pi-daddy 0.27.4 → 0.32.0

package/src/ledger.ts

@@ -1,369 +0,0 @@
-/**
- * Append-only grant ledger.
- *
- * Exists because pi-fabric's persisted execution trace records `args: {}` — it captures *that* a child
- * ran, not *what it was authorised to do* (docs/probes/pi-fabric-eval probe 5). Without this record
- * you cannot answer "what was this sub-agent permitted to do?" after the fact, which is the whole
- * point of a governance layer.
- *
- * `denied` is the field that earns the file: an agent repeatedly requesting capabilities it does not
- * hold is an escalation attempt, and it is invisible without a record.
- *
- * PRIVACY: capability ids, counts, and identifiers only. Never prompts, tool arguments, or results.
- *
- * ADR-0018 makes the boundary explicit rather than leaving it to be inferred, because a record now carries
- * something about the child's instructions. **`definitionDigest` is an identifier**: a SHA-256 of an
- * operator-authored file already committed to a repository, which names a version without reproducing it.
- * **The task is not recorded, anywhere, ever** — it is assembled by the model from the parent's context and
- * can carry anything the parent could see, so a ledger holding it would be a secrets sink. That half of
- * "what was this child told to do?" is out of the ledger by decision, not by omission.
- */
-
-import { readFile } from "node:fs/promises";
-import { appendLedgerLine } from "./ledger-append.ts";
-import type { Capability, ResolveResult } from "./resolve.ts";
-import type { ExecutorKind } from "./executor.ts";
-import type { DefinitionDigest } from "./definitions.ts";
-import { DELEGATE_SUBJECT } from "./approval.ts";
-import type { ApprovalScope, ApprovalSource } from "./approval.ts";
-import type { PromptOutcomeKind } from "./approval-prompt.ts";
-import type { CorrelationMetadata } from "./correlation.ts";
-import type { StructuredRefusal } from "./refusals.ts";
-// Type-only, so the cycle with ./ledger-events.ts is erased at runtime.
-import type { RuntimeLedgerEvent } from "./ledger-events.ts";
-import { assertExecutionId } from "./execution-id.ts";
-import { assertLedgerV3Wire } from "./ledger-v3-validation.ts";
-
-export const LEDGER_VERSION = 3 as const;
-export const LEDGER_EVENT_KINDS = [
-  "capability_decision", "workspace_lease", "child_lifecycle", "check_receipt", "workflow_fact",
-] as const;
-export type LedgerEventKind = typeof LEDGER_EVENT_KINDS[number];
-export const LEDGER_GATE_OUTCOMES = ["declined", "dismissed", "no-ui", "error"] as const;
-export type LedgerGateOutcome = typeof LEDGER_GATE_OUTCOMES[number];
-
-export interface LedgerEventBase {
-  /** Optional only on the legacy-compatible `GrantRecord` public type; every v3 event builder writes it. */
-  ledgerVersion?: typeof LEDGER_VERSION;
-  event?: LedgerEventKind;
-  ts: string;
-  /** Unique execution occurrence. Optional only for legacy, unversioned GrantRecord values. */
-  executionId?: string;
-  /** Explicit execution parent; null means the delegating session is not itself a governed child. */
-  parentExecutionId?: string | null;
-  childId?: string;
-  correlation?: CorrelationMetadata;
-}
-
-export interface GrantRecord extends LedgerEventBase {
-  /**
-   * Present only when a trusted `taskDigest` was supplied — that is what makes a line v3. `buildRecord`
-   * does NOT always emit it, and the comment here used to say it did while the emission site 200 lines
-   * down said the opposite. Two comments asserting contradictory facts about one field is R-28's shape.
-   */
-  event?: "capability_decision";
-  parentId: string;
-  childId: string;
-  depth: number;
-  agentType?: string;
-  requested: Capability[];
-  parentGrant: Capability[];
-  effective: Capability[];
-  denied: Capability[];
-  clipped: Capability[];
-  gatedBlocked: Capability[];
-  /** True when the spawn was refused outright rather than narrowed. */
-  blocked: boolean;
-  /** Present when the spawn was refused, or when resolution failed. */
-  reason?: string;
-  /**
-   * Gated capabilities satisfied for this spawn.
-   *
-   * The ledger used to have ONE flavour of no. It now has three, and they call for different responses:
-   *  - `denied` non-empty            -> an agent asked for more than it holds. ESCALATION ATTEMPT.
-   *  - `humanDenied`                 -> a person was asked and said no. WORKING AS DESIGNED.
-   *  - `gatedBlocked` with no source -> nobody was there to ask. A background run hit a gate; the fix is
-   *                                     an operator pre-approving it, not an incident.
-   */
-  approved?: Capability[];
-  approvalSource?: ApprovalSource;
-  /**
-   * WHERE each approved capability's yes came from — one entry per capability (R-46).
-   *
-   * `approvalSource` above is a single scalar and was written for a set: gate `tool:bash` and `tool:write`,
-   * let a persisted entry cover `bash` while a human clicks *Allow once* for `write`, and the record read
-   * `approved: ["tool:bash","tool:write"], approvalSource: "prompt"` — **asserting a human was asked about
-   * `tool:bash`, which they were not.** The ledger's whole job is answering "did a human authorise this?",
-   * so over-claiming in that direction is the worst available failure.
-   *
-   * The scalar is kept and is now written **only when every approved capability shares one source**, so a
-   * reader of old and new lines alike can trust it; when sources differ it is omitted and this map carries
-   * the truth. Two fields, one of which is a safe summary of the other — not two competing answers.
-   */
-  approvalSources?: Record<Capability, ApprovalSource>;
-  /**
-   * How far each prompted capability's yes reaches (F5). Same shape and same reason as `approvalSources`:
-   * `approvalScope` below is a **derived summary**, emitted only when every prompted capability shares one
-   * scope. This field decides propagation — `inheritApprovals` drops `once` — so a scalar that described
-   * one capability while claiming to describe the set was not merely a reporting defect.
-   */
-  approvalScopes?: Record<Capability, ApprovalScope>;
-  /** Persisted approval expiry, by capability. Session-scoped approvals have no wall-clock expiry. */
-  approvalExpiresAt?: Record<Capability, string>;
-  /** Count bounds where one exists. A consumed `once` approval records `{max:1, remaining:0}`. */
-  approvalUses?: Record<Capability, { max: number; remaining: number }>;
-  /** Present only when the source was a live prompt, and only when one scope covers the whole set. */
-  approvalScope?: ApprovalScope;
-  /** A human was asked and declined. Distinct from `denied`, which is an escalation attempt. */
-  humanDenied?: true;
-  /**
-   * WHY a gate went unsatisfied, when the answer was not a yes.
-   *
-   * `PromptOutcomeKind` has five members and this record kept exactly one of them (`humanDenied`, from
-   * `declined`). So `no-ui`, `dismissed` (a timeout or an abort) and `error` produced **identical** records
-   * — `gatedBlocked` non-empty, no `approvalSource`, `blocked: true` — and the only thing separating them
-   * was free-text `reason`, written for a human at the call site. Given a failed run, *"was there an
-   * operator who timed out, or was there nobody to ask?"* was not answerable from any field, and the fix
-   * for each is different: one is a queue or a longer `PI_GRANTS_APPROVAL_TIMEOUT`, the other is an
-   * operator pre-approving.
-   *
-   * The discriminant was already computed and thrown away. ADR-0026 leans on this vocabulary being able to
-   * say *"nobody was there to ask"* and be believed, so it is recorded rather than inferred.
-   *
-   * **Privacy is unchanged**: this is a fixed five-member enum, not text — nothing model-authored, nothing
-   * a task could carry. The prompt has five outcomes, but `granted` is deliberately omitted from the
-   * four-member ledger enum because the approval source/scope fields already record a yes.
