pi-daddy 0.23.0 → 0.25.0

package/src/dashboard-host.ts

@@ -17,12 +17,19 @@ const hosts=new WeakSet<object>();
 export const isDashboardHost=(value:unknown):value is DashboardHost=>typeof value==="object"&&value!==null&&hosts.has(value);
 export type DashboardHost=ReturnType<typeof openDashboardHost>;
 export interface DashboardHostOptions { ordinary?:OrdinaryChildren; harness:DashboardHarness; config:DashboardHostConfig; budget:GovernedBudgetBinding; experiment?:ReturnType<typeof openExperiment>; authority:()=>DashboardHostAuthority|null;
+  /** Exact actions constructed and authorized by the owner; the dashboard exposes only human labels/keys. */
+  humanActions?:(context:{hostDigest:string;selectionDigest:string;tip:string;observations:readonly {sourceId:string;checkpointId:string}[];preparedPresentationDigest:string|null})=>readonly {key:string;label:string;request:DashboardHostRequest}[]|Promise<readonly {key:string;label:string;request:DashboardHostRequest}[]>;
+  /** Explicit approved observation effect only; refresh/frame never invokes it. */
+  beforeObservation?:(sourceId:string)=>Promise<void>;
+  /** Owner callback after the exact intent journal reports applied; failure keeps host acknowledgement unknown. */
+  afterIntentApplied?:(selection:IntentRequest["selection"])=>void|Promise<void>;
   /** Independently sourced current declaration. Never inferred from idle, a PID, title or request fields. */
   presence?:()=>{present:boolean;closing:boolean;evidenceDigest:string;expiresAt:number}|null;
 }
 function configuration(input:DashboardHostConfig){
-  const c=detached(input);controlShape(c,["version","trustDirectory","trustPolicyId","archiveRoot","scope","author","policyPath","policySha256","sources","selection","cases","blind","budgetDigest","experimentDigest","harnessArtifactDigest",...(Object.hasOwn(c,"ordinaryDigest")?["ordinaryDigest"]:[])]);
+  const c=detached(input);controlShape(c,["version","trustDirectory","trustPolicyId","archiveRoot","scope","author","policyPath","policySha256","sources","selection","cases","blind","budgetDigest","experimentDigest","harnessArtifactDigest",...(Object.hasOwn(c,"ordinaryDigest")?["ordinaryDigest"]:[]),...(Object.hasOwn(c,"learningLifecycleId")?["learningLifecycleId"]:[])]);
   if(Object.hasOwn(c,"ordinaryDigest")&&!sha(c.ordinaryDigest))throw Error("invalid ordinary binding digest");
+  if(Object.hasOwn(c,"learningLifecycleId")&&!sha(c.learningLifecycleId))throw Error("invalid learning lifecycle manifest");
   if(c.version!=="producer-dashboard-host-v1"||![c.trustDirectory,c.archiveRoot,c.policyPath].every(p=>typeof p==="string"&&isAbsolute(p))||![c.trustPolicyId,c.policySha256,c.budgetDigest,c.harnessArtifactDigest].every(sha)||!(c.experimentDigest===null||sha(c.experimentDigest))||typeof c.scope!=="string"||!c.scope||c.scope.length>128||typeof c.author!=="string"||!c.author||c.author.length>256||!Array.isArray(c.sources)||c.sources.length<1||c.sources.length>32||new Set(c.sources.map(s=>s.id)).size!==c.sources.length||c.sources.filter(s=>s.kind==="work").length>1||c.sources.some(s=>!/^[a-zA-Z0-9:_-]{1,128}$/.test(s.id)||!["work","retention","facts"].includes(s.kind)))throw Error("invalid explicit dashboard host binding");
   return freeze(c);
 }
@@ -52,7 +59,9 @@ export function openDashboardHost(options:DashboardHostOptions){
   const observation=dashboardObservations(h,c,journal.read),history=()=>journal.read();
   const append=(value:Record<string,unknown>)=>journal.append(history().at(-1)!.id,value);
   const saved=():DebriefCheckpoint|null=>{const rows=history().filter(e=>e.value.type==="checkpoint");return rows.length?detached(rows.at(-1)!.value.checkpoint) as DebriefCheckpoint:null;};
-  let presenter:DebriefPresenter|undefined,busy=false,poisoned=false,presentationRevision:number|null=null,presenceDigest:string|null=null,attentionDeferred:string|null=null;
+  let presenter:DebriefPresenter|undefined,busy=false,poisoned=false,presentationRevision:number|null=null,presenceDigest:string|null=null,attentionDeferred:string|null=null,presentationAcknowledged=false;
+  const ordinaryDispatchHoldKey=dataDigest({hostDigest,control:"pause-new-ordinary-dispatch"});
+  let displayedActions:null|{tip:string;actions:{key:string;label:string;operation:DashboardHostRequest["operation"];request:DashboardHostRequest}[];digest:string}=null;
   const presence=()=>{const p=options.presence?.();return p&&p.present===true&&p.closing===true&&sha(p.evidenceDigest)&&Number.isFinite(p.expiresAt)&&p.expiresAt>Date.now()?p:null;};
   const persistence:DebriefPersistence={durability:"host-owned",load:saved,compareAndSwap(expected,next){
     const rows=history(),previous=saved();if((previous?dataDigest(previous):null)!==expected)throw Error("stale attention CAS");
@@ -65,6 +74,14 @@ export function openDashboardHost(options:DashboardHostOptions){
   const paused=async(revision:number)=>{const b=await boundary();if(ordinary&&!ordinary.quiescent())throw Error("original ordinary children not quiescent");if(experiment){const view=await experiment.inspect();if(view.budget?.active!==0||view.control!=="not-assessed")throw Error("original experiment not quiescent");}if(!b.dispatch.paused||b.dispatch.admission!=="paused"||b.dispatch.revision!==revision||b.active!==0)throw Error("safe paused selection unavailable");};
   const currentSelection=async()=>budget.binding.intent?(await budget.intentControls(null).inspect()).selection:c.selection;
   const nativeRead=async()=>({dispatch:await budget.controls(null).inspect(),intent:budget.binding.intent?await budget.intentControls(null).inspect():null,experiment:experiment?await experiment.inspect():null,ordinary:ordinary?ordinary.inspect():null});
+  const availableHumanActions=async()=>{
+    const rows=history(),tip=rows.at(-1)!.id,selection=await currentSelection(),seen=new Set<string>();
+    const declared=await options.humanActions?.({hostDigest,selectionDigest:dashboardSelectionDigest(selection),tip,observations:observation.latest().map(x=>({sourceId:x.sourceId,checkpointId:x.checkpointId})),preparedPresentationDigest:presenter&&presentationRevision!==null&&!presentationAcknowledged?dataDigest(presenter.view()):null})??[],a=authority();
+    return declared.map(value=>{const x=detached(value);controlShape(x,["key","label","request"]);const request=dashboardHostRequest(x.request);
+      if(!/^[a-zA-Z0-9:_-]{1,64}$/.test(x.key)||typeof x.label!=="string"||!x.label.trim()||Buffer.byteLength(x.label)>120||seen.has(x.key))throw Error("invalid human dashboard action");seen.add(x.key);
+      if(request.hostDigest!==hostDigest||request.expectedTip!==tip||request.selectionDigest!==dashboardSelectionDigest(selection)||!a?.requestDigests.includes(dashboardHostRequestDigest(request)))throw Error("human dashboard action is stale or not exactly authorized");
+      return {key:x.key,label:x.label,operation:request.operation,request};});
+  };
   const api={hostDigest,selectionDigest,
     async frame(){
       const rows=history(),tip=rows.at(-1)!.id,a=authority();let source:unknown=null,error:string|null=null;
@@ -74,14 +91,21 @@ export function openDashboardHost(options:DashboardHostOptions){
       let debrief:unknown=null;
       if(a&&presenter&&presentationRevision!==null&&presence()?.evidenceDigest===presenceDigest){try{await paused(presentationRevision);debrief=presenter.view();}catch{debrief=null;}}
       let controls:unknown=null;try{controls=await nativeRead();}catch(e){error=String(e);}
-      const attention=trust.inspect(Date.now());
-      return freeze(detached({version:"producer-dashboard-frame-v1",hostDigest,selectionDigest:dashboardSelectionDigest(selection),selectionState,tip,source,controls,debrief,attention,error,
+      let learning:unknown=null;if(c.learningLifecycleId)try{learning=h.readLearningLifecycle(c.archiveRoot,c.learningLifecycleId);}catch(e){error=String(e);}
+      const attention=trust.inspect(Date.now());let actions:{key:string;label:string;operation:string}[]=[];
+      try{const available=await availableHumanActions(),digest=dataDigest(available.map(({key,label,operation,request})=>({key,label,operation,requestDigest:dashboardHostRequestDigest(request)})));
+        if(displayedActions?.tip===tip&&displayedActions.digest!==digest)throw Error("displayed dashboard actions changed before journal advance");
+        displayedActions={tip,actions:available,digest};actions=available.map(({key,label,operation})=>({key,label,operation}));}catch(e){error=String(e);}
