,6 +250,8 @@ export default function (pi: ExtensionAPI) {
    * `exit` remains the backstop. SIGKILL still orphans panes, exactly as R-62 records, and no signal handler is
    * installed here for the reason R-62 gives: it would turn pi's "interrupt this turn" into "exit pi".
    */
+  pi.on("session_shutdown", async () => { await dailyHost.close().catch(() => undefined); });
+
   pi.on("agent_settled", async () => {
     try {
       if (session.executor.kind !== "herdr" || openPaneCount() === 0) return undefined;
@@ -350,6 +370,7 @@ export default function (pi: ExtensionAPI) {
           definitions: session.definitions,
           sessionApprovals: session.sessionApprovals,
           inheritedApprovals: session.inheritedApprovals,
+          variantRuns: session.variantRuns,
           snapshotOf: (subject: string) => snapshotOf(session, subject),
           // The REAL delegation path, minus the one thing a diagnostic must never do. `ctx: null` is what
           // says so: stored approvals count exactly as they would for a spawn, and no human is asked
@@ -360,6 +381,7 @@ export default function (pi: ExtensionAPI) {
               await loadProjectDefinitions(session, ctx.cwd);
               delegation.refreshSpawnable();
             }),
+          runHost: (target: string) => dailyHost.run(target),
           openDashboard: () => openDashboardCommand({
             env: process.env,
             pid: process.pid,

package/extensions/primary-shadow.ts

@@ -0,0 +1,11 @@
+import type { DelegationOutcome } from "./execute-child.ts";
+import type { ExecutionOccurrenceIds } from "./execution-occurrence.ts";
+import type { GrantsSession, VariantRunAccounting } from "./session.ts";
+
+/** Return one primary while the original session retains and settles every shadow outcome. */
+export async function completePrimary(input:{session:GrantsSession;primaryIndex:number;occurrences:ExecutionOccurrenceIds[];pending:Promise<DelegationOutcome>[];settle:(outcomes:{ok:boolean}[])=>void}){
+ const runId=input.occurrences[input.primaryIndex].executionId,record:VariantRunAccounting={runId,primaryExecutionId:runId,shadowExecutionIds:input.occurrences.filter((_,i)=>i!==input.primaryIndex).map(x=>x.executionId),state:"running",outcomes:null};
+ input.session.variantRuns.set(runId,record);
+ void Promise.all(input.pending).then(outcomes=>{record.outcomes=outcomes.map((outcome,index)=>({executionId:input.occurrences[index].executionId,role:index===input.primaryIndex?"primary":"shadow",ok:outcome.ok,reason:outcome.ok?null:outcome.reason??"failed"}));record.state="settled";input.settle(outcomes);});
+ return {runId,primary:await input.pending[input.primaryIndex]};
+}

package/extensions/run-delegation.ts

@@ -44,6 +44,7 @@ interface ChildSpec {
   agent?: string;
   tools?: string[];
   model?: string;
+  thinking?: string;
   correlation?: CorrelationMetadata;
   workspace?: DelegationWorkspaceSpec;
 }
@@ -248,6 +249,7 @@ export async function runOneDelegation(
     agent: spec.agent,
     tools: spec.tools,
     model: spec.model ?? defaultModel,
+    thinking: spec.thinking,
     correlation: spec.workspace
       ? { ...(spec.correlation ?? {}), workspace_id: spec.workspace.workspace_id }
       : spec.correlation,

package/extensions/session.ts

@@ -21,8 +21,7 @@ import { makeCatalog, skillPathsFromCatalog, type Catalog } from "../src/catalog
 import type { SkillDefinition } from "../src/definitions.ts";
 import { DELEGATE_CAPABILITY, type DelegationContext } from "../src/delegate.ts";
 import { budgetFromEnv } from "../src/fanout.ts";
-import { chooseExecutor, needsProbe, ENV_HERDR, type ExecutorChoice } from "../src/executor.ts";
-import { probeHerdr } from "../src/herdr-cli.ts";
+import { chooseExecutor, ENV_HERDR, type ExecutorChoice } from "../src/executor.ts";
 import { WILDCARD } from "../src/pi-tools.ts";
 import {
   childEnv,
@@ -49,7 +48,7 @@ import { republishable } from "./approvals.ts";
 import { storedGrantSessionState } from "./stored-grant-session.ts";
 import { nativeSessionRootFromEnv, type NativeSessionHost } from "../src/native-session-target.ts";
 import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/model-preflight.ts";
-
+import type { DeclaredWorkState } from "../src/work-command.ts";
 /**
  * Run governed children in herdr panes instead of captured child processes.
  *
@@ -80,6 +79,7 @@ export { ENV_HERDR_WORKSPACE } from "../src/herdr-cli.ts";
 /** Keep each child's pane after it finishes, for inspection. Off by default: fan-out would flood it. */
 export const ENV_HERDR_KEEP_PANE = "PI_GRANTS_HERDR_KEEP_PANE";
 
+export interface VariantRunAccounting {runId:string;primaryExecutionId:string;shadowExecutionIds:string[];state:"running"|"settled";outcomes:null|{executionId:string;role:"primary"|"shadow";ok:boolean;reason:string|null}[]}
 export interface GrantsSession extends NativeSessionHost {
   /**
    * False when neither `PI_GRANTS_GRANT` nor a stored grant applies: the session holds the wildcard and
@@ -127,6 +127,9 @@ export interface GrantsSession extends NativeSessionHost {
   readonly modelResolutionCache: Map<string, boolean>;
   /** Path to this extension, so a child granted `tool:delegate` can delegate in turn. */
   readonly extensionPath?: string;
+  declaredWork?: DeclaredWorkState; // Explicit operator selection; absence leaves execution visibly unbound.
+  /** Primary-return fan-outs retained by this original session; bounded and human-readable via /grants variants. */
+  readonly variantRuns: Map<string, VariantRunAccounting>;
 
   /** Approval keys approved for this session. In memory only — this dies with the process. */
   readonly sessionApprovals: Set<string>;
@@ -235,22 +238,6 @@ export async function loadProjectDefinitions(session: GrantsSession, cwd: string
   session.catalog = await session.catalogReady;
 }
 