-   */
-  gateOutcome?: LedgerGateOutcome;
-  /**
-   * WHICH operator-authored instructions this child was given (ADR-0018).
-   *
-   * Identifies, never reproduces: matching digests prove two children ran the same text, and a digest that
-   * no longer matches the file proves the definition changed since. **It says nothing about whether those
-   * instructions were correct or whether the child obeyed them** — it identifies text, it does not evaluate
-   * it. Absent for a `tools:`-style delegation, which has no definition.
-   */
-  definitionDigest?: DefinitionDigest;
-  /**
-   * WHERE this child ran — ADR-0031.
-   *
-   * **Required rather than optional**, which is unusual in this record and deliberate. Before ADR-0031 the
-   * executor was a variable an operator set, so "which one ran?" was answerable from configuration after the
-   * fact. It is now decided by a **runtime probe** at session start, so nothing outside the record preserves
-   * the answer — and the two paths do not produce the same argv, because the herdr plan withholds `--print`
-   * (`delegationContext.interactive`). A trail that cannot say where a child ran cannot be read back
-   * reliably, and reading it back is the only reason it exists.
-   *
-   * Written on refusals too, including the tripwire's: the honest value there is the executor the session
-   * *would* have used, because a refused spawn has no executor of its own.
-   */
-  executor: ExecutorKind;
-  /**
-   * The child whose OUTPUT composed this child's task — ADR-0033.
-   *
-   * **Optional, unlike `executor`, and the asymmetry is deliberate.** A non-chained spawn has no prior author, and
-   * an empty string would assert one. Present only on chain steps after the first.
-   *
-   * Why it is recorded at all: a chain makes step N's task the output of a governed child, and ADR-0033's chosen
-   * handoff is *framing* rather than enforcement. So "who wrote this instruction?" is exactly the question that
-   * decision makes worth asking, and it is unanswerable from any other field — `agentType` names the definition,
-   * `definitionDigest` names its instructions, and neither says where the TASK came from.
-   */
-  taskFrom?: string;
-  /** Unique occurrence whose output composed this task; taskFrom remains the readable logical position. */
-  taskFromExecutionId?: string;
-  /** Trusted SHA-256 of the exact task; task text remains forbidden (ADR-0034). */
-  taskDigest?: string;
-  /** Stable machine-readable refusal accompanying `reason`. */
-  refusal?: StructuredRefusal;
-}
-
-export interface LedgerOptions {
-  /** Path to the JSONL file. Parent directories are created on demand. */
-  path: string;
-  /**
-   * When true, a ledger write failure throws instead of being swallowed.
-   *
-   * Default is `true` and that is deliberate: for a security control, an unrecorded grant should fail
-   * closed. Set false only where the ledger is advisory.
-   */
-  strict?: boolean;
-  /**
-   * Called when a NON-strict append failed. Required in spirit rather than in types: a caller that opts
-   * out of failing closed still has to say something, or the ledger silently develops holes.
-   */
-  onFailure?: (error: unknown) => void;
-}
-
-export function buildRecord(args: {
-  /** Required whenever taskDigest makes this an explicit v3 event. */
-  executionId?: string;
-  /** Required (including explicit null) whenever taskDigest makes this an explicit v3 event. */
-  parentExecutionId?: string | null;
-  parentId: string;
-  childId: string;
-  depth: number;
-  agentType?: string;
-  requested: Capability[];
-  parentGrant: Capability[];
-  result: ResolveResult;
-  blocked: boolean;
-  reason?: string;
-  approved?: Capability[];
-  approvalSources?: Record<Capability, ApprovalSource>;
-  approvalScopes?: Record<Capability, ApprovalScope>;
-  approvalExpiresAt?: Record<Capability, string>;
-  approvalUses?: Record<Capability, { max: number; remaining: number }>;
-  humanDenied?: boolean;
-  gateOutcome?: PromptOutcomeKind;
-  definitionDigest?: DefinitionDigest;
-  /** Where the child ran (ADR-0031). Required: the probe's answer survives nowhere else. */
-  executor: ExecutorKind;
-  /** The logical child whose output composed this task (ADR-0033). */
-  taskFrom?: string;
-  /** The unique occurrence whose output composed this task. */
-  taskFromExecutionId?: string;
-  taskDigest?: string;
-  correlation?: CorrelationMetadata;
-  refusal?: StructuredRefusal;
-  now: Date;
-}): GrantRecord {
-  if (args.taskDigest !== undefined) {
-    if (!/^[a-f0-9]{64}$/i.test(args.taskDigest)) throw new TypeError("taskDigest must be a SHA-256 hex digest");
-    assertExecutionId(args.executionId);
-    if (args.parentExecutionId !== null) assertExecutionId(args.parentExecutionId, "parentExecutionId");
-    if (args.parentExecutionId === args.executionId) throw new TypeError("an execution cannot be its own parent");
-    if (args.taskFromExecutionId !== undefined) assertExecutionId(args.taskFromExecutionId, "taskFromExecutionId");
-  }
-  if (args.definitionDigest && !/^[a-f0-9]{64}$/i.test(args.definitionDigest.sha256)) {
-    throw new TypeError("definitionDigest.sha256 must be a SHA-256 hex digest");
-  }
-  // R-46: the scalar is a SUMMARY, emitted only when it cannot mislead. `buildRecord` derives it rather
-  // than accepting it, so a call site cannot supply one that disagrees with the map beside it.
-  const sources = args.approvalSources ?? {};
-  const distinct = [...new Set(Object.values(sources))];
-  const scopes = args.approvalScopes ?? {};
-  const distinctScopes = [...new Set(Object.values(scopes))];
-  const record: GrantRecord = {
-    // A trusted task digest is what distinguishes a v3 capability event from the legacy construction API.
-    // Production delegation always supplies it; old TypeScript callers remain able to append legacy lines.
-    ...(args.taskDigest !== undefined
-      ? {
-          ledgerVersion: LEDGER_VERSION,
-          event: "capability_decision" as const,
-          executionId: args.executionId,
-          parentExecutionId: args.parentExecutionId,
-        }
-      : {}),
-    ts: args.now.toISOString(),
-    parentId: args.parentId,
-    childId: args.childId,
-    depth: args.depth,
-    agentType: args.agentType,
-    executor: args.executor,
-    ...(args.taskFrom ? { taskFrom: args.taskFrom } : {}),
-    ...(args.taskFromExecutionId ? { taskFromExecutionId: args.taskFromExecutionId } : {}),
-    ...(args.taskDigest !== undefined ? { taskDigest: args.taskDigest } : {}),
-    ...(args.correlation ? { correlation: structuredClone(args.correlation) } : {}),
-    ...(args.refusal ? { refusal: structuredClone(args.refusal) } : {}),
-    requested: args.requested,
-    parentGrant: args.parentGrant,
-    effective: args.result.effective,
-    denied: args.result.denied,
-    clipped: args.result.clipped,
-    gatedBlocked: args.result.gatedBlocked,
-    blocked: args.blocked,
-    reason: args.reason,
-    ...(args.approved && args.approved.length > 0 ? { approved: args.approved } : {}),
-    ...(distinct.length === 1 ? { approvalSource: distinct[0] } : {}),
-    ...(Object.keys(sources).length > 0 ? { approvalSources: sources } : {}),
-    ...(distinctScopes.length === 1 ? { approvalScope: distinctScopes[0] } : {}),
-    ...(Object.keys(scopes).length > 0 ? { approvalScopes: scopes } : {}),
-    ...(args.approvalExpiresAt && Object.keys(args.approvalExpiresAt).length > 0
-      ? { approvalExpiresAt: args.approvalExpiresAt }
-      : {}),
-    ...(args.approvalUses && Object.keys(args.approvalUses).length > 0 ? { approvalUses: args.approvalUses } : {}),
-    ...(args.humanDenied ? { humanDenied: true } : {}),
-    // Written whenever a gate was reached and not satisfied by a yes. `granted` is omitted deliberately —
-    // an approved spawn already says so through `approvalSources`, and a field that appears on every record
-    // stops being a signal.