+      return freeze(detached({version:"producer-dashboard-frame-v1",hostDigest,selectionDigest:dashboardSelectionDigest(selection),selectionState,tip,source,controls,learning,debrief,attention,error,actions,
         requests:rows.filter(e=>["claim","result","presentation","defer","ordinary-intent-pending"].includes(String(e.value.type))).map(e=>e.value),
         control:rows.some(e=>e.value.type==="host-failure")?"failed":rows.some(e=>e.value.type==="claim"&&!rows.some(r=>r.value.type==="result"&&r.value.requestId===e.value.requestId))?"unknown":"not-assessed",
         acknowledgement:poisoned?"unknown":"readback-only",identity:"independently-declared-host; not human/module authentication",activeBranch:null,acceptance:"not-assessed",freshness:"snapshot-unknown",workerInteractions:0}));
     },
     /** Explicit reconciliation is read-only. A retained claim is never replayed as an effect. */
     reconcile:()=>api.frame(),
+    async humanAction(key:string){const tip=history().at(-1)!.id;if(!displayedActions||displayedActions.tip!==tip)throw Error("dashboard actions must be displayed at the current tip");
+      const found=displayedActions.actions.find(action=>action.key===key);if(!found)throw Error(`unknown dashboard action ${JSON.stringify(key)}`);
+      const current=(await availableHumanActions()).find(action=>action.key===key);if(!current||current.label!==found.label||dashboardHostRequestDigest(current.request)!==dashboardHostRequestDigest(found.request))throw Error("displayed dashboard action changed; no effect attempted");return api.action(found.request);},
     async action(input:DashboardHostRequest){
       const request=dashboardHostRequest(input),digest=dashboardHostRequestDigest(request);
       if(busy||poisoned)throw Error("dashboard operation busy or acknowledgement unknown");busy=true;let attempted=false;
@@ -97,6 +121,7 @@ export function openDashboardHost(options:DashboardHostOptions){
         let result:unknown,releaseOrdinary:(()=>void)|undefined;
         try{
           if(request.operation==="observe"){
+            const sourceId=(request.payload as {sourceId?:unknown})?.sourceId;if(typeof sourceId!=="string")throw Error("exact observation source required");await options.beforeObservation?.(sourceId);
             const captured=observation.observe(request.payload,a!,selection);append({type:"observation",observation:captured});result=captured;
           }else if(request.operation==="present"){
             const p=detached(request.payload) as {userPresent:boolean;closing:boolean;evidenceDigest:string;dispatchRevision:number};
@@ -111,11 +136,11 @@ export function openDashboardHost(options:DashboardHostOptions){
               attentionDeferred=null;const view=await presenter.open({mode:"manual",userPresent:true});await paused(p.dispatchRevision);
               if(attentionDeferred){presenter.close();presentationRevision=null;append({type:"defer",requestId:request.requestId,reason:attentionDeferred,weekly:true});result={state:"deferred",reason:attentionDeferred};}
               else {if(view.state!=="open")throw Error("presentation data/attention acknowledgement unavailable");
-                presentationRevision=p.dispatchRevision;presenceDigest=p.evidenceDigest;const frameDigest=dataDigest(view);append({type:"presentation",requestId:request.requestId,evidence:p,frameDigest,state:"prepared-not-delivery",automatic:"unqualified"});result={state:"prepared",frameDigest};}
+                presentationRevision=p.dispatchRevision;presenceDigest=p.evidenceDigest;presentationAcknowledged=false;const frameDigest=dataDigest(view);append({type:"presentation",requestId:request.requestId,evidence:p,frameDigest,state:"prepared-not-delivery",automatic:"unqualified"});result={state:"prepared",frameDigest};}
             }
           }else if(request.operation==="presented"){
             const p=detached(request.payload) as {frameDigest:string};if(Object.keys(p).join()!=="frameDigest"||!presenter||presentationRevision===null)throw Error("original prepared presentation required");
-            await paused(presentationRevision);if(presence()?.evidenceDigest!==presenceDigest)throw Error("user absent/presence changed");if(p.frameDigest!==dataDigest(presenter.view()))throw Error("stale presentation acknowledgement");result={state:"host-acknowledged-presentation",frameDigest:p.frameDigest,humanAuthentication:"unqualified"};
+            await paused(presentationRevision);if(presence()?.evidenceDigest!==presenceDigest)throw Error("user absent/presence changed");if(p.frameDigest!==dataDigest(presenter.view()))throw Error("stale presentation acknowledgement");presentationAcknowledged=true;result={state:"host-acknowledged-presentation",frameDigest:p.frameDigest,humanAuthentication:"unqualified"};
           }else if(request.operation==="defer"){
             presenter?.close();presentationRevision=null;append({type:"defer",requestId:request.requestId,weekly:true,evidence:request.payload});result={state:"deferred"};
           }else if(request.operation==="debrief"){
@@ -124,13 +149,15 @@ export function openDashboardHost(options:DashboardHostOptions){
             presenter?.close();presentationRevision=null;
             if(request.operation==="dispatch"||request.operation==="dispatch-reconcile"){
               const native=dispatchRequest(request.payload as DispatchRequest);if(native.action==="cancel-execution")throw Error("cancellation needs exact separately approved native bridge");
-              const port=budget.controls(a!.dispatch);
+              const port=budget.controls(a!.dispatch),ordinaryHold=ordinary&&["pause-dispatch","resume-dispatch"].includes(native.action)?holdOrdinaryDispatch(ordinary,ordinaryDispatchHoldKey):undefined;
               if(request.operation==="dispatch-reconcile"&&(await port.inspect()).records.find(r=>r.request.requestId===native.requestId)?.digest!==dispatchRequestDigest(native))throw Error("exact original dispatch reconciliation required");
               result=request.operation==="dispatch"?await port.request(native):await port.reconcile(native.requestId);
+              const record=(result as {records:{request:{requestId:string};decision:string;application:string}[]}).records.find(r=>r.request.requestId===native.requestId);
+              if(ordinaryHold&&(record?.decision!=="approved"||native.action==="resume-dispatch"&&record.application==="applied"))ordinaryHold.release();
             }else if(request.operation==="intent"||request.operation==="intent-reconcile"){
               const native=detached(intentRequest(request.payload as IntentRequest)) as IntentRequest,port=budget.intentControls(a!.dispatch),digest=intentRequestDigest(native);
               if(c.ordinaryDigest&&!ordinary)throw Error("original ordinary boundary unavailable; no recovery");
-              if(!ordinary)result=request.operation==="intent"?await port.request(native):await port.reconcile(native);
+              if(!ordinary){result=request.operation==="intent"?await port.request(native):await port.reconcile(native);const snapshot=result as {selection:IntentRequest["selection"];records:{requestId:string;application:string}[]},outcome=snapshot.records.find(r=>r.requestId===native.requestId);if(outcome?.application==="applied")await options.afterIntentApplied?.(snapshot.selection);}
               else {
               const pending=history().filter(e=>e.value.type==="ordinary-intent-pending"&&e.value.nativeRequestId===native.requestId);
               if(pending.some(e=>e.value.digest!==digest))throw Error("immutable pending ordinary intent ID");
@@ -144,8 +171,9 @@ export function openDashboardHost(options:DashboardHostOptions){
                 result={state:"pending-ordinary-boundary",nativeRequestId:native.requestId,application:"not-acknowledged"};
               }else{
                 result=(request.operation==="intent"||pending.length>0&&!exists)?await port.request(native):await port.reconcile(native);
-                const outcome=(result as {records:{requestId:string;application:string}[]}).records.find(r=>r.requestId===native.requestId);
+                const snapshot=result as {selection:IntentRequest["selection"];records:{requestId:string;application:string}[]},outcome=snapshot.records.find(r=>r.requestId===native.requestId);
                 if(held&&!outcome)throw Error("native intent application acknowledgement unavailable");
+                if(outcome?.application==="applied")await options.afterIntentApplied?.(snapshot.selection);
                 if(held&&["applied","not-applied"].includes(outcome!.application))releaseOrdinary=held.release;
               }
               }

