pi-daddy 0.27.4 → 0.32.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.27.4",
+  "version": "0.32.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",
@@ -29,214 +29,11 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
-    "./resolve": {
-      "types": "./dist/resolve.d.ts",
-      "default": "./dist/resolve.js"
-    },
-    "./ledger": {
-      "types": "./dist/ledger.d.ts",
-      "default": "./dist/ledger.js"
-    },
-    "./work-setup": { "types": "./dist/work-setup.d.ts", "default": "./dist/work-setup.js" },
-    "./work-command": { "types": "./dist/work-command.d.ts", "default": "./dist/work-command.js" },
-    "./work-run": { "types": "./dist/work-run.d.ts", "default": "./dist/work-run.js" },
-    "./work-policy-registry": { "types": "./dist/work-policy-registry.d.ts", "default": "./dist/work-policy-registry.js" },
-    "./factory-registry": { "types": "./dist/factory-registry.d.ts", "default": "./dist/factory-registry.js" },
-    "./learning-connection": { "types": "./dist/learning-connection.d.ts", "default": "./dist/learning-connection.js" },
-    "./work-ledger": {
-      "types": "./dist/work-ledger.d.ts",
-      "default": "./dist/work-ledger.js"
-    },
-    "./factory-order": {
-      "types": "./dist/factory-order.d.ts",
-      "default": "./dist/factory-order.js"
-    },
-    "./experiment": {
-      "types": "./dist/experiment.d.ts",
-      "default": "./dist/experiment.js"
-    },
-    "./dashboard-harness": {
-      "types": "./dist/dashboard-harness.d.ts",
-      "default": "./dist/dashboard-harness.js"
-    },
-    "./daily-dashboard-host": {
-      "types": "./dist/daily-dashboard-host.d.ts",
-      "default": "./dist/daily-dashboard-host.js"
-    },
-    "./dashboard-host": {
-      "types": "./dist/dashboard-host.d.ts",
-      "default": "./dist/dashboard-host.js"
-    },
-    "./dashboard-host-transport": {
-      "types": "./dist/dashboard-host-transport.d.ts",
-      "default": "./dist/dashboard-host-transport.js"
-    },
-    "./debrief-host": {
-      "types": "./dist/debrief-host.d.ts",
-      "default": "./dist/debrief-host.js"
-    },
-    "./contracts/debrief/v2/*": "./contracts/debrief/v2/*",
-    "./debrief": {
-      "types": "./dist/debrief.d.ts",
-      "default": "./dist/debrief.js"
-    },
-    "./daily-view": {
-      "types": "./dist/daily-view.d.ts",
-      "default": "./dist/daily-view.js"
-    },
-    "./intent-control": {
-      "types": "./dist/intent-control.d.ts",
-      "default": "./dist/intent-control.js"
-    },
-    "./dispatch-control": {
-      "types": "./dist/dispatch-control.d.ts",
-      "default": "./dist/dispatch-control.js"
-    },
-    "./resource-budget": {
-      "types": "./dist/resource-budget.d.ts",
-      "default": "./dist/resource-budget.js"
-    },
-    "./producer-ipc": {
-      "types": "./dist/producer-ipc.d.ts",
-      "default": "./dist/producer-ipc.js"
-    },
-    "./effect-profile": {
-      "types": "./dist/effect-profile.d.ts",
-      "default": "./dist/effect-profile.js"
-    },
-    "./measured-session": {
-      "types": "./dist/measured-session.d.ts",
-      "default": "./dist/measured-session.js"
-    },
-    "./measured-order": {
-      "types": "./dist/measured-order.d.ts",
-      "default": "./dist/measured-order.js"
-    },
-    "./execution-retention": {
-      "types": "./dist/execution-retention.d.ts",
-      "default": "./dist/execution-retention.js"
-    },
-    "./spawn": {
-      "types": "./dist/spawn.d.ts",
-      "default": "./dist/spawn.js"
-    },
-    "./delegate": {
-      "types": "./dist/delegate.d.ts",
-      "default": "./dist/delegate.js"
-    },
-    "./catalog": {
-      "types": "./dist/catalog.d.ts",
-      "default": "./dist/catalog.js"
-    },
-    "./propagation": {
-      "types": "./dist/propagation.d.ts",
-      "default": "./dist/propagation.js"
-    },
-    "./definitions": {
-      "types": "./dist/definitions.d.ts",
-      "default": "./dist/definitions.js"
-    },
-    "./fanout": {
-      "types": "./dist/fanout.d.ts",
-      "default": "./dist/fanout.js"
-    },
-    "./pi-tools": {
-      "types": "./dist/pi-tools.d.ts",
-      "default": "./dist/pi-tools.js"
-    },
-    "./run-herdr": {
-      "types": "./dist/run-herdr.d.ts",
-      "default": "./dist/run-herdr.js"
-    },
-    "./herdr-poll": {
-      "types": "./dist/herdr-poll.d.ts",
-      "default": "./dist/herdr-poll.js"
-    },
-    "./herdr-cli": {
-      "types": "./dist/herdr-cli.d.ts",
-      "default": "./dist/herdr-cli.js"
-    },
-    "./executor": {
-      "types": "./dist/executor.d.ts",