-    ...(args.gateOutcome && args.gateOutcome !== "granted" ? { gateOutcome: args.gateOutcome } : {}),
-    ...(args.definitionDigest ? { definitionDigest: args.definitionDigest } : {}),
-  };
-  if (args.taskDigest !== undefined) assertLedgerV3Wire(record);
-  return record;
-}
-
-// R-49: the lock moved to `src/file-lock.ts` so the approvals store could use the SAME one rather than
-// grow a second copy. Re-exported because `./ledger` is a published subpath and these were part of it.
-export { LOCK_TIMEOUT_MS, STALE_LOCK_MS } from "./file-lock.ts";
-
-// The reading half, split out under the file-size guard and re-exported so `./ledger` is unchanged for
-// anyone importing it. See `ledger-report.ts` for why the seam is where it is.
-export { verifyLedger, type LedgerReport } from "./ledger-report.ts";
-
-/**
- * Serialise appends across processes.
- *
- * **Why the ledger needs it.** For most of this package's life cardinality was bounded to one by `delegate`
- * being blocking, so there was never a second writer. Fan-out removes that: `ENV_LEDGER` propagates to
- * children, so a subtree can have many processes appending to one file.
- *
- * A ledger write that cannot take the lock **fails the delegation closed** — see `appendRecord`'s `strict`
- * — because a child running with granted capabilities and no audit line is what the ledger exists to
- * prevent. That is the opposite of what the approvals store does with the same lock, and deliberately so.
- */
-export async function appendLedgerEvent(options: LedgerOptions, event: RuntimeLedgerEvent | GrantRecord): Promise<void> {
-  const line = `${JSON.stringify(event)}\n`;
-  try {
-    await appendLedgerLine(options, line);
-  } catch (error) {
-    if (options.strict ?? true) {
-      throw new Error(`grant ledger write failed (failing closed): ${String(error)}`);
-    }
-    // A non-strict append is a deliberate choice not to fail closed. It is NOT a choice to be silent:
-    // a silent safe-mode is as confusing as a silent unsafe one, so the caller is always told.
-    options.onFailure?.(error);
-  }
-}
-
-export async function appendRecord(options: LedgerOptions, record: GrantRecord): Promise<void> {
-  return appendLedgerEvent(options, record);
-}
-
-/** True when this record shows an agent asking for more than it holds. */
-export function isEscalationAttempt(record: GrantRecord): boolean {
-  return record.denied.length > 0;
-}
-
-export {
-  CHILD_LIFECYCLE_STATES,
-  CHILD_PROCESS_SIGNALS,
-  WORKSPACE_ACCESSES,
-  WORKSPACE_LEASE_OUTCOMES,
-  WORKSPACE_RECOVERY_VALUES,
-  buildCheckReceiptLedgerEvent,
-  buildChildLifecycleEvent,
-  buildWorkspaceLeaseEvent,
-  type CapabilityDecisionEvent,
-  type ChildLifecycleEvent,
-  type ChildLifecycleState,
-  type ChildProcessSignal,
-  type CheckReceiptLedgerEvent,
-  type RuntimeLedgerEvent,
-  type WorkspaceAccess,
-  type WorkspaceLeaseEvent,
-  type WorkspaceLeaseOutcome,
-  type WorkspaceRecovery,
-} from "./ledger-events.ts";
-
-export {
-  WORKFLOW_FACT_KINDS,
-  WORKFLOW_FACT_PROVENANCE,
-  WORKFLOW_FACT_STATES,
-  buildWorkflowFactEvent,
-  type WorkflowFactEvent,
-  type WorkflowFactKind,
-  type WorkflowFactProvenance,
-  type WorkflowFactState,
-} from "./workflow-facts.ts";

package/src/measured-order.ts

@@ -1,72 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { constants } from "node:fs";
-import { mkdir, open, readFile, realpath, lstat, writeFile } from "node:fs/promises";
-import { isAbsolute, join, resolve } from "node:path";
-import { withFileLock } from "./file-lock.ts";
-import { intentKey } from "./intent-control.ts";
-import { runMeasuredAgentSession, MeasuredSessionFailure, MeasuredSessionUnknownError, type MeasuredSessionHost, type MeasuredSessionInput } from "./measured-session.ts";
-import { openResourceBudget, resourceBindingDigest, type GovernedBudgetBinding } from "./resource-budget.ts";
-import { freezeWork } from "./work-ledger-json.ts";
-
-const ID=/^[a-zA-Z0-9:_-]{1,128}$/,HEX=/^[a-f0-9]{64}$/;
-const hash=(value:unknown)=>createHash("sha256").update(typeof value==="string"?value:intentKey(value)).digest("hex");
-const exact=(value:object,keys:string[])=>Object.keys(value).sort().join()===keys.sort().join();
-type JournalJson=null|boolean|number|string|JournalJson[]|{[key:string]:JournalJson};
-class JournalSerializationError extends Error {constructor(){super("invalid measured order journal value");this.name="JournalSerializationError";}}
-/** Result evidence is not work/intent input: provider money is finite decimal Number data, not an integer schema field. */
-function journalKey(value:unknown):string{try{const ancestors=new Set<object>();const copy=(v:unknown,depth:number):JournalJson=>{if(v===null||typeof v==="boolean"||typeof v==="string")return v;if(typeof v==="number"){if(Number.isFinite(v))return v;throw new JournalSerializationError();}if(!v||typeof v!=="object"||depth>16||ancestors.has(v))throw new JournalSerializationError();ancestors.add(v);let result:JournalJson;if(Array.isArray(v)){if(Object.getPrototypeOf(v)!==Array.prototype||v.length>256)throw new JournalSerializationError();const fields=Object.getOwnPropertyDescriptors(v);if(Reflect.ownKeys(fields).length!==v.length+1)throw new JournalSerializationError();result=[];for(let i=0;i<v.length;i++){const field=fields[String(i)];if(!field||!Object.hasOwn(field,"value")||!field.enumerable)throw new JournalSerializationError();result.push(copy(field.value,depth+1));}}else{if(Object.getPrototypeOf(v)!==Object.prototype&&Object.getPrototypeOf(v)!==null)throw new JournalSerializationError();const fields=Object.getOwnPropertyDescriptors(v),object:Record<string,JournalJson>=Object.create(null);for(const key of Reflect.ownKeys(fields)){if(typeof key!=="string")throw new JournalSerializationError();const field=fields[key];if(!Object.hasOwn(field,"value")||!field.enumerable)throw new JournalSerializationError();Object.defineProperty(object,key,{value:copy(field.value,depth+1),enumerable:true});}result=object;}ancestors.delete(v);return result;},emit=(v:JournalJson):string=>v===null||typeof v!=="object"?JSON.stringify(v):Array.isArray(v)?`[${v.map(emit).join(",")}]`:`{${Object.keys(v).sort().map(key=>`${JSON.stringify(key)}:${emit(v[key])}`).join(",")}}`;return emit(copy(value,1));}catch(error){if(error instanceof JournalSerializationError)throw error;throw new JournalSerializationError();}}
-const journalHash=(value:unknown)=>createHash("sha256").update(journalKey(value)).digest("hex");
-export type MeasuredOutputContract={version:"measured-output-exact-v1";expectedSha256:string}|{version:"measured-output-json-projection-v1";requiredKeys:string[];textFields:string[];arrayField:string;minItems:number;maxItems:number;itemRequiredFields:string[];projectionFields:string[];expectedProjectionSha256:string};
-export interface MeasuredOrderAttempt extends Omit<MeasuredSessionInput,"budget"|"attempt"|"signal">{attemptId:string;includeDependencies:boolean;qualification:MeasuredOutputContract}