-/**
- * Probe for herdr and settle this session's executor — ADR-0031.
- *
- * **Once, at session start, and never per spawn.** A fan-out whose children ran under two executors would put
- * two different things under one call in the ledger, and the two plans differ (`--print` is withheld on the
- * herdr path). A herdr server that dies mid-session therefore surfaces as a failed `tab create`, reported as
- * the spawn error it is, rather than as a silent relocation of the remaining children.
- *
- * `probeHerdr` never throws, so this cannot either — which matters because it runs *before* the line that
- * discloses what it decided (R-60: a throw here would cancel that line and every control after it).
- */
-export async function resolveExecutor(session: GrantsSession): Promise<void> {
-  const raw = process.env[ENV_HERDR];
-  session.executor = chooseExecutor(raw, needsProbe(raw) ? await probeHerdr() : null);
-}
-
 export function createGrantsSession(extensionPath: string | undefined): GrantsSession {
   // Governance is opt-in: with PI_GRANTS_GRANT unset AND no stored grant for this directory, the session
   // holds the wildcard and nothing is blocked. This extension must never silently tighten a normal
@@ -322,6 +309,7 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
     nativeSessionRoot: nativeSessionRootFromEnv(process.env),
     modelResolutionCache: new Map<string, boolean>(),
     extensionPath,
+    variantRuns: new Map(),
 
     sessionApprovals: new Set<string>(),
     sessionApprovalBindings: new Map<string, ApprovalBinding>(),

package/extensions/work-runtime.ts

@@ -0,0 +1,44 @@
+import type { Delegation } from "../src/delegate.ts";
+import { retentionConfigurationDigest } from "../src/execution-retention.ts";
+import { appendDeclaredWorkOccurrence } from "../src/work-command.ts";
+import type { WorkOccurrencePayload } from "../src/work-ledger.ts";
+import type { GrantsSession } from "./session.ts";
+import type { PreparedWorkspace } from "./workspace-runtime.ts";
+
+export async function beginDeclaredWorkAttempt(input: {
+  session: GrantsSession;
+  plan: Delegation;
+  childId: string;
+  executionId: string;
+  parentExecutionId: string | null;
+  toolCallId?: string;
+  preparedWorkspace?: PreparedWorkspace;
+  configuredTimeoutMs: number;
+  startedAt: Date;
+}): Promise<null | { finish(state: Extract<WorkOccurrencePayload["state"], "completed" | "failed">): Promise<void> }> {
+  const state = input.session.declaredWork;
+  if (!state) return null;
+  const argument = (flag: string): string | null => {
+    const index = input.plan.args.indexOf(flag);
+    return index >= 0 ? input.plan.args[index + 1] ?? null : null;
+  };
+  const identity = {
+    executionId: input.executionId,
+    parentExecutionId: input.parentExecutionId,
+    childId: input.childId,
+    variantId: input.plan.correlation?.context_id ?? null,
+    toolCallId: input.toolCallId ?? null,
+    taskId: input.plan.correlation?.task_id ?? input.plan.taskDigest,
+    workspaceId: input.preparedWorkspace?.workspace.workspaceId ?? input.plan.correlation?.workspace_id ?? null,
+    definitionDigest: input.plan.definitionDigest?.sha256 ?? null,
+    configurationDigest: retentionConfigurationDigest({
+      args: input.plan.args,
+      effective: input.plan.effective,
+      timeoutMs: input.configuredTimeoutMs,
+    }),
+    modelId: argument("--model"),
+    effortId: argument("--thinking"),
+  };
+  await appendDeclaredWorkOccurrence(state, { ...identity, now: input.startedAt }, "starting");
+  return { finish: (terminal) => appendDeclaredWorkOccurrence(state, { ...identity, now: new Date() }, terminal) };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/cli.ts

@@ -21,12 +21,15 @@ import { UnsafeGrantError } from "./grant-env.ts";
 import { applyInit, countDeclaring, planInit, type InitPlan } from "./init.ts";
 import { registeredWorkspaceIds } from "./workspace.ts";
 import { discoverSkillPackages, skillPackageRoots, type RefusedSkill, type SkillPackage } from "./skill-packages.ts";
+import { declareWork } from "./work-command.ts";
 
 const USAGE = `pi-daddy — capability governance for pi sub-agents
 
 Usage:
   pi-daddy init [--force] [--dir <path>]   scaffold .pi/skills/ and .pi/grants.env from installed
                                            packages that declare skills (package.json "pi": {"skills": …})
+  pi-daddy work add --id <id> --outcome <text> [--dir <path>]
+                                           declare one current obligation for ordinary delegation
   pi-daddy --help | --version
 
 init copies each declared SKILL.md into .pi/skills/ and writes a grant naming exactly what those files
@@ -38,9 +41,11 @@ placeholder and stays unspawnable until you fill it in. Capabilities that can ch
             It never rewrites .pi/grants.env — delete that file if you want it regenerated.`;
 
 export interface ParsedArgs {
-  command: "init" | "help" | "version";
+  command: "init" | "work-add" | "help" | "version";
   dir?: string;
   force: boolean;
+  id?: string;
+  outcome?: string;
   /** Non-empty means refuse: argv said something this program does not understand. */
   errors: string[];
 }
@@ -58,16 +63,28 @@ export function parseArgs(argv: string[]): ParsedArgs {
   if (args.includes("--help") || args.includes("-h")) return { command: "help", force: false, errors: [] };
   if (args.includes("--version") || args.includes("-v")) return { command: "version", force: false, errors: [] };
 