-      "default": "./dist/executor.js"
-    },
-    "./progress": {
-      "types": "./dist/progress.d.ts",
-      "default": "./dist/progress.js"
-    },
-    "./chain": {
-      "types": "./dist/chain.d.ts",
-      "default": "./dist/chain.js"
-    },
-    "./run-child": {
-      "types": "./dist/run-child.d.ts",
-      "default": "./dist/run-child.js"
-    },
-    "./approval": {
-      "types": "./dist/approval.d.ts",
-      "default": "./dist/approval.js"
-    },
-    "./approval-store": {
-      "types": "./dist/approval-store.d.ts",
-      "default": "./dist/approval-store.js"
-    },
-    "./approval-prompt": {
-      "types": "./dist/approval-prompt.d.ts",
-      "default": "./dist/approval-prompt.js"
-    },
-    "./init": {
-      "types": "./dist/init.d.ts",
-      "default": "./dist/init.js"
-    },
-    "./skill-packages": {
-      "types": "./dist/skill-packages.d.ts",
-      "default": "./dist/skill-packages.js"
-    },
-    "./correlation": {
-      "types": "./dist/correlation.d.ts",
-      "default": "./dist/correlation.js"
-    },
-    "./refusals": {
-      "types": "./dist/refusals.d.ts",
-      "default": "./dist/refusals.js"
-    },
-    "./workspace": {
-      "types": "./dist/workspace.d.ts",
-      "default": "./dist/workspace.js"
-    },
-    "./check-runner": {
-      "types": "./dist/check-runner.d.ts",
-      "default": "./dist/check-runner.js"
-    },
-    "./dashboard-projection": {
-      "types": "./dist/dashboard-projection.d.ts",
-      "default": "./dist/dashboard-projection.js"
-    },
-    "./dashboard-render": {
-      "types": "./dist/dashboard-render.d.ts",
-      "default": "./dist/dashboard-render.js"
-    },
-    "./contracts/factory-order/v1/*": "./contracts/factory-order/v1/*",
-    "./contracts/experiment/v1/*": "./contracts/experiment/v1/*",
-    "./contracts/producer-ipc/v1/*": "./contracts/producer-ipc/v1/*",
-    "./contracts/debrief/v1/*": "./contracts/debrief/v1/*",
-    "./contracts/intent-control/v2/request.schema.json": "./contracts/intent-control/v2/request.schema.json",
-    "./contracts/intent-control/v1/request.schema.json": "./contracts/intent-control/v1/request.schema.json",
-    "./contracts/dispatch-control/v1/request.schema.json": "./contracts/dispatch-control/v1/request.schema.json",
-    "./contracts/daily-view/v1/fixtures/*": "./contracts/daily-view/v1/fixtures/*",
-    "./contracts/daily-view/v1/p03/projection.schema.json": "./contracts/daily-view/v1/p03/projection.schema.json",
-    "./contracts/execution-retention/v2/manifest.schema.json": "./contracts/execution-retention/v2/manifest.schema.json",
-    "./contracts/execution-retention/v2/fixtures/*": "./contracts/execution-retention/v2/fixtures/*",
-    "./contracts/ledger/v4/ledger-event.schema.json": "./contracts/ledger/v4/ledger-event.schema.json",
-    "./contracts/ledger/v4/fixtures/*.json": "./contracts/ledger/v4/fixtures/*.json",
-    "./contracts/ledger/v3/ledger-event.schema.json": "./contracts/ledger/v3/ledger-event.schema.json",
-    "./contracts/ledger/v3/fixtures/*.json": "./contracts/ledger/v3/fixtures/*.json",
-    "./contracts/ledger/v2/ledger-event.schema.json": "./contracts/ledger/v2/ledger-event.schema.json",
-    "./contracts/ledger/v2/fixtures/*.json": "./contracts/ledger/v2/fixtures/*.json"
+    "./contracts/*": "./contracts/*"
   },
   "bin": {
     "pi-daddy": "./dist/cli.js",
-    "pi-daddy-dashboard": "./dist/dashboard-cli.js"
+    "pi-daddy-dashboard": "./dist/products/dashboard-cli.js"
   },
   "files": [
     "dist",
@@ -247,8 +44,6 @@
     "THIRD_PARTY_LICENSES",
     "THIRD_PARTY_NOTICES.md",
     "README.md",
-    "PRODUCT-GUIDE.md",
-    "REQUIREMENTS.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
@@ -256,11 +51,9 @@
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.check.json",
     "test": "node scripts/unit-tests.ts",
-    "test:dashboard-pty": "if [ \"$(uname -s)\" = Linux ]; then python3 test/dashboard-cli-pty.py; else echo 'dashboard PTY probe requires Unix pty/Unix sockets'; fi",
     "test:integration": "node --test test-integration/*.it.ts",
-    "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts",
-    "contracts:generate": "node scripts/generate-ledger-v3-contract.ts",
-    "contracts:generate:v4": "node scripts/generate-ledger-v4-contract.ts contracts/ledger/v4",
+    "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts test-integration/activity.it.ts",
+    "contracts:generate": "node scripts/generate-ledger-record-contract.ts",
     "prepack": "npm run build",
     "test:smoke": "node scripts/smoke-installed.mjs"
   },