package/src/dashboard-observation.ts

@@ -20,10 +20,12 @@ export function dashboardObservations(h: DashboardHarness, c: DashboardHostConfi
       if(source.kind==="work"||source.kind==="facts"){
         const checkpoint=h.readArchiveCheckpoint(root,captured.checkpointId).checkpoint;sourceManifestId=checkpoint.sourceManifestId;bytes(sourceManifestId);
         if(source.kind==="facts") {if(input.facts!==null)throw Error("facts sources are declarations, not replacement authority");return {sourceId:source.id,kind:source.kind,checkpointId:captured.checkpointId,sourceManifestId,metadata:captured,cases:null,linkageManifestId:null};}
-        const factSource=latest().find(r=>r.kind==="facts"&&r.sourceManifestId===input.facts);if(!factSource)throw Error("exact observed fact source required, not caller replacement facts");
-        const facts=parseRetentionJson(new TextDecoder("utf-8",{fatal:true}).decode(bytes(factSource.sourceManifestId!)),256*1024);captured.factSourceManifestId=factSource.sourceManifestId;captured.factBasis="explicit-host-declarations-not-authenticated-truth";
+        const factSource=input.facts===null?null:latest().find(r=>r.kind==="facts"&&r.sourceManifestId===input.facts);if(input.facts!==null&&!factSource)throw Error("exact observed fact source required, not caller replacement facts");
+        const facts=factSource?parseRetentionJson(new TextDecoder("utf-8",{fatal:true}).decode(bytes(factSource.sourceManifestId!)),256*1024):null;
+        captured.factSourceManifestId=factSource?.sourceManifestId??null;captured.factBasis=factSource?"explicit-host-declarations-not-authenticated-truth":"derived-retained-work-only";
         if(dataDigest(authority.workContext.selectedSnapshot)!==dataDigest(selection))throw Error("independent source selection changed");
         try { const signals=h.captureArchivedWorkSignals(root,sourceManifestId,authority.workContext,facts);
+          captured.runtimeFactsManifestId=signals.runtimeFactsManifestId;
           cases={version:"work-signals-v1",batchId:signals.caseBatchId,observationId:signals.observationId};linkageManifestId=signals.linkageManifestId;
         } catch(error) { captured.semanticFailure=String(error); } // Retain checkpoint/gap even when nomination is unavailable.
       } else {if(input.facts!==null||captured.kind!=="execution-retention-v2")throw Error("retention source requires exact referenced-blobs policy");h.readRetainedExecution(root,captured.checkpointId);}

package/src/experiment-store.ts

@@ -13,7 +13,8 @@ export async function ownedDirectory(path: string) {
   if (!s.isDirectory() || s.isSymbolicLink() || s.uid !== BigInt(process.getuid!()) || (s.mode & 0o077n) !== 0n || await realpath(path) !== path) throw new Error("canonical private experiment directory required");
   return s;
 }
-export async function readExperimentFile(path: string, max: number): Promise<Buffer> {
+export async function readExperimentFile(path: string, max: number, options: { appendOnly?: true } = {}): Promise<Buffer> {
+  if (Object.keys(options).some(key => key !== "appendOnly") || options.appendOnly !== undefined && options.appendOnly !== true) throw new TypeError("invalid experiment read mode");
   const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
   return runWithFinalizers(async () => {
     const s = await file.stat({ bigint: true });
@@ -21,7 +22,14 @@ export async function readExperimentFile(path: string, max: number): Promise<Buf
     const data = Buffer.alloc(Number(s.size)); let offset = 0;
     while (offset < data.length) { const n = (await file.read(data, offset, data.length - offset, offset)).bytesRead; if (!n) throw new Error("short experiment read"); offset += n; }
     const end = await file.stat({ bigint: true }), current = await lstat(path, { bigint: true });
-    if (end.size !== s.size || end.mtimeNs !== s.mtimeNs || current.dev !== s.dev || current.ino !== s.ino || current.nlink !== 1n) throw new Error("experiment source changed");
+    const identityChanged = current.dev !== s.dev || current.ino !== s.ino || current.nlink !== 1n;
+    if (!options.appendOnly && (end.size !== s.size || end.mtimeNs !== s.mtimeNs || identityChanged)) throw new Error("experiment source changed");
+    if (options.appendOnly) {
+      if (end.size < s.size || identityChanged) throw new Error("experiment source changed");
+      const verify = Buffer.alloc(data.length); let checked = 0;
+      while (checked < verify.length) { const n = (await file.read(verify, checked, verify.length - checked, checked)).bytesRead; if (!n) throw new Error("short experiment read"); checked += n; }
+      if (!verify.equals(data)) throw new Error("experiment source changed");
+    }
     return data;
   }, [{ label: "experiment read close failed", run: () => file.close() }]);
 }
@@ -59,7 +67,7 @@ export function experimentStore(value: ExperimentBinding) {
     if (String(root.dev) !== b.device || String(root.ino) !== b.inode || String(file.dev) !== b.journalDevice || String(file.ino) !== b.journalInode) throw new Error("experiment identity replaced");
   };
   const read = async () => {
-    await check(); const bytes = await readExperimentFile(path, 256 * 1024); await check();
+    await check(); const bytes = await readExperimentFile(path, 256 * 1024, { appendOnly: true }); await check();
     const text = new TextDecoder("utf8", { fatal: true }).decode(bytes); if (!text.endsWith("\n")) throw new Error("torn experiment journal");
     const lines = text.slice(0, -1).split("\n"); if (lines.length > 260 || experimentHash(parseWorkJson(lines[0])) !== experimentHash(b)) throw new Error("experiment header/bound mismatch");
     let previous = experimentHash(b); const events: Record<string, unknown>[] = [];

package/src/experiment.ts

@@ -146,6 +146,12 @@ export function openExperiment(input: ExperimentBinding, hostAuthority: Experime
           let resolve!: (success: boolean) => void;
           return { promise: new Promise<boolean>(done => { resolve = done; }), done: (success: boolean) => resolve(success) };
         });
+        // Public readiness includes the durable spawn observation, not merely process creation.
+        // This closes the process-start -> spawn-ledger race for inspect and cancellation callers.
+        const observedStarted = reserved.map((run, i) => run.started.then(async value => {
+          if (value === "spawned") await append({ type: "spawn", executionId: c.variants[i].executionId });
+          return value;
+        }));
         const one = async (i: number) => {
           const v = c.variants[i]; let success = false, launched = false, primaryResult: VariantRecord | null = null;
           try {
@@ -155,8 +161,7 @@ export function openExperiment(input: ExperimentBinding, hostAuthority: Experime
             launched = true;
             const running = reserved[i].run(handles.get(v.executionId)!.signal);
             // Consume both promises even on bookkeeping failure. No untracked rejection or worker.
-            const observed = reserved[i].started.then(async value => { if (value === "spawned") await append({ type: "spawn", executionId: v.executionId }); });
-            const [result, observation] = await Promise.allSettled([running, observed]);
+            const [result, observation] = await Promise.allSettled([running, observedStarted[i]]);
             if (result.status === "rejected" || observation.status === "rejected") throw new Error("runtime/accounting/observation unknown");
             const data = Buffer.from(JSON.stringify(result.value) + "\n"), out = result.value.output;
             const cancelled = out.aborted && (Boolean(out.signal) || await reserved[i].started === "settled-without-spawn");
@@ -218,7 +223,7 @@ export function openExperiment(input: ExperimentBinding, hostAuthority: Experime
           }
           const view = await inspect().catch(unknown); primary.resolve(view.variants[0]); resolveBoundary(view); return view;
         })();
-        live = Object.freeze({ primary: primary.promise, completion, boundary: c.order ? boundary : completion, started: Object.freeze(reserved.map(r => r.started)) }); return live;
+        live = Object.freeze({ primary: primary.promise, completion, boundary: c.order ? boundary : completion, started: Object.freeze(observedStarted) }); return live;
       } catch (error) {
         fault = true;
         for (const run of reserved) await run.run(AbortSignal.abort()).catch(() => {});