-  const [command, ...rest] = args;
-  if (command !== "init") return { command: "help", force: false, errors: [`unknown command "${command}"`] };
+  const [command, ...tail] = args;
+  if (command !== "init" && command !== "work") return { command: "help", force: false, errors: [`unknown command "${command}"`] };
+  const work = command === "work";
+  const rest = work && tail[0] === "add" ? tail.slice(1) : tail;
+  if (work && tail[0] !== "add") return { command: "work-add", force: false, errors: ["work needs subcommand add"] };
 
   const errors: string[] = [];
   let dir: string | undefined;
   let force = false;
+  let id: string | undefined, outcome: string | undefined;
   for (let i = 0; i < rest.length; i += 1) {
     const arg = rest[i];
-    if (arg === "--force") {
+    if (arg === "--force" && !work) {
       force = true;
+    } else if (arg === "--id" && work) {
+      const value = rest[i + 1];
+      if (value === undefined || value.startsWith("-")) errors.push("--id needs a value");
+      else { id = value; i += 1; }
+    } else if (arg === "--outcome" && work) {
+      const value = rest[i + 1];
+      if (value === undefined || value.startsWith("-")) errors.push("--outcome needs text");
+      else { outcome = value; i += 1; }
     } else if (arg === "--dir") {
       const value = rest[i + 1];
       // A flag is not a path. Without this, `--dir --force` consumed the flag as the directory AND left
@@ -87,6 +104,11 @@ export function parseArgs(argv: string[]): ParsedArgs {
     }
   }
 
+  if (work) {
+    if (!id && !errors.some(error => error.startsWith("--id"))) errors.push("--id needs a value");
+    if (!outcome && !errors.some(error => error.startsWith("--outcome"))) errors.push("--outcome needs text");
+    return { command: "work-add", force: false, errors, ...(id ? { id } : {}), ...(outcome ? { outcome } : {}), ...(dir ? { dir } : {}) };
+  }
   return { command: "init", dir, force, errors };
 }
 
@@ -260,6 +282,21 @@ export async function main(argv: string[]): Promise<number> {
     console.log(USAGE);
     return 0;
   }
+  if (parsed.command === "work-add") {
+    const declared = await declareWork({
+      cwd: resolvePath(parsed.dir ?? process.cwd()),
+      id: parsed.id!,
+      outcome: parsed.outcome!,
+    });
+    console.log(
+      `pi-daddy work: declared ${declared.id}\n` +
+      `  ledger    ${declared.ledgerPath}\n` +
+      `  selection ${declared.statePath}\n\n` +
+      `Ordinary governed delegations from this project will record attempts after the Pi extension loads it.\n` +
+      `Run /reload in an existing Pi session, then /grants dashboard. Runtime success is not acceptance.`,
+    );
+    return 0;
+  }
 
   // ABSOLUTE, always. `readSkill` compares a resolved entry against the package directory, and a relative
   // `--dir` made that comparison false for every entry: every declared skill of every package was reported