-export interface MeasuredOrderNode {nodeId:string;dependencies:string[];attempts:MeasuredOrderAttempt[]}
-export interface MeasuredOrder {version:"measured-order-v1";orderId:string;authorityDigest:string;budgetDigest:string;nodes:MeasuredOrderNode[]}
-export interface MeasuredOrderBinding {version:"measured-order-binding-v1";directory:string;directoryDevice:string;directoryInode:string;journalDevice:string;journalInode:string;budget:GovernedBudgetBinding;order:MeasuredOrder;digest:string}
-export interface MeasuredOrderAuthority {authorityDigest:string;orderDigests:string[];acknowledgementDigests:string[]}
-export interface MeasuredOrderAcknowledgement {version:"measured-order-ack-v1";requestId:string;bindingDigest:string;attemptId:string;claimOwner:string;claimDigest:string}
-type JournalEvent=
- |{type:"claim";sequence:number;previousDigest:string|null;attemptId:string;owner:string;digest:string}
- |{type:"result";sequence:number;previousDigest:string;attemptId:string;owner:string;state:"completed"|"failed"|"cancelled"|"unknown"|"mismatch";outputSha256:string|null;result:unknown;digest:string}
- |{type:"acknowledge-unknown";sequence:number;previousDigest:string;request:MeasuredOrderAcknowledgement;digest:string};
-export interface MeasuredOrderNodeView {nodeId:string;state:"eligible"|"dependency-blocked"|"running"|"unknown"|"exhausted"|"satisfied";action:"dispatch"|"wait"|"acknowledge"|"none";attemptId:string|null;outputSha256:string|null;unknownClaim:{owner:string;digest:string}|null}
-function field(value:unknown):value is string{return typeof value==="string"&&/^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(value);}
-function checkedContract(input:MeasuredOutputContract):MeasuredOutputContract{const c=JSON.parse(intentKey(input)) as MeasuredOutputContract;if(c.version==="measured-output-exact-v1"){if(!exact(c,["version","expectedSha256"])||!HEX.test(c.expectedSha256))throw Error("invalid exact output contract");return c;}if(c.version!=="measured-output-json-projection-v1"||!exact(c,["version","requiredKeys","textFields","arrayField","minItems","maxItems","itemRequiredFields","projectionFields","expectedProjectionSha256"])||![c.requiredKeys,c.textFields,c.itemRequiredFields,c.projectionFields].every(x=>Array.isArray(x)&&x.length<=32&&new Set(x).size===x.length&&x.every(field))||!field(c.arrayField)||!Number.isSafeInteger(c.minItems)||!Number.isSafeInteger(c.maxItems)||c.minItems<0||c.maxItems<c.minItems||c.maxItems>4096||!c.requiredKeys.includes(c.arrayField)||c.textFields.some(x=>!c.requiredKeys.includes(x))||c.projectionFields.some(x=>!c.itemRequiredFields.includes(x))||!HEX.test(c.expectedProjectionSha256))throw Error("invalid deterministic JSON output contract");return c;}
-export function qualifyMeasuredOutput(output:string,input:MeasuredOutputContract){const contract=checkedContract(input),outputSha256=hash(output);if(contract.version==="measured-output-exact-v1")return{eligible:outputSha256===contract.expectedSha256,outputSha256,projectionSha256:null};let value:unknown;try{value=JSON.parse(output);}catch{return{eligible:false,outputSha256,projectionSha256:null};}if(!value||typeof value!=="object"||Array.isArray(value)||Object.keys(value).sort().join()!==[...contract.requiredKeys].sort().join())return{eligible:false,outputSha256,projectionSha256:null};const object=value as Record<string,unknown>,items=object[contract.arrayField];if(contract.textFields.some(x=>typeof object[x]!=="string"||!(object[x] as string).trim())||!Array.isArray(items)||items.length<contract.minItems||items.length>contract.maxItems||items.some(x=>!x||typeof x!=="object"||Array.isArray(x)||contract.itemRequiredFields.some(k=>!Object.hasOwn(x,k))))return{eligible:false,outputSha256,projectionSha256:null};const projection=(items as Record<string,unknown>[]).map(item=>Object.fromEntries(contract.projectionFields.map(k=>[k,item[k]]))),projectionSha256=hash(intentKey(projection));return{eligible:projectionSha256===contract.expectedProjectionSha256,outputSha256,projectionSha256};}
-
-function checkedOrder(input:MeasuredOrder,budget:GovernedBudgetBinding):MeasuredOrder{
- const order=JSON.parse(intentKey(input)) as MeasuredOrder;if(!exact(order,["version","orderId","authorityDigest","budgetDigest","nodes"])||order.version!=="measured-order-v1"||!ID.test(order.orderId)||!HEX.test(order.authorityDigest)||order.budgetDigest!==resourceBindingDigest(budget)||!Array.isArray(order.nodes)||!order.nodes.length||order.nodes.length>8)throw Error("invalid bounded measured order");
- const ids=new Set<string>(),attempts=new Set<string>();let inputBytes=0,count=0;
- for(const node of order.nodes){if(!exact(node,["nodeId","dependencies","attempts"])||!ID.test(node.nodeId)||ids.has(node.nodeId)||!Array.isArray(node.dependencies)||node.dependencies.length>8||new Set(node.dependencies).size!==node.dependencies.length||!Array.isArray(node.attempts)||!node.attempts.length||node.attempts.length>3)throw Error("invalid node/dependency/recovery policy");ids.add(node.nodeId);
-  for(const a of node.attempts){if(!exact(a,["attemptId","model","thinkingLevel","prompt","deadlineMs","terminationGraceMs","maxRetainedOutputBytes","maxOutputTokens","includeDependencies","qualification"])||!ID.test(a.attemptId)||attempts.has(a.attemptId)||typeof a.includeDependencies!=="boolean"||!["openai-codex/gpt-5.6-sol","openai-codex/gpt-5.6-terra"].includes(a.model)||typeof a.prompt!=="string"||!a.prompt.length||Buffer.byteLength(a.prompt)>16384||!Number.isSafeInteger(a.deadlineMs)||a.deadlineMs<1000||a.deadlineMs>300000||!Number.isSafeInteger(a.terminationGraceMs)||a.terminationGraceMs<100||a.terminationGraceMs>10000||!Number.isSafeInteger(a.maxRetainedOutputBytes)||a.maxRetainedOutputBytes<1||a.maxRetainedOutputBytes>1024*1024||!Number.isSafeInteger(a.maxOutputTokens)||a.maxOutputTokens<1||a.maxOutputTokens>16384)throw Error("invalid read-only model attempt");checkedContract(a.qualification);attempts.add(a.attemptId);inputBytes+=Buffer.byteLength(a.prompt);count++;}
- }
- for(const node of order.nodes)for(const attempt of node.attempts)if(attempt.includeDependencies){let extra=0;for(const dependency of node.dependencies){const prior=order.nodes.find(n=>n.nodeId===dependency);extra+=256+Math.max(...(prior?.attempts.map(a=>a.maxRetainedOutputBytes)??[0]));}if(Buffer.byteLength(attempt.prompt)+extra>16384)throw Error("sealed dependency prompt exceeds attempt bound");inputBytes+=extra;}
- if(count>budget.limits.maxAttempts||inputBytes>budget.limits.maxInputBytes||budget.limits.maxConcurrent<count)throw Error("order exceeds original accounting allowance");
- const visiting=new Set<string>(),done=new Set<string>();const visit=(id:string)=>{if(done.has(id))return;if(visiting.has(id))throw Error("dependency cycle");const node=order.nodes.find(n=>n.nodeId===id);if(!node)throw Error("missing dependency");visiting.add(id);node.dependencies.forEach(visit);visiting.delete(id);done.add(id);};order.nodes.forEach(n=>visit(n.nodeId));return order;