package/src/index.ts

@@ -37,6 +37,7 @@ export {
 export { createDebriefPresenter, type DebriefPresenter, type DebriefHost, type DebriefFrame, type DebriefCheckpoint, type DebriefPersistence } from "./debrief.ts";
 export { ordinaryChildrenFor, ordinaryCancellation, ordinaryCancellationDigest, isOrdinaryChildren, type OrdinaryChildren, type OrdinaryCancellation, type OrdinaryAuthority, type OrdinaryTarget } from "./ordinary-children.ts";
 export { loadDashboardHarness, loadedDashboardHarnessDigest, type DashboardHarnessArtifact } from "./dashboard-harness.ts";
+export { startDailyDashboardHost, discoverDailyIntentActions, type DailyDashboardHostInput, type DailyIntentAction } from "./daily-dashboard-host.ts";
 export { createDashboardHost, openDashboardHost, dashboardHostDigest, dashboardHostRequestDigest, dashboardSelectionDigest, type DashboardHost, type DashboardHostConfig, type DashboardHostRequest, type DashboardHostAuthority, type DashboardHarness, type DashboardHostOptions } from "./dashboard-host.ts";
 export { serveDashboardHost, connectDashboardHost, ENV_DASHBOARD_HOST_SOCKET, type DashboardConnection } from "./dashboard-host-transport.ts";
 export { createRetainedDebrief, retainDebriefBlind, openDebriefBlindPreview, type DebriefHarness, type CaseSelection, type DurableBlindBinding } from "./debrief-host.ts";
@@ -154,6 +155,22 @@ export {
 
 export { renderDashboard, type DashboardRenderOptions } from "./dashboard-render.ts";
 
+export {
+  runMeasuredAgentSession,
+  piSdkMeasuredSessionHost,
+  verifyMeasuredSubscription,
+  MeasuredSessionFailure,
+  MeasuredSessionUnknownError,
+  type MeasuredSessionInput,
+  type MeasuredSessionHost,
+  type MeasuredSessionHostInput,
+  type MeasuredSessionHostResult,
+  type ProviderUsage,
+} from "./measured-session.ts";
+export { createMeasuredOrder, openMeasuredOrder, measuredOrderDigest, measuredOrderAcknowledgementDigest, qualifyMeasuredOutput,
+  type MeasuredOrder, type MeasuredOrderNode, type MeasuredOrderAttempt, type MeasuredOutputContract, type MeasuredOrderBinding, type MeasuredOrderAuthority,
+  type MeasuredOrderAcknowledgement, type MeasuredOrderNodeView } from "./measured-order.ts";
+
 export {
   createApprovalGate,
   createApprovalGateProvider,

package/src/intent-application.ts

@@ -9,9 +9,10 @@ import { freezeWork } from "./work-ledger-json.ts";
 import { intentKey, intentSelection, intentPriorities, type WorkIntentBinding, type IntentRequest, type IntentState, type IntentSelection, type IntentPriority } from "./intent-control.ts";
 const ref = (r: WorkFrozen<WorkRevision>) => ({ kind: r.kind, id: r.id, revision: r.revision, digest: r.digest });
 const entity = (r: { kind: string; id: string } | null) => r ? `${r.kind}:${r.id}` : null;
+const allowedIntentPath=(path:string)=>!path.split("/").includes(".pi")||path.endsWith("/.pi/work.jsonl");
 export function workIntentBinding(input: WorkIntentBinding): WorkIntentBinding {
   controlShape(input, ["version", "path", "device", "inode", "grantLedgerPath", "selection", "priorities"]);
-  if (input.version !== "1.0" || typeof input.path !== "string" || input.path.length > 1024 || !isAbsolute(input.path) || resolve(input.path) !== input.path || input.path.split("/").includes(".pi") ||
+  if (input.version !== "1.0" || typeof input.path !== "string" || input.path.length > 1024 || !isAbsolute(input.path) || resolve(input.path) !== input.path || !allowedIntentPath(input.path) ||
     ![input.device, input.inode].every(x => typeof x === "string" && /^\d+$/.test(x)) || !(input.grantLedgerPath === null || typeof input.grantLedgerPath === "string" && input.grantLedgerPath.length <= 1024 && isAbsolute(input.grantLedgerPath))) throw new TypeError("invalid pinned work binding");
   return JSON.parse(intentKey({ ...input, selection: intentSelection(input.selection), priorities: intentPriorities(input.priorities) }));
 }
@@ -37,7 +38,7 @@ export function resolveIntent(text: string, selection: WorkFrozen<IntentSelectio
 export async function bindWorkIntent(input: { path: string; grantLedgerPath: string | null; selection: IntentSelection; priorities: IntentPriority[] }): Promise<WorkFrozen<WorkIntentBinding>> {
   controlShape(input, ["path", "grantLedgerPath", "selection", "priorities"]);
   const selection = intentSelection(input.selection), priorities = intentPriorities(input.priorities), path = input.path, grantLedgerPath = input.grantLedgerPath;
-  if (typeof path !== "string" || !isAbsolute(path) || path.split("/").includes(".pi")) throw new TypeError("explicit work path required");
+  if (typeof path !== "string" || !isAbsolute(path) || !allowedIntentPath(path)) throw new TypeError("explicit work path required");
   await workDestination(path, grantLedgerPath);
   const parent = await lstat(dirname(path), { bigint: true });
   if (!parent.isDirectory() || (parent.mode & 0o077n) || parent.uid !== BigInt(process.getuid!())) throw new Error("owner-private work parent required");