package/src/daily-dashboard-host.ts

@@ -0,0 +1,49 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { isAbsolute, resolve, join } from "node:path";
+import { createDashboardHost, dashboardHostDigest, dashboardHostRequestDigest, type DashboardHostAuthority, type DashboardHostConfig, type DashboardHostRequest } from "./dashboard-host.ts";
+import type { DashboardHarness } from "./dashboard-host-contract.ts";
+import { loadedDashboardHarnessDigest } from "./dashboard-harness.ts";
+import { createDispatchBudget, openResourceBudget, resourceBindingDigest } from "./resource-budget.ts";
+import { dispatchRequestDigest, type DispatchRequest } from "./dispatch-control.ts";
+import { serveDashboardHost } from "./dashboard-host-transport.ts";
+import type { DeclaredWorkState } from "./work-command.ts";
+import type { OrdinaryChildren } from "./ordinary-children.ts";
+import { dataDigest } from "./debrief-contract.ts";
+
+export interface DailyDashboardHostInput {id:string;cwd:string;directory:string;socketPath?:string;declared:DeclaredWorkState;ordinary:OrdinaryChildren;harness:DashboardHarness;author:string}
+const idPattern=/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const hash=(value:string)=>createHash("sha256").update(value).digest("hex");
+
+/** One explicitly started, process-owned daily host. No authority, controller or prior host is recovered from disk. */
+export async function startDailyDashboardHost(input:DailyDashboardHostInput){
+ if(!idPattern.test(input.id)||!isAbsolute(input.cwd)||resolve(input.cwd)!==input.cwd||!isAbsolute(input.directory)||resolve(input.directory)!==input.directory||!input.author.trim()||input.author.length>256)throw Error("explicit bounded daily host configuration required");
+ const harnessDigest=loadedDashboardHarnessDigest(input.harness);if(!harnessDigest)throw Error("loaded skill-harness bridge required");
+ if(input.declared.ledgerPath!==join(input.cwd,".pi","work.jsonl"))throw Error("current declared work must belong to this host project");
+ await mkdir(input.directory,{mode:0o700});const archiveRoot=join(input.directory,"archive");await mkdir(archiveRoot,{mode:0o700});
+ const reference=input.harness.retainArchiveSource(archiveRoot,{sourceId:`host-${input.id}-bootstrap`,parser:{id:"daily-host-bootstrap",version:"1"},retention:"exact",bytes:Buffer.from("explicit daily host bootstrap")});
+ const component={kind:"detector",id:"retained-work",version:"1",population:`daily:${input.id}`};
+ const trustInput={archiveRoot,component,seed:hash(`daily-host\0${input.id}`),maxUnflagged:0,cohort:[{incidentId:"bootstrap",manifestId:reference.manifestId,flagged:true,split:"calibration"}],exposure:null};
+ const trustPolicyId=input.harness.trustPolicyDigest(trustInput),trustDirectory=join(input.directory,"trust");input.harness.createTrustLifecycle(trustDirectory,trustInput,[trustPolicyId]);
+ const workRelative="work.jsonl",factsRelative="facts.jsonl",workMirror=join(input.directory,workRelative);await writeFile(workMirror,await readFile(input.declared.ledgerPath),{mode:0o600,flag:"wx"});
+ const refreshWork=async()=>{const temporary=`${workMirror}.${process.pid}.${randomUUID()}.tmp`;try{await writeFile(temporary,await readFile(input.declared.ledgerPath),{mode:0o600,flag:"wx"});await rename(temporary,workMirror);}finally{await rm(temporary,{force:true});}};
+ const facts={scopeDigest:input.declared.selectedSnapshot.snapshot.digest,version:"declared-work-v1",population:`daily:${input.id}`,expectedWaits:[],checkpoints:[],violations:[],priorAccepted:[]};await writeFile(join(input.directory,factsRelative),JSON.stringify(facts)+"\n",{mode:0o600,flag:"wx"});
+ const policy={version:"archive-policy-v2",id:`daily-${input.id}`,revision:"1",sourceRoot:input.directory,archiveRoot,maxBytes:8*1024*1024,retention:"exact",expiresAt:new Date(Date.now()+24*60*60*1000).toISOString(),sources:[{id:"work",path:workRelative,parser:{id:"pi-daddy-work-ledger",version:"4"},contentPolicy:"manifest-only"},{id:"facts",path:factsRelative,parser:{id:"pi-daddy-work-signal-facts",version:"1"},contentPolicy:"manifest-only"}]};
+ const policyPath=join(input.directory,"archive-policy.json"),policyBytes=JSON.stringify(policy);await writeFile(policyPath,policyBytes,{mode:0o600,flag:"wx"});
+ const authorityDigest=dataDigest({kind:"daily-dashboard-host",id:input.id,cwd:input.cwd}),budget=await createDispatchBudget({directory:join(input.directory,"budget"),authorityDigest,limits:{maxAttempts:6,maxInputBytes:65536,maxConcurrent:3}});
+ const config:DashboardHostConfig={version:"producer-dashboard-host-v1",trustDirectory,trustPolicyId,archiveRoot,scope:`daily:${input.id}`,author:input.author,policyPath,policySha256:hash(policyBytes),sources:[{id:"work",kind:"work"},{id:"facts",kind:"facts"}],selection:input.declared.selectedSnapshot,cases:null,blind:null,budgetDigest:resourceBindingDigest(budget),experimentDigest:null,harnessArtifactDigest:harnessDigest,ordinaryDigest:input.ordinary.bindingDigest};
+ const requestDigests=new Set<string>(),dispatchDigests=new Set<string>();let host:ReturnType<typeof createDashboardHost>,factsResultManifest:string|null=null;
+ const authority=():DashboardHostAuthority=>({hostDigests:[dashboardHostDigest(config)],requestDigests:[...requestDigests],workContext:{selectedSnapshot:config.selection,authority:null},dispatch:{authorityDigest,requestDigests:[...dispatchDigests]},experiment:null});
+ const request=(context:{hostDigest:string;selectionDigest:string;tip:string},operation:DashboardHostRequest["operation"],payload:unknown,requestId:string):DashboardHostRequest=>({version:"1.0",requestId,hostDigest:context.hostDigest,selectionDigest:context.selectionDigest,expectedTip:context.tip,operation,payload});
+ host=createDashboardHost({harness:input.harness,config,budget,ordinary:input.ordinary,authority,beforeObservation:sourceId=>sourceId==="work"?refreshWork():Promise.resolve(),humanActions:async context=>{
+   const state=await openResourceBudget(budget).controls(null).inspect(),action=state.paused?"resume-dispatch":"pause-dispatch",key=state.paused?"resume-dispatch":"pause-new-dispatch";
+   const native:DispatchRequest={version:"1.0",requestId:`${action}:${state.revision}`,bindingDigest:config.budgetDigest,expectedRevision:state.revision,action,targetExecutionId:null};dispatchDigests.add(dispatchRequestDigest(native));
+   const hostRequest=request(context,"dispatch",native,`host-${action}:${state.revision}`);requestDigests.add(dashboardHostRequestDigest(hostRequest));
+   const previous=context.observations.find(x=>x.sourceId==="work")?.checkpointId??null,refresh=request(context,"observe",{sourceId:"work",previousCheckpointId:previous,facts:context.observations.find(x=>x.sourceId==="facts")?.checkpointId?factsResultManifest:null},`refresh-work:${state.revision}:${context.tip.slice(0,12)}`);requestDigests.add(dashboardHostRequestDigest(refresh));
+   return [{key,label:state.paused?"Resume new governed dispatch":"Pause new governed dispatch; running children continue",request:hostRequest},{key:"refresh-current-work",label:"Capture current declared work and attempts",request:refresh}];
+ }});
+ const before=await host.frame(),observeFacts=request({hostDigest:host.hostDigest,selectionDigest:before.selectionDigest,tip:before.tip},"observe",{sourceId:"facts",previousCheckpointId:null,facts:null},"observe-current-facts");requestDigests.add(dashboardHostRequestDigest(observeFacts));const factsResult=await host.action(observeFacts) as {result:{sourceManifestId:string}};factsResultManifest=factsResult.result.sourceManifestId;
+ const afterFacts=await host.frame(),observeWork=request({hostDigest:host.hostDigest,selectionDigest:afterFacts.selectionDigest,tip:afterFacts.tip},"observe",{sourceId:"work",previousCheckpointId:null,facts:factsResult.result.sourceManifestId},"observe-current-work");requestDigests.add(dashboardHostRequestDigest(observeWork));await host.action(observeWork);
+ const socketPath=input.socketPath??join(input.directory,"dashboard.sock"),server=await serveDashboardHost(socketPath,host);
+ let closed=false;return Object.freeze({host,socketPath,directory:input.directory,async close(){if(closed)return;closed=true;await server.close();}});
+}

package/src/dashboard-cli.ts

@@ -52,7 +52,10 @@ export interface DashboardFrameOptions {
 }
 export async function dashboardHostAction(host:DashboardConnection,line:string){
   if(!isDashboardConnection(host)||Buffer.byteLength(line)>60000)throw Error("genuine bounded dashboard connection required");
-  return host.action(dashboardHostRequest(parseRetentionJson(line,60000) as DashboardHostRequest));
+  const command=line.trim();
+  if(command.startsWith("{"))return host.action(dashboardHostRequest(parseRetentionJson(command,60000) as DashboardHostRequest));
+  if(!/^[a-zA-Z0-9:_-]{1,64}$/.test(command))throw Error("dashboard action must be a listed command key");
+  return host.humanAction(command);
 }
 