-}
-export const measuredOrderDigest=(order:MeasuredOrder)=>hash(order);
-export function measuredOrderAcknowledgementDigest(input:MeasuredOrderAcknowledgement){const value=JSON.parse(intentKey(input)) as MeasuredOrderAcknowledgement;if(!exact(value,["version","requestId","bindingDigest","attemptId","claimOwner","claimDigest"])||value.version!=="measured-order-ack-v1"||![value.requestId,value.attemptId,value.claimOwner].every(x=>ID.test(x))||![value.bindingDigest,value.claimDigest].every(x=>HEX.test(x)))throw Error("invalid unknown acknowledgement");return hash(value);}
-function paths(directory:string){return{binding:join(directory,"binding.json"),journal:join(directory,"journal.jsonl")};}
-async function privateDirectory(directory:string){const st=await lstat(directory,{bigint:true});if(!st.isDirectory()||(st.mode&0o077n)||st.uid!==BigInt(process.getuid!())||await realpath(directory)!==directory)throw Error("owner-private measured order directory required");}
-export async function createMeasuredOrder(input:{directory:string;budget:GovernedBudgetBinding;order:MeasuredOrder}):Promise<Readonly<MeasuredOrderBinding>>{
- if(!isAbsolute(input.directory)||resolve(input.directory)!==input.directory)throw Error("absolute measured order directory required");const order=checkedOrder(input.order,input.budget);await mkdir(input.directory,{recursive:false,mode:0o700});await privateDirectory(input.directory);
- const p=paths(input.directory);await writeFile(p.journal,"",{mode:0o600,flag:"wx"});const directoryStat=await lstat(input.directory,{bigint:true}),journalStat=await lstat(p.journal,{bigint:true}),identity={directory:input.directory,directoryDevice:String(directoryStat.dev),directoryInode:String(directoryStat.ino),journalDevice:String(journalStat.dev),journalInode:String(journalStat.ino)};
- const binding={version:"measured-order-binding-v1" as const,...identity,budget:input.budget,order,digest:hash({...identity,budgetDigest:resourceBindingDigest(input.budget),orderDigest:measuredOrderDigest(order)})};await writeFile(p.binding,intentKey(binding)+"\n",{mode:0o600,flag:"wx"});return freezeWork(binding) as unknown as Readonly<MeasuredOrderBinding>;
-}
-function checkedBinding(input:MeasuredOrderBinding):MeasuredOrderBinding{const b=JSON.parse(intentKey(input)) as MeasuredOrderBinding,identity={directory:b.directory,directoryDevice:b.directoryDevice,directoryInode:b.directoryInode,journalDevice:b.journalDevice,journalInode:b.journalInode};if(!exact(b,["version","directory","directoryDevice","directoryInode","journalDevice","journalInode","budget","order","digest"])||b.version!=="measured-order-binding-v1"||!isAbsolute(b.directory)||resolve(b.directory)!==b.directory||![b.directoryDevice,b.directoryInode,b.journalDevice,b.journalInode].every(x=>/^\d+$/.test(x))||b.digest!==hash({...identity,budgetDigest:resourceBindingDigest(b.budget),orderDigest:measuredOrderDigest(checkedOrder(b.order,b.budget))}))throw Error("invalid measured order binding");return b;}
-async function pinnedJournal(binding:MeasuredOrderBinding,writable=false){const path=paths(binding.directory).journal,handle=await open(path,(writable?constants.O_RDWR|constants.O_APPEND:constants.O_RDONLY)|constants.O_NOFOLLOW);try{const st=await handle.stat({bigint:true});if(!st.isFile()||st.nlink!==1n||(st.mode&0o077n)||String(st.dev)!==binding.journalDevice||String(st.ino)!==binding.journalInode)throw Error("measured order binding changed");return handle;}catch(error){await handle.close();throw error;}}
-async function linked(binding:MeasuredOrderBinding){const st=await lstat(paths(binding.directory).journal,{bigint:true});if(!st.isFile()||st.nlink!==1n||String(st.dev)!==binding.journalDevice||String(st.ino)!==binding.journalInode||(await realpath(paths(binding.directory).journal))!==paths(binding.directory).journal)throw Error("measured order binding changed");}
-function parseJournal(text:string):JournalEvent[]{if(text&&!text.endsWith("\n"))throw Error("incomplete measured order journal");const rows=text?text.trimEnd().split("\n").map(line=>{const row=JSON.parse(line) as JournalEvent;if(journalKey(row)!==line)throw Error("noncanonical measured order journal");return row;}):[];let prior:string|null=null;for(let i=0;i<rows.length;i++){const row=rows[i],copy={...row} as any,claimed=copy.digest;delete copy.digest;if(row.sequence!==i||row.previousDigest!==prior||claimed!==journalHash(copy))throw Error("invalid measured order journal");prior=claimed;}return rows;}
-async function appendJournal(binding:MeasuredOrderBinding,event:Omit<JournalEvent,"sequence"|"previousDigest"|"digest">){const path=paths(binding.directory).journal;return withFileLock(path,"measured order",async()=>{const handle=await pinnedJournal(binding,true);try{const rows=parseJournal(await handle.readFile("utf8")),base={...event,sequence:rows.length,previousDigest:rows.at(-1)?.digest??null} as any,record={...base,digest:journalHash(base)} as JournalEvent;await linked(binding);await handle.writeFile(journalKey(record)+"\n");await handle.sync();return record;}finally{await handle.close();}});}
-function project(order:MeasuredOrder,events:JournalEvent[],currentOwner:string):MeasuredOrderNodeView[]{const rows=new Map<string,MeasuredOrderNodeView>();const evaluate=(node:MeasuredOrderNode):MeasuredOrderNodeView=>{const prior=rows.get(node.nodeId);if(prior)return prior;const row:MeasuredOrderNodeView={nodeId:node.nodeId,state:"exhausted",action:"none",attemptId:null,outputSha256:null,unknownClaim:null};if(node.dependencies.some(id=>evaluate(order.nodes.find(n=>n.nodeId===id)!).state!=="satisfied")){row.state="dependency-blocked";row.action="wait";rows.set(node.nodeId,row);return row;}
- for(const attempt of node.attempts){const claim=events.find(e=>e.type==="claim"&&e.attemptId===attempt.attemptId) as Extract<JournalEvent,{type:"claim"}>|undefined;if(!claim){row.state="eligible";row.action="dispatch";row.attemptId=attempt.attemptId;break;}const result=events.find(e=>e.type==="result"&&e.attemptId===attempt.attemptId) as Extract<JournalEvent,{type:"result"}>|undefined;const acknowledged=events.some(e=>e.type==="acknowledge-unknown"&&e.request.attemptId===attempt.attemptId&&e.request.claimDigest===claim.digest&&e.request.claimOwner===claim.owner);if(!result){if(claim.owner!==currentOwner){if(acknowledged)continue;row.state="unknown";row.action="acknowledge";row.unknownClaim={owner:claim.owner,digest:claim.digest};}else{row.state="running";row.action="wait";}row.attemptId=attempt.attemptId;break;}if(result.state==="unknown"){if(!acknowledged){row.state="unknown";row.action="acknowledge";row.attemptId=attempt.attemptId;row.unknownClaim={owner:claim.owner,digest:claim.digest};break;}continue;}if(result.state==="completed"){row.state="satisfied";row.outputSha256=result.outputSha256;row.attemptId=attempt.attemptId;break;}}
- rows.set(node.nodeId,row);return row;};return order.nodes.map(evaluate);}