package/src/measured-order.ts

@@ -0,0 +1,67 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { mkdir, open, readFile, realpath, lstat, writeFile } from "node:fs/promises";
+import { isAbsolute, join, resolve } from "node:path";
+import { withFileLock } from "./file-lock.ts";
+import { intentKey } from "./intent-control.ts";
+import { runMeasuredAgentSession, MeasuredSessionFailure, MeasuredSessionUnknownError, type MeasuredSessionHost, type MeasuredSessionInput } from "./measured-session.ts";
+import { openResourceBudget, resourceBindingDigest, type GovernedBudgetBinding } from "./resource-budget.ts";
+import { freezeWork } from "./work-ledger-json.ts";
+
+const ID=/^[a-zA-Z0-9:_-]{1,128}$/,HEX=/^[a-f0-9]{64}$/;
+const hash=(value:unknown)=>createHash("sha256").update(typeof value==="string"?value:intentKey(value)).digest("hex");
+const exact=(value:object,keys:string[])=>Object.keys(value).sort().join()===keys.sort().join();
+export type MeasuredOutputContract={version:"measured-output-exact-v1";expectedSha256:string}|{version:"measured-output-json-projection-v1";requiredKeys:string[];textFields:string[];arrayField:string;minItems:number;maxItems:number;itemRequiredFields:string[];projectionFields:string[];expectedProjectionSha256:string};
+export interface MeasuredOrderAttempt extends Omit<MeasuredSessionInput,"budget"|"attempt"|"signal">{attemptId:string;includeDependencies:boolean;qualification:MeasuredOutputContract}
+export interface MeasuredOrderNode {nodeId:string;dependencies:string[];attempts:MeasuredOrderAttempt[]}
+export interface MeasuredOrder {version:"measured-order-v1";orderId:string;authorityDigest:string;budgetDigest:string;nodes:MeasuredOrderNode[]}
+export interface MeasuredOrderBinding {version:"measured-order-binding-v1";directory:string;directoryDevice:string;directoryInode:string;journalDevice:string;journalInode:string;budget:GovernedBudgetBinding;order:MeasuredOrder;digest:string}
+export interface MeasuredOrderAuthority {authorityDigest:string;orderDigests:string[];acknowledgementDigests:string[]}
+export interface MeasuredOrderAcknowledgement {version:"measured-order-ack-v1";requestId:string;bindingDigest:string;attemptId:string;claimOwner:string;claimDigest:string}
+type JournalEvent=
+ |{type:"claim";sequence:number;previousDigest:string|null;attemptId:string;owner:string;digest:string}
+ |{type:"result";sequence:number;previousDigest:string;attemptId:string;owner:string;state:"completed"|"failed"|"cancelled"|"unknown"|"mismatch";outputSha256:string|null;result:unknown;digest:string}
+ |{type:"acknowledge-unknown";sequence:number;previousDigest:string;request:MeasuredOrderAcknowledgement;digest:string};
+export interface MeasuredOrderNodeView {nodeId:string;state:"eligible"|"dependency-blocked"|"running"|"unknown"|"exhausted"|"satisfied";action:"dispatch"|"wait"|"acknowledge"|"none";attemptId:string|null;outputSha256:string|null;unknownClaim:{owner:string;digest:string}|null}
+function field(value:unknown):value is string{return typeof value==="string"&&/^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(value);}
+function checkedContract(input:MeasuredOutputContract):MeasuredOutputContract{const c=JSON.parse(intentKey(input)) as MeasuredOutputContract;if(c.version==="measured-output-exact-v1"){if(!exact(c,["version","expectedSha256"])||!HEX.test(c.expectedSha256))throw Error("invalid exact output contract");return c;}if(c.version!=="measured-output-json-projection-v1"||!exact(c,["version","requiredKeys","textFields","arrayField","minItems","maxItems","itemRequiredFields","projectionFields","expectedProjectionSha256"])||![c.requiredKeys,c.textFields,c.itemRequiredFields,c.projectionFields].every(x=>Array.isArray(x)&&x.length<=32&&new Set(x).size===x.length&&x.every(field))||!field(c.arrayField)||!Number.isSafeInteger(c.minItems)||!Number.isSafeInteger(c.maxItems)||c.minItems<0||c.maxItems<c.minItems||c.maxItems>4096||!c.requiredKeys.includes(c.arrayField)||c.textFields.some(x=>!c.requiredKeys.includes(x))||c.projectionFields.some(x=>!c.itemRequiredFields.includes(x))||!HEX.test(c.expectedProjectionSha256))throw Error("invalid deterministic JSON output contract");return c;}
+export function qualifyMeasuredOutput(output:string,input:MeasuredOutputContract){const contract=checkedContract(input),outputSha256=hash(output);if(contract.version==="measured-output-exact-v1")return{eligible:outputSha256===contract.expectedSha256,outputSha256,projectionSha256:null};let value:unknown;try{value=JSON.parse(output);}catch{return{eligible:false,outputSha256,projectionSha256:null};}if(!value||typeof value!=="object"||Array.isArray(value)||Object.keys(value).sort().join()!==[...contract.requiredKeys].sort().join())return{eligible:false,outputSha256,projectionSha256:null};const object=value as Record<string,unknown>,items=object[contract.arrayField];if(contract.textFields.some(x=>typeof object[x]!=="string"||!(object[x] as string).trim())||!Array.isArray(items)||items.length<contract.minItems||items.length>contract.maxItems||items.some(x=>!x||typeof x!=="object"||Array.isArray(x)||contract.itemRequiredFields.some(k=>!Object.hasOwn(x,k))))return{eligible:false,outputSha256,projectionSha256:null};const projection=(items as Record<string,unknown>[]).map(item=>Object.fromEntries(contract.projectionFields.map(k=>[k,item[k]]))),projectionSha256=hash(intentKey(projection));return{eligible:projectionSha256===contract.expectedProjectionSha256,outputSha256,projectionSha256};}
+
+function checkedOrder(input:MeasuredOrder,budget:GovernedBudgetBinding):MeasuredOrder{
+ const order=JSON.parse(intentKey(input)) as MeasuredOrder;if(!exact(order,["version","orderId","authorityDigest","budgetDigest","nodes"])||order.version!=="measured-order-v1"||!ID.test(order.orderId)||!HEX.test(order.authorityDigest)||order.budgetDigest!==resourceBindingDigest(budget)||!Array.isArray(order.nodes)||!order.nodes.length||order.nodes.length>8)throw Error("invalid bounded measured order");
+ const ids=new Set<string>(),attempts=new Set<string>();let inputBytes=0,count=0;
+ for(const node of order.nodes){if(!exact(node,["nodeId","dependencies","attempts"])||!ID.test(node.nodeId)||ids.has(node.nodeId)||!Array.isArray(node.dependencies)||node.dependencies.length>8||new Set(node.dependencies).size!==node.dependencies.length||!Array.isArray(node.attempts)||!node.attempts.length||node.attempts.length>3)throw Error("invalid node/dependency/recovery policy");ids.add(node.nodeId);
+  for(const a of node.attempts){if(!exact(a,["attemptId","model","thinkingLevel","prompt","deadlineMs","terminationGraceMs","maxRetainedOutputBytes","maxOutputTokens","includeDependencies","qualification"])||!ID.test(a.attemptId)||attempts.has(a.attemptId)||typeof a.includeDependencies!=="boolean"||!["openai-codex/gpt-5.6-sol","openai-codex/gpt-5.6-terra"].includes(a.model)||typeof a.prompt!=="string"||!a.prompt.length||Buffer.byteLength(a.prompt)>16384||!Number.isSafeInteger(a.deadlineMs)||a.deadlineMs<1000||a.deadlineMs>300000||!Number.isSafeInteger(a.terminationGraceMs)||a.terminationGraceMs<100||a.terminationGraceMs>10000||!Number.isSafeInteger(a.maxRetainedOutputBytes)||a.maxRetainedOutputBytes<1||a.maxRetainedOutputBytes>1024*1024||!Number.isSafeInteger(a.maxOutputTokens)||a.maxOutputTokens<1||a.maxOutputTokens>16384)throw Error("invalid read-only model attempt");checkedContract(a.qualification);attempts.add(a.attemptId);inputBytes+=Buffer.byteLength(a.prompt);count++;}