 function shellQuote(value: string): string {
@@ -96,9 +99,11 @@ export async function dashboardFrame(options: DashboardFrameOptions): Promise<st
     try{view=await options.connected.frame();}catch{return "PI-DADDY — CONNECTED HOST UNAVAILABLE\nNo prior acceptance, presentation or continuity substituted. No action retried.";}
     if(options.dailyJson||options.debriefJson)return JSON.stringify(view);
     const source=view.source as {daily?:Parameters<typeof renderDailyView>[0]}|null;
+    const actions=(view.actions as {key:string;label:string}[]|undefined)??[];
     return ["PI-DADDY — CONNECTED HOST (snapshot; identity/acceptance not authenticated)",source?.daily?renderDailyView(source.daily,options.width):"Source unavailable; no previous acceptance substituted.",
       view.debrief?renderDebrief(view.debrief as Parameters<typeof renderDebrief>[0],options.width):"Debrief deferred/closed. No implicit presentation or steering.",
-      `Attention reserved ${view.attention.attentionUsed}/5 (not proof of delivery). Tip ${view.tip}.`,"Explicit exact approved JSON requests only; refresh never acts."].join("\n\n");
+      `Attention reserved ${view.attention.attentionUsed}/5 (not proof of delivery). Tip ${view.tip}.`,
+      actions.length?`ACTIONS — type one command and Enter\n${actions.map(action=>`  ${action.key} — ${action.label}`).join("\n")}`:"ACTIONS — none currently authorized; refresh never acts."].join("\n\n");
   }
   if (options.debrief || options.debriefJson) {
     if (!isDebriefPresenter(options.debrief)) return "PI-DADDY — DEBRIEF UNAVAILABLE: genuine presenter/host missing";

package/src/dashboard-harness.ts

@@ -6,6 +6,15 @@ import { dataDigest,byteDigest,detached,sha } from "./debrief-contract.ts";
 import { DASHBOARD_HARNESS_PIN,type DashboardHarness } from "./dashboard-host-contract.ts";
 export interface DashboardHarnessArtifact {version:"dashboard-harness-artifact-v1";sourceCommit:typeof DASHBOARD_HARNESS_PIN;files:Record<string,string>;typeboxRoot:string;typeboxPackageSha256:string}
 const loaded=new WeakMap<object,string>();
+export const DASHBOARD_HARNESS_BRIDGE_SOURCE="127b349310dd8f28e5d6b12148a063fce66a77dd";
+const bridgeFunctions=["learningJournal","createTrustLifecycle","openTrustLifecycle","trustPolicyDigest","archivePolicyBinding","ingestPolicySource","readArchiveCheckpoint","readArchiveSource","retainArchiveSource","captureArchivedWorkSignals","readRetainedExecution","projectRetainedExecutions","createWorkCaseReviewer","createWorkSignalReviewer","retainBlindIntervention","openBlindIntervention"] as const;
+/** Adopt the API published by the already-loaded skill-harness extension. Same-process source identity is not human authentication. */
+export function adoptDashboardHarnessBridge(input:unknown):DashboardHarness{
+ const value=input as {version?:unknown;sourceCommit?:unknown;api?:unknown};
+ if(!value||typeof value!=="object"||Object.keys(value).sort().join()!=="api,sourceCommit,version"||value.version!=="skill-harness-dashboard-bridge-v1"||value.sourceCommit!==DASHBOARD_HARNESS_BRIDGE_SOURCE)throw Error("exact supported harness bridge required");
+ const api=value.api as DashboardHarness;if(!api||typeof api!=="object"||!Object.isFrozen(api)||bridgeFunctions.some(name=>typeof (api as unknown as Record<string,unknown>)[name]!=="function"))throw Error("frozen harness API with required source jobs required");
+ const digest=dataDigest({version:value.version,sourceCommit:value.sourceCommit,functions:bridgeFunctions});loaded.set(api,digest);return api;
+}
 export const loadedDashboardHarnessDigest=(h:unknown):string|null=>typeof h==="object"&&h!==null?loaded.get(h)??null:null;
 async function privateDirectory(path:string){const stat=await lstat(path);if(!isAbsolute(path)||await realpath(path)!==path||!stat.isDirectory()||stat.mode&0o077||stat.uid!==process.getuid?.())throw Error("canonical private owned harness directory required");}
 async function bytes(path:string){if(await realpath(path)!==path)throw Error("harness artifact alias");const fd=await open(path,constants.O_RDONLY|constants.O_NOFOLLOW|constants.O_NONBLOCK);try{const stat=await fd.stat();if(!stat.isFile()||stat.nlink!==1||stat.mode&0o022||stat.size>1048576)throw Error("bounded immutable artifact required");const value=Buffer.alloc(stat.size+1),n=await fd.read(value,0,value.length,0),after=await fd.stat();if(n.bytesRead!==stat.size||after.size!==stat.size||after.mtimeMs!==stat.mtimeMs||after.ctimeMs!==stat.ctimeMs)throw Error("artifact changed during read");return value.subarray(0,n.bytesRead);}finally{await fd.close();}}

package/src/dashboard-host-contract.ts

@@ -5,13 +5,16 @@ import type { WorkProjectionContext, WorkFrozen } from "./work-ledger.ts";
 import type { DispatchAuthority } from "./dispatch-control.ts";
 import type { OrdinaryAuthority } from "./ordinary-children.ts";
 import type { ExperimentAuthority } from "./experiment-contract.ts";
-export const DASHBOARD_HARNESS_PIN = "1c02194d4a3709d14890a5fbbad91ff5f0151f65";
+export const DASHBOARD_HARNESS_PIN = "127b349310dd8f28e5d6b12148a063fce66a77dd";
 export interface HostEvent { id: string; prior: string | null; value: Record<string, unknown> }
 export interface HostJournal { read(): HostEvent[]; append(prior: string, value: Record<string, unknown>): HostEvent }
 /** Loaded trusted ports; an interface or caller-supplied pin is NOT module/human authentication. */
 export interface DashboardHarness extends DebriefHarness {
   learningJournal(path: string, initial?: Record<string, unknown>): HostJournal;
   openTrustLifecycle(path: string): { history(): HostEvent[]; inspect(now: number): { policyId: string; attentionUsed: number; tip: string; grantExpansion: false }; expose(id: string, now: number): { mode: string; reason: string; replayed: boolean } };
+  createTrustLifecycle(path:string,input:unknown,authorized:readonly string[]):unknown;
+  trustPolicyDigest(input:unknown):string;
+  retainArchiveSource(root:string,input:unknown):{manifestId:string};
   archivePolicyBinding(path: string, source: string): { policySha256: string; archiveRoot: string };
   ingestPolicySource(path: string, source: string, previous?: string, expectedPolicy?: string): { checkpointId: string; sourceStatus: string; issues?: string[]; [key: string]: unknown };
   readArchiveCheckpoint(root: string, checkpoint: string): { checkpoint: { sourceManifestId: string; issues: string[]; [key: string]: unknown } };