-export function openMeasuredOrder(input:MeasuredOrderBinding,hostAuthority:MeasuredOrderAuthority|null,host:MeasuredSessionHost){const binding=checkedBinding(input),p=paths(binding.directory),owner=randomUUID(),authorized=()=>hostAuthority?.authorityDigest===binding.order.authorityDigest&&hostAuthority.orderDigests.includes(measuredOrderDigest(binding.order));
- const read=async()=>{await privateDirectory(binding.directory);const directoryStat=await lstat(binding.directory,{bigint:true});if(String(directoryStat.dev)!==binding.directoryDevice||String(directoryStat.ino)!==binding.directoryInode||(await readFile(p.binding,"utf8")).trimEnd()!==intentKey(binding))throw Error("measured order binding changed");await linked(binding);const handle=await pinnedJournal(binding);try{return parseJournal(await handle.readFile("utf8"));}finally{await handle.close();}};
- const inspect=async()=>{const events=await read(),accounting=await openResourceBudget(binding.budget).inspect(),diagnostics=events.filter((e):e is Extract<JournalEvent,{type:"result"}>=>e.type==="result"&&e.state!=="completed").map(e=>`${e.attemptId}:${e.state}`);return freezeWork({version:"measured-order-view-v1",orderId:binding.order.orderId,nodes:project(binding.order,events,owner),resources:accounting,diagnostics,acceptance:"not-assessed",freshness:"snapshot-unknown" as const});};
- return Object.freeze({inspect,async advance(){if(!authorized())throw Error("independent exact order authority required");await read();let selected:MeasuredOrderAttempt|undefined,claim:Extract<JournalEvent,{type:"claim"}>|undefined;
-  await withFileLock(p.journal,"measured order advance",async()=>{const handle=await pinnedJournal(binding,true);try{const events=parseJournal(await handle.readFile("utf8")),eligible=project(binding.order,events,owner).find(n=>n.state==="eligible");if(!eligible)return;selected=binding.order.nodes.flatMap(n=>n.attempts).find(a=>a.attemptId===eligible.attemptId)!;const base={type:"claim",sequence:events.length,previousDigest:events.at(-1)?.digest??null,attemptId:selected.attemptId,owner} as const;claim={...base,digest:hash(base)};await linked(binding);await handle.writeFile(intentKey(claim)+"\n");await handle.sync();}finally{await handle.close();}});
-  if(!selected||!claim)return inspect();const node=binding.order.nodes.find(n=>n.attempts.some(a=>a.attemptId===selected!.attemptId))!,index=node.attempts.findIndex(a=>a.attemptId===selected!.attemptId),controller=new AbortController();let state:Extract<JournalEvent,{type:"result"}>["state"]="failed",result:unknown=null,outputSha256:string|null=null;
-  try{const accounting=await openResourceBudget(binding.budget).inspect(),parent=[...node.attempts.slice(0,index)].reverse().find(a=>accounting.reservations.some(r=>r.attemptId===a.attemptId))??null,events=await read();let prompt=selected.prompt;if(selected.includeDependencies)for(const dependency of node.dependencies){const dependencyNode=binding.order.nodes.find(n=>n.nodeId===dependency)!,prior=dependencyNode.attempts.map(a=>events.find(e=>e.type==="result"&&e.attemptId===a.attemptId)).find((e):e is Extract<JournalEvent,{type:"result"}>=>e?.type==="result"&&e.state==="completed"),output=(prior?.result as {output?:unknown})?.output;if(!prior||typeof output!=="string"||hash(output)!==prior.outputSha256)throw Error("sealed dependency output unavailable");prompt+=`\n\n<sealed-dependency node=${JSON.stringify(dependency)} sha256=${JSON.stringify(prior.outputSha256)}>\n${output}\n</sealed-dependency>`;}
-   result=await runMeasuredAgentSession({budget:binding.budget,attempt:{attemptId:selected.attemptId,orderId:binding.order.orderId,experimentId:`${binding.order.orderId}:${node.nodeId}`,kind:parent?"retry":"primary",parentAttemptId:parent?.attemptId??null},model:selected.model,thinkingLevel:selected.thinkingLevel,prompt,deadlineMs:selected.deadlineMs,terminationGraceMs:selected.terminationGraceMs,maxRetainedOutputBytes:selected.maxRetainedOutputBytes,maxOutputTokens:selected.maxOutputTokens,signal:controller.signal},host);const qualified=qualifyMeasuredOutput((result as {output:string}).output,selected.qualification);outputSha256=qualified.outputSha256;state=qualified.eligible?"completed":"mismatch";}catch(error){result=error instanceof MeasuredSessionFailure?error.evidence:{errorType:error instanceof Error?error.name:"unknown",errorCode:typeof error==="object"&&error&&"code" in error?String(error.code):null,message:error instanceof Error?error.message:"unknown"};state=error instanceof MeasuredSessionUnknownError?"unknown":error instanceof MeasuredSessionFailure&&(error.evidence as {state?:string})?.state==="cancelled"?"cancelled":"failed";}
-  let event={type:"result" as const,attemptId:selected.attemptId,owner:claim.owner,state,outputSha256,result} as Omit<JournalEvent,"sequence"|"previousDigest"|"digest">;try{journalKey(event);}catch(error){if(!(error instanceof JournalSerializationError))throw error;event={type:"result",attemptId:selected.attemptId,owner:claim.owner,state:"failed",outputSha256,result:{errorType:"JournalSerializationError",errorCode:"MEASURED_RESULT_SERIALIZATION_FAILED",message:"measured result could not be durably serialized"}} as Omit<JournalEvent,"sequence"|"previousDigest"|"digest">;journalKey(event);}await appendJournal(binding,event);return inspect();},
-  async acknowledgeUnknown(request:MeasuredOrderAcknowledgement,authority:MeasuredOrderAuthority|null){const digest=measuredOrderAcknowledgementDigest(request);if(authority?.authorityDigest!==binding.order.authorityDigest||!authority.acknowledgementDigests.includes(digest)||request.bindingDigest!==binding.digest)throw Error("independent exact acknowledgement authority required");await read();await withFileLock(p.journal,"measured order acknowledgement",async()=>{const handle=await pinnedJournal(binding,true);try{const events=parseJournal(await handle.readFile("utf8")),claim=events.find(e=>e.type==="claim"&&e.attemptId===request.attemptId) as Extract<JournalEvent,{type:"claim"}>|undefined,result=events.find(e=>e.type==="result"&&e.attemptId===request.attemptId) as Extract<JournalEvent,{type:"result"}>|undefined;if(!claim||claim.owner!==request.claimOwner||claim.digest!==request.claimDigest||!(result?.state==="unknown"||!result&&claim.owner!==owner)||events.some(e=>e.type==="acknowledge-unknown"&&e.request.attemptId===request.attemptId))throw Error("exact current unknown claim required");const base={type:"acknowledge-unknown",sequence:events.length,previousDigest:events.at(-1)!.digest,request} as const,record={...base,digest:hash(base)};await linked(binding);await handle.writeFile(intentKey(record)+"\n");await handle.sync();}finally{await handle.close();}});return inspect();}});
-}

package/src/measured-session.ts

@@ -1,70 +0,0 @@
-import { createHash } from 'node:crypto';
-import { mkdir, mkdtemp, rm } from 'node:fs/promises';
-import { join, resolve } from 'node:path';
-import { createAgentSession, DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager } from '@earendil-works/pi-coding-agent';