+ }
+ for(const node of order.nodes)for(const attempt of node.attempts)if(attempt.includeDependencies){let extra=0;for(const dependency of node.dependencies){const prior=order.nodes.find(n=>n.nodeId===dependency);extra+=256+Math.max(...(prior?.attempts.map(a=>a.maxRetainedOutputBytes)??[0]));}if(Buffer.byteLength(attempt.prompt)+extra>16384)throw Error("sealed dependency prompt exceeds attempt bound");inputBytes+=extra;}
+ if(count>budget.limits.maxAttempts||inputBytes>budget.limits.maxInputBytes||budget.limits.maxConcurrent<count)throw Error("order exceeds original accounting allowance");
+ const visiting=new Set<string>(),done=new Set<string>();const visit=(id:string)=>{if(done.has(id))return;if(visiting.has(id))throw Error("dependency cycle");const node=order.nodes.find(n=>n.nodeId===id);if(!node)throw Error("missing dependency");visiting.add(id);node.dependencies.forEach(visit);visiting.delete(id);done.add(id);};order.nodes.forEach(n=>visit(n.nodeId));return order;
+}
+export const measuredOrderDigest=(order:MeasuredOrder)=>hash(order);
+export function measuredOrderAcknowledgementDigest(input:MeasuredOrderAcknowledgement){const value=JSON.parse(intentKey(input)) as MeasuredOrderAcknowledgement;if(!exact(value,["version","requestId","bindingDigest","attemptId","claimOwner","claimDigest"])||value.version!=="measured-order-ack-v1"||![value.requestId,value.attemptId,value.claimOwner].every(x=>ID.test(x))||![value.bindingDigest,value.claimDigest].every(x=>HEX.test(x)))throw Error("invalid unknown acknowledgement");return hash(value);}
+function paths(directory:string){return{binding:join(directory,"binding.json"),journal:join(directory,"journal.jsonl")};}
+async function privateDirectory(directory:string){const st=await lstat(directory,{bigint:true});if(!st.isDirectory()||(st.mode&0o077n)||st.uid!==BigInt(process.getuid!())||await realpath(directory)!==directory)throw Error("owner-private measured order directory required");}
+export async function createMeasuredOrder(input:{directory:string;budget:GovernedBudgetBinding;order:MeasuredOrder}):Promise<Readonly<MeasuredOrderBinding>>{
+ if(!isAbsolute(input.directory)||resolve(input.directory)!==input.directory)throw Error("absolute measured order directory required");const order=checkedOrder(input.order,input.budget);await mkdir(input.directory,{recursive:false,mode:0o700});await privateDirectory(input.directory);
+ const p=paths(input.directory);await writeFile(p.journal,"",{mode:0o600,flag:"wx"});const directoryStat=await lstat(input.directory,{bigint:true}),journalStat=await lstat(p.journal,{bigint:true}),identity={directory:input.directory,directoryDevice:String(directoryStat.dev),directoryInode:String(directoryStat.ino),journalDevice:String(journalStat.dev),journalInode:String(journalStat.ino)};
+ const binding={version:"measured-order-binding-v1" as const,...identity,budget:input.budget,order,digest:hash({...identity,budgetDigest:resourceBindingDigest(input.budget),orderDigest:measuredOrderDigest(order)})};await writeFile(p.binding,intentKey(binding)+"\n",{mode:0o600,flag:"wx"});return freezeWork(binding) as unknown as Readonly<MeasuredOrderBinding>;
+}
+function checkedBinding(input:MeasuredOrderBinding):MeasuredOrderBinding{const b=JSON.parse(intentKey(input)) as MeasuredOrderBinding,identity={directory:b.directory,directoryDevice:b.directoryDevice,directoryInode:b.directoryInode,journalDevice:b.journalDevice,journalInode:b.journalInode};if(!exact(b,["version","directory","directoryDevice","directoryInode","journalDevice","journalInode","budget","order","digest"])||b.version!=="measured-order-binding-v1"||!isAbsolute(b.directory)||resolve(b.directory)!==b.directory||![b.directoryDevice,b.directoryInode,b.journalDevice,b.journalInode].every(x=>/^\d+$/.test(x))||b.digest!==hash({...identity,budgetDigest:resourceBindingDigest(b.budget),orderDigest:measuredOrderDigest(checkedOrder(b.order,b.budget))}))throw Error("invalid measured order binding");return b;}
+async function pinnedJournal(binding:MeasuredOrderBinding,writable=false){const path=paths(binding.directory).journal,handle=await open(path,(writable?constants.O_RDWR|constants.O_APPEND:constants.O_RDONLY)|constants.O_NOFOLLOW);try{const st=await handle.stat({bigint:true});if(!st.isFile()||st.nlink!==1n||(st.mode&0o077n)||String(st.dev)!==binding.journalDevice||String(st.ino)!==binding.journalInode)throw Error("measured order binding changed");return handle;}catch(error){await handle.close();throw error;}}
+async function linked(binding:MeasuredOrderBinding){const st=await lstat(paths(binding.directory).journal,{bigint:true});if(!st.isFile()||st.nlink!==1n||String(st.dev)!==binding.journalDevice||String(st.ino)!==binding.journalInode||(await realpath(paths(binding.directory).journal))!==paths(binding.directory).journal)throw Error("measured order binding changed");}
+function parseJournal(text:string):JournalEvent[]{if(text&&!text.endsWith("\n"))throw Error("incomplete measured order journal");const rows=text?text.trimEnd().split("\n").map(line=>{const row=JSON.parse(line) as JournalEvent;if(intentKey(row)!==line)throw Error("noncanonical measured order journal");return row;}):[];let prior:string|null=null;for(let i=0;i<rows.length;i++){const row=rows[i],copy={...row} as any,claimed=copy.digest;delete copy.digest;if(row.sequence!==i||row.previousDigest!==prior||claimed!==hash(copy))throw Error("invalid measured order journal");prior=claimed;}return rows;}
+async function appendJournal(binding:MeasuredOrderBinding,event:Omit<JournalEvent,"sequence"|"previousDigest"|"digest">){const path=paths(binding.directory).journal;return withFileLock(path,"measured order",async()=>{const handle=await pinnedJournal(binding,true);try{const rows=parseJournal(await handle.readFile("utf8")),base={...event,sequence:rows.length,previousDigest:rows.at(-1)?.digest??null} as any,record={...base,digest:hash(base)} as JournalEvent;await linked(binding);await handle.writeFile(intentKey(record)+"\n");await handle.sync();return record;}finally{await handle.close();}});}
+function project(order:MeasuredOrder,events:JournalEvent[],currentOwner:string):MeasuredOrderNodeView[]{const rows=new Map<string,MeasuredOrderNodeView>();const evaluate=(node:MeasuredOrderNode):MeasuredOrderNodeView=>{const prior=rows.get(node.nodeId);if(prior)return prior;const row:MeasuredOrderNodeView={nodeId:node.nodeId,state:"exhausted",action:"none",attemptId:null,outputSha256:null,unknownClaim:null};if(node.dependencies.some(id=>evaluate(order.nodes.find(n=>n.nodeId===id)!).state!=="satisfied")){row.state="dependency-blocked";row.action="wait";rows.set(node.nodeId,row);return row;}