package/src/dashboard-host-transport.ts

@@ -4,7 +4,7 @@ import { dirname, isAbsolute } from "node:path";
 import { parseRetentionJson } from "./retention-json.ts";
 import { isDashboardHost, dashboardHostRequest, type DashboardHost, type DashboardHostRequest } from "./dashboard-host.ts";
 export const ENV_DASHBOARD_HOST_SOCKET="PI_DADDY_HOST_SOCKET";
-export type DashboardConnection={frame:DashboardHost["frame"];action:DashboardHost["action"]};
+export type DashboardConnection={frame:DashboardHost["frame"];action:DashboardHost["action"];humanAction:DashboardHost["humanAction"]};
 const connections=new WeakSet<object>();
 export const isDashboardConnection=(v:unknown):v is DashboardConnection=>isDashboardHost(v)||typeof v==="object"&&v!==null&&connections.has(v);
 async function parent(path:string){if(!isAbsolute(path)||Buffer.byteLength(path)>100||await realpath(dirname(path))!==dirname(path))throw Error("canonical bounded private dashboard socket required");const s=await lstat(dirname(path));if(!s.isDirectory()||s.mode&0o077||s.uid!==process.getuid?.())throw Error("private owned dashboard socket parent required");}
@@ -13,9 +13,11 @@ export async function serveDashboardHost(path:string,host:DashboardHost){
   if(!isDashboardHost(host))throw Error("original dashboard host required");await parent(path);const clients=new Set<Socket>(),tasks=new Set<Promise<void>>();
   const server=createServer(socket=>{if(clients.size>=4){socket.destroy();return;}clients.add(socket);socket.on("close",()=>clients.delete(socket));socket.on("error",()=>{});socket.setTimeout(5000,()=>socket.destroy());let size=0,used=false;const chunks:Buffer[]=[];
     socket.on("data",bytes=>{if(used)return;size+=bytes.length;if(size>65536){socket.destroy();return;}chunks.push(bytes);if(bytes.at(-1)!==10)return;used=true;
-      const task=(async()=>{try{const text=new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks));const r=parseRetentionJson(text,65536) as {operation:string;request?:DashboardHostRequest};let result:unknown;
+      const task=(async()=>{try{const text=new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks));const r=parseRetentionJson(text,65536) as {operation:string;request?:DashboardHostRequest;key?:string};let result:unknown;
         if(Object.keys(r).join()==="operation"&&r.operation==="frame")result=await host.frame();
-        else if(Object.keys(r).sort().join()==="operation,request"&&r.operation==="action")result=await host.action(dashboardHostRequest(r.request!));else throw Error("closed dashboard protocol required");
+        else if(Object.keys(r).sort().join()==="operation,request"&&r.operation==="action")result=await host.action(dashboardHostRequest(r.request!));
+        else if(Object.keys(r).sort().join()==="key,operation"&&r.operation==="human-action"&&typeof r.key==="string")result=await host.humanAction(r.key);
+        else throw Error("closed dashboard protocol required");
         const output=JSON.stringify({ok:true,result})+"\n";if(Buffer.byteLength(output)>512*1024)throw Error("dashboard frame bound exceeded");socket.end(output);
       }catch{socket.end(JSON.stringify({ok:false,error:"refused or acknowledgement unknown; explicit readback only"})+"\n");}})();tasks.add(task);void task.finally(()=>tasks.delete(task));
     });
@@ -26,13 +28,13 @@ export async function serveDashboardHost(path:string,host:DashboardHost){
 }
 /** Explicit operator-selected endpoint. Socket ownership is access policy, not module/human authentication. */
 export function connectDashboardHost(path:string):DashboardConnection{
-  const call=async(operation:string,request?:DashboardHostRequest)=>{await parent(path);const s=await lstat(path);if(!s.isSocket()||s.mode&0o077||s.uid!==process.getuid?.())throw Error("private original dashboard endpoint unavailable");
+  const call=async(operation:string,payload:{request?:DashboardHostRequest;key?:string}={})=>{await parent(path);const s=await lstat(path);if(!s.isSocket()||s.mode&0o077||s.uid!==process.getuid?.())throw Error("private original dashboard endpoint unavailable");
     return new Promise<any>((resolve,reject)=>{const socket=createConnection(path);let size=0,done=false;const chunks:Buffer[]=[];const fail=(e:unknown)=>{if(!done){done=true;socket.destroy();reject(e);}};
-      socket.setTimeout(5000,()=>fail(Error("dashboard acknowledgement timeout; do not repeat action")));socket.on("error",fail);socket.on("connect",()=>socket.write(JSON.stringify({operation,...(request?{request}:{})})+"\n"));
+      socket.setTimeout(5000,()=>fail(Error("dashboard acknowledgement timeout; do not repeat action")));socket.on("error",fail);socket.on("connect",()=>socket.write(JSON.stringify({operation,...payload})+"\n"));
       socket.on("data",b=>{size+=b.length;if(size>512*1024){fail(Error("dashboard frame limit"));return;}chunks.push(b);});
       socket.on("end",()=>{try{const text=new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks));const r=parseRetentionJson(text,512*1024) as {ok:boolean;result:unknown};if(r.ok!==true)throw Error("dashboard refused or acknowledgement unknown");if(operation==="frame"&&(r.result as {version?:string})?.version!=="producer-dashboard-frame-v1")throw Error("incompatible dashboard host");if(!done){done=true;resolve(r.result);}}catch(e){fail(e);}});
       socket.on("close",()=>{if(!done)fail(Error("dashboard disconnected; acknowledgement unknown"));});
     });
   };
-  const api={frame:()=>call("frame"),action:(r:DashboardHostRequest)=>call("action",dashboardHostRequest(r))};connections.add(api);return Object.freeze(api);
+  const api={frame:()=>call("frame"),action:(r:DashboardHostRequest)=>call("action",{request:dashboardHostRequest(r)}),humanAction:(key:string)=>call("human-action",{key})};connections.add(api);return Object.freeze(api);
 }