-import { openResourceBudget, type AttemptDemand, type GovernedBudgetBinding } from './resource-budget.ts';
-import { freezeWork } from './work-ledger-json.ts';
-
-const MODELS=['openai-codex/gpt-5.6-sol','openai-codex/gpt-5.6-terra'] as const;
-const THINKING=['off','minimal','low','medium','high','xhigh','max'] as const;
-export interface ProviderUsage {input:number;output:number;cacheRead:number;cacheWrite:number;reasoning:number;totalTokens:number;cost:{input:number;output:number;cacheRead:number;cacheWrite:number;total:number}}
-export interface MeasuredSessionHostInput {model:typeof MODELS[number];thinkingLevel:typeof THINKING[number];prompt:string;deadlineMs:number;maxOutputTokens:number;tools:readonly [];discovery:'factory-only';signal:AbortSignal}
-export interface MeasuredSessionHostResult {output:string;usage:ProviderUsage;provider:'openai-codex';model:'gpt-5.6-sol'|'gpt-5.6-terra';stopReason:string}
-export interface MeasuredSessionHost {run(input:MeasuredSessionHostInput):Promise<MeasuredSessionHostResult>}
-export interface MeasuredSessionInput {budget:GovernedBudgetBinding;attempt:Omit<AttemptDemand,'inputBytes'|'inputDigest'>;model:typeof MODELS[number];thinkingLevel:typeof THINKING[number];prompt:string;deadlineMs:number;terminationGraceMs:number;maxRetainedOutputBytes:number;maxOutputTokens:number;signal?:AbortSignal}
-export class MeasuredSessionFailure extends Error {readonly evidence:unknown;constructor(message:string,evidence:unknown){super(message);this.name='MeasuredSessionFailure';this.evidence=evidence;}}
-export class MeasuredSessionUnknownError extends Error {constructor(){super('measured session did not settle after owned abort; reservation remains active');this.name='MeasuredSessionUnknownError';}}
-const finite=(value:unknown)=>typeof value==='number'&&Number.isFinite(value)&&value>=0;
-function checkedUsage(value:ProviderUsage):ProviderUsage {
- if(!value||typeof value!=='object'||Object.keys(value).sort().join()!=='cacheRead,cacheWrite,cost,input,output,reasoning,totalTokens'||![value.input,value.output,value.cacheRead,value.cacheWrite,value.reasoning,value.totalTokens].every(finite)||!Number.isSafeInteger(value.totalTokens)||!value.cost||Object.keys(value.cost).sort().join()!=='cacheRead,cacheWrite,input,output,total'||!Object.values(value.cost).every(finite))throw Error('provider usage unavailable or malformed');
- return JSON.parse(JSON.stringify(value));
-}
-function checked(input:MeasuredSessionInput):MeasuredSessionInput {
- if(!input||typeof input!=='object'||!MODELS.includes(input.model)||!THINKING.includes(input.thinkingLevel))throw Error('measured sessions require exact Codex Sol or Terra');
- if(typeof input.prompt!=='string'||!input.prompt.length||Buffer.byteLength(input.prompt)>65536||!Number.isSafeInteger(input.deadlineMs)||input.deadlineMs<1000||input.deadlineMs>300000||!Number.isSafeInteger(input.terminationGraceMs)||input.terminationGraceMs<100||input.terminationGraceMs>10000||!Number.isSafeInteger(input.maxRetainedOutputBytes)||input.maxRetainedOutputBytes<1||input.maxRetainedOutputBytes>1024*1024||!Number.isSafeInteger(input.maxOutputTokens)||input.maxOutputTokens<1||input.maxOutputTokens>16384)throw Error('invalid measured session bounds');
- if(input.signal?.aborted)throw new MeasuredSessionFailure('measured session cancelled before reservation',{state:'cancelled-before-reservation',reason:'caller-signal'});
- return input;
-}
-/** Opt-in one-prompt route. Existing resource budgets own attempts; byte retention is checked after generation. */
-export async function runMeasuredAgentSession(raw:MeasuredSessionInput,host:MeasuredSessionHost){
- const input=checked(raw),bytes=Buffer.from(input.prompt),budget=openResourceBudget(input.budget),permit=await budget.reserve({...input.attempt,inputBytes:bytes.length,inputDigest:createHash('sha256').update(bytes).digest('hex')});
- const controller=new AbortController(),abort=()=>controller.abort(input.signal?.reason??'operator-cancellation');input.signal?.addEventListener('abort',abort,{once:true});if(input.signal?.aborted)abort();
- const timer=setTimeout(()=>controller.abort('deadline'),input.deadlineMs);let outcome:'completed'|'failed'|'cancelled'|null='failed';
- try{
-  const unknown=new Promise<never>((_,reject)=>controller.signal.addEventListener('abort',()=>setTimeout(()=>reject(new MeasuredSessionUnknownError()),input.terminationGraceMs),{once:true}));
-  if(controller.signal.aborted)throw new MeasuredSessionFailure('measured session cancelled after reservation',{state:'cancelled-before-host',reason:'caller-signal'});
-  const running=host.run({model:input.model,thinkingLevel:input.thinkingLevel,prompt:input.prompt,deadlineMs:input.deadlineMs,maxOutputTokens:input.maxOutputTokens,tools:[],discovery:'factory-only',signal:controller.signal});
-  const result=await Promise.race([running,unknown]);
-  const outputBytes=Buffer.from(result.output),outputEvidence={sha256:createHash('sha256').update(outputBytes).digest('hex'),bytes:outputBytes.length,retainedPrefix:outputBytes.subarray(0,input.maxRetainedOutputBytes).toString('utf8')};
-  let usage:ProviderUsage;try{usage=checkedUsage(result.usage);}catch(error){throw new MeasuredSessionFailure(String(error),{state:'failed',model:result.model,stopReason:result.stopReason,output:outputEvidence});}
-  if(result.provider!=='openai-codex'||`${result.provider}/${result.model}`!==input.model)throw new MeasuredSessionFailure('measured model identity mismatch',{state:'failed',observedProvider:result.provider,observedModel:result.model,stopReason:result.stopReason,output:outputEvidence,usage});
-  if(outputEvidence.bytes>input.maxRetainedOutputBytes)throw new MeasuredSessionFailure('measured retained-output bound exceeded',{state:'failed',model:input.model,stopReason:result.stopReason,output:outputEvidence,usage});
-  if(controller.signal.aborted||result.stopReason!=='stop')throw new MeasuredSessionFailure('measured assistant did not stop cleanly',{state:controller.signal.aborted?'cancelled':'failed',model:input.model,stopReason:result.stopReason,output:outputEvidence,usage});
-  outcome='completed';return freezeWork({version:'measured-session-result-v1',state:'completed',model:input.model,thinkingLevel:input.thinkingLevel,output:result.output,usage,stopReason:result.stopReason,acceptance:'not-assessed',grantExpansion:false});
- }catch(error){
-  if(error instanceof MeasuredSessionUnknownError){outcome=null;throw error;}
-  if(controller.signal.aborted)outcome='cancelled';
-  if(error instanceof MeasuredSessionFailure)throw error;
-  throw new MeasuredSessionFailure('measured host failed',{state:controller.signal.aborted?'cancelled':'failed',errorType:error instanceof Error?error.name:'unknown'});
- }
- finally{clearTimeout(timer);input.signal?.removeEventListener('abort',abort);if(outcome)await permit.settle(outcome);}
-}
-export interface MeasuredAuthRuntime {isUsingOAuth(provider:string):boolean;isUsingSubscription(provider:string):boolean;checkAuth(provider:string,options?:{signal?:AbortSignal}):Promise<{type:string}|undefined>}