+ for(const attempt of node.attempts){const claim=events.find(e=>e.type==="claim"&&e.attemptId===attempt.attemptId) as Extract<JournalEvent,{type:"claim"}>|undefined;if(!claim){row.state="eligible";row.action="dispatch";row.attemptId=attempt.attemptId;break;}const result=events.find(e=>e.type==="result"&&e.attemptId===attempt.attemptId) as Extract<JournalEvent,{type:"result"}>|undefined;const acknowledged=events.some(e=>e.type==="acknowledge-unknown"&&e.request.attemptId===attempt.attemptId&&e.request.claimDigest===claim.digest&&e.request.claimOwner===claim.owner);if(!result){if(claim.owner!==currentOwner){if(acknowledged)continue;row.state="unknown";row.action="acknowledge";row.unknownClaim={owner:claim.owner,digest:claim.digest};}else{row.state="running";row.action="wait";}row.attemptId=attempt.attemptId;break;}if(result.state==="unknown"){if(!acknowledged){row.state="unknown";row.action="acknowledge";row.attemptId=attempt.attemptId;row.unknownClaim={owner:claim.owner,digest:claim.digest};break;}continue;}if(result.state==="completed"){row.state="satisfied";row.outputSha256=result.outputSha256;row.attemptId=attempt.attemptId;break;}}
+ rows.set(node.nodeId,row);return row;};return order.nodes.map(evaluate);}
+export function openMeasuredOrder(input:MeasuredOrderBinding,hostAuthority:MeasuredOrderAuthority|null,host:MeasuredSessionHost){const binding=checkedBinding(input),p=paths(binding.directory),owner=randomUUID(),authorized=()=>hostAuthority?.authorityDigest===binding.order.authorityDigest&&hostAuthority.orderDigests.includes(measuredOrderDigest(binding.order));
+ const read=async()=>{await privateDirectory(binding.directory);const directoryStat=await lstat(binding.directory,{bigint:true});if(String(directoryStat.dev)!==binding.directoryDevice||String(directoryStat.ino)!==binding.directoryInode||(await readFile(p.binding,"utf8")).trimEnd()!==intentKey(binding))throw Error("measured order binding changed");await linked(binding);const handle=await pinnedJournal(binding);try{return parseJournal(await handle.readFile("utf8"));}finally{await handle.close();}};
+ const inspect=async()=>{const events=await read(),accounting=await openResourceBudget(binding.budget).inspect(),diagnostics=events.filter((e):e is Extract<JournalEvent,{type:"result"}>=>e.type==="result"&&e.state!=="completed").map(e=>`${e.attemptId}:${e.state}`);return freezeWork({version:"measured-order-view-v1",orderId:binding.order.orderId,nodes:project(binding.order,events,owner),resources:accounting,diagnostics,acceptance:"not-assessed",freshness:"snapshot-unknown" as const});};
+ return Object.freeze({inspect,async advance(){if(!authorized())throw Error("independent exact order authority required");await read();let selected:MeasuredOrderAttempt|undefined,claim:Extract<JournalEvent,{type:"claim"}>|undefined;
+  await withFileLock(p.journal,"measured order advance",async()=>{const handle=await pinnedJournal(binding,true);try{const events=parseJournal(await handle.readFile("utf8")),eligible=project(binding.order,events,owner).find(n=>n.state==="eligible");if(!eligible)return;selected=binding.order.nodes.flatMap(n=>n.attempts).find(a=>a.attemptId===eligible.attemptId)!;const base={type:"claim",sequence:events.length,previousDigest:events.at(-1)?.digest??null,attemptId:selected.attemptId,owner} as const;claim={...base,digest:hash(base)};await linked(binding);await handle.writeFile(intentKey(claim)+"\n");await handle.sync();}finally{await handle.close();}});
+  if(!selected||!claim)return inspect();const node=binding.order.nodes.find(n=>n.attempts.some(a=>a.attemptId===selected!.attemptId))!,index=node.attempts.findIndex(a=>a.attemptId===selected!.attemptId),controller=new AbortController();let state:Extract<JournalEvent,{type:"result"}>["state"]="failed",result:unknown=null,outputSha256:string|null=null;
+  try{const accounting=await openResourceBudget(binding.budget).inspect(),parent=[...node.attempts.slice(0,index)].reverse().find(a=>accounting.reservations.some(r=>r.attemptId===a.attemptId))??null,events=await read();let prompt=selected.prompt;if(selected.includeDependencies)for(const dependency of node.dependencies){const dependencyNode=binding.order.nodes.find(n=>n.nodeId===dependency)!,prior=dependencyNode.attempts.map(a=>events.find(e=>e.type==="result"&&e.attemptId===a.attemptId)).find((e):e is Extract<JournalEvent,{type:"result"}>=>e?.type==="result"&&e.state==="completed"),output=(prior?.result as {output?:unknown})?.output;if(!prior||typeof output!=="string"||hash(output)!==prior.outputSha256)throw Error("sealed dependency output unavailable");prompt+=`\n\n<sealed-dependency node=${JSON.stringify(dependency)} sha256=${JSON.stringify(prior.outputSha256)}>\n${output}\n</sealed-dependency>`;}
+   result=await runMeasuredAgentSession({budget:binding.budget,attempt:{attemptId:selected.attemptId,orderId:binding.order.orderId,experimentId:`${binding.order.orderId}:${node.nodeId}`,kind:parent?"retry":"primary",parentAttemptId:parent?.attemptId??null},model:selected.model,thinkingLevel:selected.thinkingLevel,prompt,deadlineMs:selected.deadlineMs,terminationGraceMs:selected.terminationGraceMs,maxRetainedOutputBytes:selected.maxRetainedOutputBytes,maxOutputTokens:selected.maxOutputTokens,signal:controller.signal},host);const qualified=qualifyMeasuredOutput((result as {output:string}).output,selected.qualification);outputSha256=qualified.outputSha256;state=qualified.eligible?"completed":"mismatch";}catch(error){result=error instanceof MeasuredSessionFailure?error.evidence:{errorType:error instanceof Error?error.name:"unknown",errorCode:typeof error==="object"&&error&&"code" in error?String(error.code):null,message:error instanceof Error?error.message:"unknown"};state=error instanceof MeasuredSessionUnknownError?"unknown":error instanceof MeasuredSessionFailure&&(error.evidence as {state?:string})?.state==="cancelled"?"cancelled":"failed";}
+  await appendJournal(binding,{type:"result",attemptId:selected.attemptId,owner:claim.owner,state,outputSha256,result} as Omit<JournalEvent,"sequence"|"previousDigest"|"digest">);return inspect();},
+  async acknowledgeUnknown(request:MeasuredOrderAcknowledgement,authority:MeasuredOrderAuthority|null){const digest=measuredOrderAcknowledgementDigest(request);if(authority?.authorityDigest!==binding.order.authorityDigest||!authority.acknowledgementDigests.includes(digest)||request.bindingDigest!==binding.digest)throw Error("independent exact acknowledgement authority required");await read();await withFileLock(p.journal,"measured order acknowledgement",async()=>{const handle=await pinnedJournal(binding,true);try{const events=parseJournal(await handle.readFile("utf8")),claim=events.find(e=>e.type==="claim"&&e.attemptId===request.attemptId) as Extract<JournalEvent,{type:"claim"}>|undefined,result=events.find(e=>e.type==="result"&&e.attemptId===request.attemptId) as Extract<JournalEvent,{type:"result"}>|undefined;if(!claim||claim.owner!==request.claimOwner||claim.digest!==request.claimDigest||!(result?.state==="unknown"||!result&&claim.owner!==owner)||events.some(e=>e.type==="acknowledge-unknown"&&e.request.attemptId===request.attemptId))throw Error("exact current unknown claim required");const base={type:"acknowledge-unknown",sequence:events.length,previousDigest:events.at(-1)!.digest,request} as const,record={...base,digest:hash(base)};await linked(binding);await handle.writeFile(intentKey(record)+"\n");await handle.sync();}finally{await handle.close();}});return inspect();}});
+}