package/src/dashboard-host.ts

@@ -17,6 +17,10 @@ const hosts=new WeakSet<object>();
 export const isDashboardHost=(value:unknown):value is DashboardHost=>typeof value==="object"&&value!==null&&hosts.has(value);
 export type DashboardHost=ReturnType<typeof openDashboardHost>;
 export interface DashboardHostOptions { ordinary?:OrdinaryChildren; harness:DashboardHarness; config:DashboardHostConfig; budget:GovernedBudgetBinding; experiment?:ReturnType<typeof openExperiment>; authority:()=>DashboardHostAuthority|null;
+  /** Exact actions constructed and authorized by the owner; the dashboard exposes only human labels/keys. */
+  humanActions?:(context:{hostDigest:string;selectionDigest:string;tip:string;observations:readonly {sourceId:string;checkpointId:string}[]})=>readonly {key:string;label:string;request:DashboardHostRequest}[]|Promise<readonly {key:string;label:string;request:DashboardHostRequest}[]>;
+  /** Explicit approved observation effect only; refresh/frame never invokes it. */
+  beforeObservation?:(sourceId:string)=>Promise<void>;
   /** Independently sourced current declaration. Never inferred from idle, a PID, title or request fields. */
   presence?:()=>{present:boolean;closing:boolean;evidenceDigest:string;expiresAt:number}|null;
 }
@@ -53,6 +57,8 @@ export function openDashboardHost(options:DashboardHostOptions){
   const append=(value:Record<string,unknown>)=>journal.append(history().at(-1)!.id,value);
   const saved=():DebriefCheckpoint|null=>{const rows=history().filter(e=>e.value.type==="checkpoint");return rows.length?detached(rows.at(-1)!.value.checkpoint) as DebriefCheckpoint:null;};
   let presenter:DebriefPresenter|undefined,busy=false,poisoned=false,presentationRevision:number|null=null,presenceDigest:string|null=null,attentionDeferred:string|null=null;
+  const ordinaryDispatchHoldKey=dataDigest({hostDigest,control:"pause-new-ordinary-dispatch"});
+  let displayedActions:null|{tip:string;actions:{key:string;label:string;operation:DashboardHostRequest["operation"];request:DashboardHostRequest}[];digest:string}=null;
   const presence=()=>{const p=options.presence?.();return p&&p.present===true&&p.closing===true&&sha(p.evidenceDigest)&&Number.isFinite(p.expiresAt)&&p.expiresAt>Date.now()?p:null;};
   const persistence:DebriefPersistence={durability:"host-owned",load:saved,compareAndSwap(expected,next){
     const rows=history(),previous=saved();if((previous?dataDigest(previous):null)!==expected)throw Error("stale attention CAS");
@@ -65,6 +71,14 @@ export function openDashboardHost(options:DashboardHostOptions){
   const paused=async(revision:number)=>{const b=await boundary();if(ordinary&&!ordinary.quiescent())throw Error("original ordinary children not quiescent");if(experiment){const view=await experiment.inspect();if(view.budget?.active!==0||view.control!=="not-assessed")throw Error("original experiment not quiescent");}if(!b.dispatch.paused||b.dispatch.admission!=="paused"||b.dispatch.revision!==revision||b.active!==0)throw Error("safe paused selection unavailable");};
   const currentSelection=async()=>budget.binding.intent?(await budget.intentControls(null).inspect()).selection:c.selection;
   const nativeRead=async()=>({dispatch:await budget.controls(null).inspect(),intent:budget.binding.intent?await budget.intentControls(null).inspect():null,experiment:experiment?await experiment.inspect():null,ordinary:ordinary?ordinary.inspect():null});
+  const availableHumanActions=async()=>{
+    const rows=history(),tip=rows.at(-1)!.id,selection=await currentSelection(),seen=new Set<string>();
+    const declared=await options.humanActions?.({hostDigest,selectionDigest:dashboardSelectionDigest(selection),tip,observations:observation.latest().map(x=>({sourceId:x.sourceId,checkpointId:x.checkpointId}))})??[],a=authority();
+    return declared.map(value=>{const x=detached(value);controlShape(x,["key","label","request"]);const request=dashboardHostRequest(x.request);
+      if(!/^[a-zA-Z0-9:_-]{1,64}$/.test(x.key)||typeof x.label!=="string"||!x.label.trim()||Buffer.byteLength(x.label)>120||seen.has(x.key))throw Error("invalid human dashboard action");seen.add(x.key);
+      if(request.hostDigest!==hostDigest||request.expectedTip!==tip||request.selectionDigest!==dashboardSelectionDigest(selection)||!a?.requestDigests.includes(dashboardHostRequestDigest(request)))throw Error("human dashboard action is stale or not exactly authorized");
+      return {key:x.key,label:x.label,operation:request.operation,request};});
+  };
   const api={hostDigest,selectionDigest,
     async frame(){
       const rows=history(),tip=rows.at(-1)!.id,a=authority();let source:unknown=null,error:string|null=null;
@@ -74,14 +88,20 @@ export function openDashboardHost(options:DashboardHostOptions){
       let debrief:unknown=null;
       if(a&&presenter&&presentationRevision!==null&&presence()?.evidenceDigest===presenceDigest){try{await paused(presentationRevision);debrief=presenter.view();}catch{debrief=null;}}
       let controls:unknown=null;try{controls=await nativeRead();}catch(e){error=String(e);}
-      const attention=trust.inspect(Date.now());
-      return freeze(detached({version:"producer-dashboard-frame-v1",hostDigest,selectionDigest:dashboardSelectionDigest(selection),selectionState,tip,source,controls,debrief,attention,error,
+      const attention=trust.inspect(Date.now());let actions:{key:string;label:string;operation:string}[]=[];
+      try{const available=await availableHumanActions(),digest=dataDigest(available.map(({key,label,operation,request})=>({key,label,operation,requestDigest:dashboardHostRequestDigest(request)})));
+        if(displayedActions?.tip===tip&&displayedActions.digest!==digest)throw Error("displayed dashboard actions changed before journal advance");
+        displayedActions={tip,actions:available,digest};actions=available.map(({key,label,operation})=>({key,label,operation}));}catch(e){error=String(e);}
+      return freeze(detached({version:"producer-dashboard-frame-v1",hostDigest,selectionDigest:dashboardSelectionDigest(selection),selectionState,tip,source,controls,debrief,attention,error,actions,
         requests:rows.filter(e=>["claim","result","presentation","defer","ordinary-intent-pending"].includes(String(e.value.type))).map(e=>e.value),
         control:rows.some(e=>e.value.type==="host-failure")?"failed":rows.some(e=>e.value.type==="claim"&&!rows.some(r=>r.value.type==="result"&&r.value.requestId===e.value.requestId))?"unknown":"not-assessed",
         acknowledgement:poisoned?"unknown":"readback-only",identity:"independently-declared-host; not human/module authentication",activeBranch:null,acceptance:"not-assessed",freshness:"snapshot-unknown",workerInteractions:0}));
     },
     /** Explicit reconciliation is read-only. A retained claim is never replayed as an effect. */
     reconcile:()=>api.frame(),
+    async humanAction(key:string){const tip=history().at(-1)!.id;if(!displayedActions||displayedActions.tip!==tip)throw Error("dashboard actions must be displayed at the current tip");
+      const found=displayedActions.actions.find(action=>action.key===key);if(!found)throw Error(`unknown dashboard action ${JSON.stringify(key)}`);
+      const current=(await availableHumanActions()).find(action=>action.key===key);if(!current||current.label!==found.label||dashboardHostRequestDigest(current.request)!==dashboardHostRequestDigest(found.request))throw Error("displayed dashboard action changed; no effect attempted");return api.action(found.request);},
     async action(input:DashboardHostRequest){
       const request=dashboardHostRequest(input),digest=dashboardHostRequestDigest(request);
       if(busy||poisoned)throw Error("dashboard operation busy or acknowledgement unknown");busy=true;let attempted=false;
@@ -97,6 +117,7 @@ export function openDashboardHost(options:DashboardHostOptions){
         let result:unknown,releaseOrdinary:(()=>void)|undefined;
         try{
           if(request.operation==="observe"){
+            const sourceId=(request.payload as {sourceId?:unknown})?.sourceId;if(typeof sourceId!=="string")throw Error("exact observation source required");await options.beforeObservation?.(sourceId);
             const captured=observation.observe(request.payload,a!,selection);append({type:"observation",observation:captured});result=captured;
           }else if(request.operation==="present"){
             const p=detached(request.payload) as {userPresent:boolean;closing:boolean;evidenceDigest:string;dispatchRevision:number};
@@ -124,9 +145,11 @@ export function openDashboardHost(options:DashboardHostOptions){
             presenter?.close();presentationRevision=null;
             if(request.operation==="dispatch"||request.operation==="dispatch-reconcile"){
               const native=dispatchRequest(request.payload as DispatchRequest);if(native.action==="cancel-execution")throw Error("cancellation needs exact separately approved native bridge");
-              const port=budget.controls(a!.dispatch);
+              const port=budget.controls(a!.dispatch),ordinaryHold=ordinary&&["pause-dispatch","resume-dispatch"].includes(native.action)?holdOrdinaryDispatch(ordinary,ordinaryDispatchHoldKey):undefined;
               if(request.operation==="dispatch-reconcile"&&(await port.inspect()).records.find(r=>r.request.requestId===native.requestId)?.digest!==dispatchRequestDigest(native))throw Error("exact original dispatch reconciliation required");
               result=request.operation==="dispatch"?await port.request(native):await port.reconcile(native.requestId);
+              const record=(result as {records:{request:{requestId:string};decision:string;application:string}[]}).records.find(r=>r.request.requestId===native.requestId);
+              if(ordinaryHold&&(record?.decision!=="approved"||native.action==="resume-dispatch"&&record.application==="applied"))ordinaryHold.release();
             }else if(request.operation==="intent"||request.operation==="intent-reconcile"){
               const native=detached(intentRequest(request.payload as IntentRequest)) as IntentRequest,port=budget.intentControls(a!.dispatch),digest=intentRequestDigest(native);
               if(c.ordinaryDigest&&!ordinary)throw Error("original ordinary boundary unavailable; no recovery");