-export async function verifyMeasuredSubscription(runtime:MeasuredAuthRuntime,signal?:AbortSignal){
- signal?.throwIfAborted();const auth=await runtime.checkAuth('openai-codex',{signal});signal?.throwIfAborted();
- if(auth?.type!=='oauth'||!runtime.isUsingOAuth('openai-codex')||!runtime.isUsingSubscription('openai-codex'))throw Error('exact OpenAI Codex OAuth subscription authorization required');
-}
-/** Concrete SDK host: in-memory session/settings, empty discovery roots, no tools, one factory-named inline extension. */
-export function piSdkMeasuredSessionHost():MeasuredSessionHost{return{async run(input){
- const root=await mkdtemp(join(resolve(process.env.TMPDIR??'/tmp'),'pi-daddy-measured-'));let session:Awaited<ReturnType<typeof createAgentSession>>['session']|undefined;
- try{
-  const agentDir=join(root,'agent');await mkdir(agentDir,{mode:0o700});const settings=SettingsManager.inMemory({compaction:{enabled:false},retry:{enabled:false,maxRetries:0}});
-  const loader=new DefaultResourceLoader({cwd:root,agentDir,settingsManager:settings,systemPromptOverride:()=> 'Follow the supplied bounded task. Do not use tools or claim acceptance.',agentsFilesOverride:()=>({agentsFiles:[],diagnostics:[]}),skillsOverride:()=>({skills:[],diagnostics:[]}),promptsOverride:()=>({prompts:[],diagnostics:[]}),extensionFactories:[{name:'pi-daddy-measured-session',factory:()=>{}}]});await loader.reload();
-  input.signal.throwIfAborted();const runtime=await ModelRuntime.create({signal:input.signal});input.signal.throwIfAborted();await verifyMeasuredSubscription(runtime,input.signal);input.signal.throwIfAborted();
-  const [provider,modelId]=input.model.split('/'),found=runtime.getModel(provider,modelId);if(!found)throw Error('requested measured model unavailable');
-  const created=await createAgentSession({cwd:root,agentDir,model:{...found,maxTokens:input.maxOutputTokens},thinkingLevel:input.thinkingLevel,modelRuntime:runtime,resourceLoader:loader,sessionManager:SessionManager.inMemory(root),settingsManager:settings,noTools:'all'});session=created.session;if(created.extensionsResult.errors.length)throw Error('factory-only extension load failed');
-  const abort=()=>void session!.abort();input.signal.addEventListener('abort',abort,{once:true});try{if(input.signal.aborted){await session.abort();throw input.signal.reason;}await session.prompt(input.prompt,{expandPromptTemplates:false});}finally{input.signal.removeEventListener('abort',abort);}
-  const message=[...session.messages].reverse().find(m=>m.role==='assistant');if(!message)throw Error('measured assistant result unavailable');
-  return {output:message.content.filter(c=>c.type==='text').map(c=>c.text).join(''),usage:message.usage as ProviderUsage,provider:message.provider as MeasuredSessionHostResult['provider'],model:message.model as MeasuredSessionHostResult['model'],stopReason:message.stopReason};
- }finally{session?.dispose();await rm(root,{recursive:true,force:true});}
-}};}

package/src/model-preflight.ts

@@ -1,41 +0,0 @@
-import { refusal, type StructuredRefusal } from "./refusals.ts";
-
-export const ENV_ALLOW_UNRESOLVED_MODELS = "PI_GRANTS_ALLOW_UNRESOLVED_MODELS";
-
-/** Pi's resolved catalogue carries provider support in thinkingLevelMap. Never silently clamp a user's choice. */
-export function supportedModelEfforts(model: { reasoning: boolean; thinkingLevelMap?: Partial<Record<string, string | null>> }): ("off"|"minimal"|"low"|"medium"|"high"|"xhigh"|"max")[] {
-  if (!model.reasoning) return ["off"];
-  return (["off","minimal","low","medium","high","xhigh","max"] as const).filter(level => {
-    const mapped=model.thinkingLevelMap?.[level];
-    return mapped!==null && ((level!=="xhigh"&&level!=="max") || mapped!==undefined);
-  });
-}
-
-export interface ModelCatalogue {
-  find(provider: string, modelId: string): unknown;
-}
-
-/** Resolve an explicit provider/id against pi's own session catalogue without probing credentials or network. */
-export function preflightModel(
-  model: string | undefined,
-  catalogue: ModelCatalogue,
-  cache: Map<string, boolean>,
-  allowUnresolved: boolean,
-): StructuredRefusal | undefined {
-  if (model === undefined || allowUnresolved) return undefined;
-  const slash = model.indexOf("/");
-  const provider = slash > 0 ? model.slice(0, slash) : "";
-  const id = slash > 0 ? model.slice(slash + 1) : "";
-  let resolved = cache.get(model);
-  if (resolved === undefined) {
-    resolved = provider.length > 0 && id.length > 0 && catalogue.find(provider, id) !== undefined;
-    cache.set(model, resolved);
-  }
-  if (resolved) return undefined;
-  return refusal(
-    "MODEL_UNRESOLVED",
-    `grants: model ${model || "(empty)"} is not in pi's session catalogue; use provider/id from /model, ` +
-      `or set ${ENV_ALLOW_UNRESOLVED_MODELS}=1 to let pi attempt custom resolution`,
-    { model: model || "(empty)" },
-  );
-}

package/src/native-session-target.ts

@@ -1,23 +0,0 @@
-import { lstat, realpath, mkdir } from "node:fs/promises";
-import { dirname, isAbsolute, join, parse, resolve } from "node:path";
-import { createHash } from "node:crypto";
-import { ENV_NATIVE_SESSION_ROOT } from "./native-session.ts";
-export interface NativeSessionHost { /** Explicit host opt-in captured once, not model-supplied. */ readonly nativeSessionRoot?: string }
-export const nativeSessionRootFromEnv=(env:NodeJS.ProcessEnv)=>env[ENV_RETAIN_NATIVE_SESSIONS]==="1"?env[ENV_NATIVE_SESSION_ROOT]??"":undefined;
-export const ENV_RETAIN_NATIVE_SESSIONS = "PI_GRANTS_RETAIN_NATIVE_SESSIONS";
-/** Explicit ordinary-host opt-in only. Never read a destination from tool/model parameters.
- * Allocate a fresh per-occurrence directory; no scan, existing-session takeover or transcript creation. */
-export async function allocateNativeSessionTarget(root: string, executionId: string): Promise<string> {
-  if (!isAbsolute(root) || resolve(root) !== root || !/^[a-zA-Z0-9:_-]{1,128}$/.test(executionId)) throw new Error("explicit native root/execution identity required");
-  for (let p = root;; p = dirname(p)) {
-    const s = await lstat(p); if (!s.isDirectory() || s.isSymbolicLink()) throw new Error("native target ancestor changed");
-    if (p === parse(p).root) break;
-  }
-  const before = await lstat(root);
-  if (await realpath(root) !== root || before.mode & 0o077 || before.uid !== process.getuid?.()) throw new Error("private owned native target root required");
-  const directory = join(root, "execution-" + createHash("sha256").update(executionId).digest("hex"));
-  await mkdir(directory, { mode: 0o700 }); // EEXIST is a refusal, never permission to append an old occurrence.
-  const after = await lstat(root);
-  if (before.dev !== after.dev || before.ino !== after.ino || await realpath(directory) !== directory) throw new Error("native target root replaced");
-  return join(directory, "session.jsonl");
-}