package/src/measured-session.ts

@@ -0,0 +1,70 @@
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { createAgentSession, DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager } from '@earendil-works/pi-coding-agent';
+import { openResourceBudget, type AttemptDemand, type GovernedBudgetBinding } from './resource-budget.ts';
+import { freezeWork } from './work-ledger-json.ts';
+
+const MODELS=['openai-codex/gpt-5.6-sol','openai-codex/gpt-5.6-terra'] as const;
+const THINKING=['off','minimal','low','medium','high','xhigh','max'] as const;
+export interface ProviderUsage {input:number;output:number;cacheRead:number;cacheWrite:number;reasoning:number;totalTokens:number;cost:{input:number;output:number;cacheRead:number;cacheWrite:number;total:number}}
+export interface MeasuredSessionHostInput {model:typeof MODELS[number];thinkingLevel:typeof THINKING[number];prompt:string;deadlineMs:number;maxOutputTokens:number;tools:readonly [];discovery:'factory-only';signal:AbortSignal}
+export interface MeasuredSessionHostResult {output:string;usage:ProviderUsage;provider:'openai-codex';model:'gpt-5.6-sol'|'gpt-5.6-terra';stopReason:string}
+export interface MeasuredSessionHost {run(input:MeasuredSessionHostInput):Promise<MeasuredSessionHostResult>}
+export interface MeasuredSessionInput {budget:GovernedBudgetBinding;attempt:Omit<AttemptDemand,'inputBytes'|'inputDigest'>;model:typeof MODELS[number];thinkingLevel:typeof THINKING[number];prompt:string;deadlineMs:number;terminationGraceMs:number;maxRetainedOutputBytes:number;maxOutputTokens:number;signal?:AbortSignal}
+export class MeasuredSessionFailure extends Error {readonly evidence:unknown;constructor(message:string,evidence:unknown){super(message);this.name='MeasuredSessionFailure';this.evidence=evidence;}}
+export class MeasuredSessionUnknownError extends Error {constructor(){super('measured session did not settle after owned abort; reservation remains active');this.name='MeasuredSessionUnknownError';}}
+const finite=(value:unknown)=>typeof value==='number'&&Number.isFinite(value)&&value>=0;
+function checkedUsage(value:ProviderUsage):ProviderUsage {
+ if(!value||typeof value!=='object'||Object.keys(value).sort().join()!=='cacheRead,cacheWrite,cost,input,output,reasoning,totalTokens'||![value.input,value.output,value.cacheRead,value.cacheWrite,value.reasoning,value.totalTokens].every(finite)||!Number.isSafeInteger(value.totalTokens)||!value.cost||Object.keys(value.cost).sort().join()!=='cacheRead,cacheWrite,input,output,total'||!Object.values(value.cost).every(finite))throw Error('provider usage unavailable or malformed');
+ return JSON.parse(JSON.stringify(value));
+}
+function checked(input:MeasuredSessionInput):MeasuredSessionInput {
+ if(!input||typeof input!=='object'||!MODELS.includes(input.model)||!THINKING.includes(input.thinkingLevel))throw Error('measured sessions require exact Codex Sol or Terra');
+ if(typeof input.prompt!=='string'||!input.prompt.length||Buffer.byteLength(input.prompt)>65536||!Number.isSafeInteger(input.deadlineMs)||input.deadlineMs<1000||input.deadlineMs>300000||!Number.isSafeInteger(input.terminationGraceMs)||input.terminationGraceMs<100||input.terminationGraceMs>10000||!Number.isSafeInteger(input.maxRetainedOutputBytes)||input.maxRetainedOutputBytes<1||input.maxRetainedOutputBytes>1024*1024||!Number.isSafeInteger(input.maxOutputTokens)||input.maxOutputTokens<1||input.maxOutputTokens>16384)throw Error('invalid measured session bounds');
+ if(input.signal?.aborted)throw new MeasuredSessionFailure('measured session cancelled before reservation',{state:'cancelled-before-reservation',reason:'caller-signal'});
+ return input;
+}
+/** Opt-in one-prompt route. Existing resource budgets own attempts; byte retention is checked after generation. */
+export async function runMeasuredAgentSession(raw:MeasuredSessionInput,host:MeasuredSessionHost){
+ const input=checked(raw),bytes=Buffer.from(input.prompt),budget=openResourceBudget(input.budget),permit=await budget.reserve({...input.attempt,inputBytes:bytes.length,inputDigest:createHash('sha256').update(bytes).digest('hex')});
+ const controller=new AbortController(),abort=()=>controller.abort(input.signal?.reason??'operator-cancellation');input.signal?.addEventListener('abort',abort,{once:true});if(input.signal?.aborted)abort();
+ const timer=setTimeout(()=>controller.abort('deadline'),input.deadlineMs);let outcome:'completed'|'failed'|'cancelled'|null='failed';
+ try{
+  const unknown=new Promise<never>((_,reject)=>controller.signal.addEventListener('abort',()=>setTimeout(()=>reject(new MeasuredSessionUnknownError()),input.terminationGraceMs),{once:true}));
+  if(controller.signal.aborted)throw new MeasuredSessionFailure('measured session cancelled after reservation',{state:'cancelled-before-host',reason:'caller-signal'});
+  const running=host.run({model:input.model,thinkingLevel:input.thinkingLevel,prompt:input.prompt,deadlineMs:input.deadlineMs,maxOutputTokens:input.maxOutputTokens,tools:[],discovery:'factory-only',signal:controller.signal});
+  const result=await Promise.race([running,unknown]);
+  const outputBytes=Buffer.from(result.output),outputEvidence={sha256:createHash('sha256').update(outputBytes).digest('hex'),bytes:outputBytes.length,retainedPrefix:outputBytes.subarray(0,input.maxRetainedOutputBytes).toString('utf8')};
+  let usage:ProviderUsage;try{usage=checkedUsage(result.usage);}catch(error){throw new MeasuredSessionFailure(String(error),{state:'failed',model:result.model,stopReason:result.stopReason,output:outputEvidence});}
+  if(result.provider!=='openai-codex'||`${result.provider}/${result.model}`!==input.model)throw new MeasuredSessionFailure('measured model identity mismatch',{state:'failed',observedProvider:result.provider,observedModel:result.model,stopReason:result.stopReason,output:outputEvidence,usage});
+  if(outputEvidence.bytes>input.maxRetainedOutputBytes)throw new MeasuredSessionFailure('measured retained-output bound exceeded',{state:'failed',model:input.model,stopReason:result.stopReason,output:outputEvidence,usage});
+  if(controller.signal.aborted||result.stopReason!=='stop')throw new MeasuredSessionFailure('measured assistant did not stop cleanly',{state:controller.signal.aborted?'cancelled':'failed',model:input.model,stopReason:result.stopReason,output:outputEvidence,usage});
+  outcome='completed';return freezeWork({version:'measured-session-result-v1',state:'completed',model:input.model,thinkingLevel:input.thinkingLevel,output:result.output,usage,stopReason:result.stopReason,acceptance:'not-assessed',grantExpansion:false});
+ }catch(error){
+  if(error instanceof MeasuredSessionUnknownError){outcome=null;throw error;}
+  if(controller.signal.aborted)outcome='cancelled';
+  if(error instanceof MeasuredSessionFailure)throw error;
+  throw new MeasuredSessionFailure('measured host failed',{state:controller.signal.aborted?'cancelled':'failed',errorType:error instanceof Error?error.name:'unknown'});
+ }
+ finally{clearTimeout(timer);input.signal?.removeEventListener('abort',abort);if(outcome)await permit.settle(outcome);}
+}
+export interface MeasuredAuthRuntime {isUsingOAuth(provider:string):boolean;isUsingSubscription(provider:string):boolean;checkAuth(provider:string,options?:{signal?:AbortSignal}):Promise<{type:string}|undefined>}
+export async function verifyMeasuredSubscription(runtime:MeasuredAuthRuntime,signal?:AbortSignal){
+ signal?.throwIfAborted();const auth=await runtime.checkAuth('openai-codex',{signal});signal?.throwIfAborted();
+ if(auth?.type!=='oauth'||!runtime.isUsingOAuth('openai-codex')||!runtime.isUsingSubscription('openai-codex'))throw Error('exact OpenAI Codex OAuth subscription authorization required');
+}
+/** Concrete SDK host: in-memory session/settings, empty discovery roots, no tools, one factory-named inline extension. */
+export function piSdkMeasuredSessionHost():MeasuredSessionHost{return{async run(input){
+ const root=await mkdtemp(join(resolve(process.env.TMPDIR??'/tmp'),'pi-daddy-measured-'));let session:Awaited<ReturnType<typeof createAgentSession>>['session']|undefined;
+ try{
+  const agentDir=join(root,'agent');await mkdir(agentDir,{mode:0o700});const settings=SettingsManager.inMemory({compaction:{enabled:false},retry:{enabled:false,maxRetries:0}});
+  const loader=new DefaultResourceLoader({cwd:root,agentDir,settingsManager:settings,systemPromptOverride:()=> 'Follow the supplied bounded task. Do not use tools or claim acceptance.',agentsFilesOverride:()=>({agentsFiles:[],diagnostics:[]}),skillsOverride:()=>({skills:[],diagnostics:[]}),promptsOverride:()=>({prompts:[],diagnostics:[]}),extensionFactories:[{name:'pi-daddy-measured-session',factory:()=>{}}]});await loader.reload();
+  input.signal.throwIfAborted();const runtime=await ModelRuntime.create({signal:input.signal});input.signal.throwIfAborted();await verifyMeasuredSubscription(runtime,input.signal);input.signal.throwIfAborted();
+  const [provider,modelId]=input.model.split('/'),found=runtime.getModel(provider,modelId);if(!found)throw Error('requested measured model unavailable');
+  const created=await createAgentSession({cwd:root,agentDir,model:{...found,maxTokens:input.maxOutputTokens},thinkingLevel:input.thinkingLevel,modelRuntime:runtime,resourceLoader:loader,sessionManager:SessionManager.inMemory(root),settingsManager:settings,noTools:'all'});session=created.session;if(created.extensionsResult.errors.length)throw Error('factory-only extension load failed');
+  const abort=()=>void session!.abort();input.signal.addEventListener('abort',abort,{once:true});try{if(input.signal.aborted){await session.abort();throw input.signal.reason;}await session.prompt(input.prompt,{expandPromptTemplates:false});}finally{input.signal.removeEventListener('abort',abort);}
+  const message=[...session.messages].reverse().find(m=>m.role==='assistant');if(!message)throw Error('measured assistant result unavailable');
+  return {output:message.content.filter(c=>c.type==='text').map(c=>c.text).join(''),usage:message.usage as ProviderUsage,provider:message.provider as MeasuredSessionHostResult['provider'],model:message.model as MeasuredSessionHostResult['model'],stopReason:message.stopReason};
+ }finally{session?.dispose();await rm(root,{recursive:true,force:true});}
+}};}