package/src/dashboard-observation.ts

@@ -20,8 +20,9 @@ export function dashboardObservations(h: DashboardHarness, c: DashboardHostConfi
       if(source.kind==="work"||source.kind==="facts"){
         const checkpoint=h.readArchiveCheckpoint(root,captured.checkpointId).checkpoint;sourceManifestId=checkpoint.sourceManifestId;bytes(sourceManifestId);
         if(source.kind==="facts") {if(input.facts!==null)throw Error("facts sources are declarations, not replacement authority");return {sourceId:source.id,kind:source.kind,checkpointId:captured.checkpointId,sourceManifestId,metadata:captured,cases:null,linkageManifestId:null};}
-        const factSource=latest().find(r=>r.kind==="facts"&&r.sourceManifestId===input.facts);if(!factSource)throw Error("exact observed fact source required, not caller replacement facts");
-        const facts=parseRetentionJson(new TextDecoder("utf-8",{fatal:true}).decode(bytes(factSource.sourceManifestId!)),256*1024);captured.factSourceManifestId=factSource.sourceManifestId;captured.factBasis="explicit-host-declarations-not-authenticated-truth";
+        const factSource=input.facts===null?null:latest().find(r=>r.kind==="facts"&&r.sourceManifestId===input.facts);if(input.facts!==null&&!factSource)throw Error("exact observed fact source required, not caller replacement facts");
+        const facts=factSource?parseRetentionJson(new TextDecoder("utf-8",{fatal:true}).decode(bytes(factSource.sourceManifestId!)),256*1024):null;
+        captured.factSourceManifestId=factSource?.sourceManifestId??null;captured.factBasis=factSource?"explicit-host-declarations-not-authenticated-truth":"derived-retained-work-only";
         if(dataDigest(authority.workContext.selectedSnapshot)!==dataDigest(selection))throw Error("independent source selection changed");
         try { const signals=h.captureArchivedWorkSignals(root,sourceManifestId,authority.workContext,facts);
           cases={version:"work-signals-v1",batchId:signals.caseBatchId,observationId:signals.observationId};linkageManifestId=signals.linkageManifestId;