package/src/cli.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * `pi-daddy` — scaffolding, read-only work inspection and the installed product guide.
+ * `pi-daddy` — scaffolding and ledger maintenance.
  *
  * Thin on purpose: argv in, `discoverSkillPackages` + `planInit` + `applyInit`, report out. Every decision
  * lives in `./init.ts`, `./grant-env.ts` and `./skill-packages.ts` as functions that touch no argv and print
@@ -17,26 +17,37 @@ import { realpathSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { relative, resolve as resolvePath } from "node:path";
 import { pathToFileURL } from "node:url";
-import { UnsafeGrantError } from "./grant-env.ts";
-import { applyInit, countDeclaring, planInit, type InitPlan } from "./init.ts";
-import { registeredWorkspaceIds } from "./workspace.ts";
-import { discoverSkillPackages, skillPackageRoots, type RefusedSkill, type SkillPackage } from "./skill-packages.ts";
-import { declareWork, loadDeclaredWork } from "./work-command.ts";
-import { listWorkSetups, workPresentation } from "./work-setup.ts";
-import { panelText } from "./daily-panel.ts";
+import { UnsafeGrantError } from "./kernel/grant-env.ts";
+import {
+  applyInit,
+  countDeclaring,
+  planInit,
+  type InitPlan,
+  GITIGNORE_REINCLUDE_LINES,
+  settingsIgnoredByGit,
+} from "./governance/init.ts";
+import { registeredWorkspaceIds } from "./kernel/workspace.ts";
+import {
+  discoverSkillPackages,
+  skillPackageRoots,
+  type RefusedSkill,
+  type SkillPackage,
+} from "./kernel/skill-packages.ts";
+import { adoptLegacyEnvironment, legacyEnvironmentWarning } from "./kernel/env-names.ts";
+import { PI_PROJECT_DIR, PROJECT_FILES, PROJECT_STATE_DIRNAME } from "./kernel/project-paths.ts";
+import { repairLedger } from "./governance/record.ts";
+import { importLegacyLedger } from "./governance/ledger.ts";
+
+/** The reviewable record, as the operator sees it relative to the project (ADR-0076 PR 3c). */
+const SETTINGS_REL = `${PI_PROJECT_DIR}/${PROJECT_STATE_DIRNAME}/${PROJECT_FILES.settings}`;
 
 const USAGE = `pi-daddy — capability governance for pi sub-agents
 
 Usage:
-  pi-daddy init [--force] [--dir <path>]   prepare .pi/grants.env from enabled installed
+  pi-daddy init [--force] [--dir <path>]   prepare ${SETTINGS_REL} from enabled installed
                                            packages that declare skills (package.json "pi": {"skills": …})
-  pi-daddy work add --id <id> --outcome <text> [--dir <path>]
-                                           declare one current obligation for ordinary delegation
-  pi-daddy work list | work show [--dir <path>]
-                                           inspect saved setups or selected outcome (no model calls)
-  In Pi: /grants work                     guided multi-task/model/effort/dependency setup and run
-         /grants learning                 retained review, trust, adoption and later outcomes
-  pi-daddy guide | current               installed product guide / current requirement register
+  pi-daddy ledger repair <path> [--yes]   show the damaged tail of a ledger; --yes truncates it (ADR-0076)
+  pi-daddy ledger import <source> <target> copy a pre-format ledger into the record format; the source is untouched
   pi-daddy --help | --version
 
 init references skills already enabled in Pi at their installed or local paths. Legacy unregistered npm
@@ -45,14 +56,16 @@ stays unspawnable. Capabilities that can change your machine
 (bash, write, edit) are written COMMENTED — uncomment them deliberately. Review the files, then commit.
 
   --force   rewrite legacy unregistered npm SKILL.md copies that already exist. This DISCARDS any \`allowed-tools\` you added.
-            It never rewrites .pi/grants.env — delete that file if you want it regenerated.`;
+            It never rewrites ${SETTINGS_REL} — delete that file if you want it regenerated.`;
 
 export interface ParsedArgs {
-  command: "init" | "work-add" | "work-list" | "work-show" | "guide" | "current" | "help" | "version";
+  command: "init" | "ledger-repair" | "ledger-import" | "help" | "version";
+  importTarget?: string;
+  /** `ledger repair <path>`: the ledger file; `yes` applies, otherwise preview only. */
+  ledgerPath?: string;
+  yes?: boolean;
   dir?: string;
   force: boolean;
-  id?: string;
-  outcome?: string;
   /** Non-empty means refuse: argv said something this program does not understand. */
   errors: string[];
 }
@@ -71,54 +84,45 @@ export function parseArgs(argv: string[]): ParsedArgs {
   if (args.includes("--version") || args.includes("-v")) return { command: "version", force: false, errors: [] };
 
   const [command, ...tail] = args;
-  if(command==="guide"||command==="current")return{command,force:false,errors:tail.length?[`${command} takes no arguments`]:[]};
-  if (command !== "init" && command !== "work") return { command: "help", force: false, errors: [`unknown command "${command}"`] };
-  const work = command === "work";
-  const workVerb = tail[0];
-  const rest = work ? tail.slice(1) : tail;
-  if (work && !["add", "list", "show"].includes(workVerb)) return { command: "work-add", force: false, errors: ["work needs add, list or show; /grants work opens guided setup in Pi"] };
-
+  if (command === "ledger") {
+    // ADR-0076 PR 3d: `ledger repair <path> [--yes]` previews, --yes truncates; `ledger import <source> <target>`.
+    const [verb, target, ...flags] = tail;
+    if (verb === "import") {
+      const [source, dest, ...extra] = tail.slice(1);
+      if (!source || !dest || source.startsWith("-") || dest.startsWith("-") || extra.length)
+        return { command: "help", force: false, errors: ["ledger import needs: <source> <target>"] };
+      return { command: "ledger-import", force: false, errors: [], ledgerPath: source, importTarget: dest };
+    }
+    if (verb !== "repair" || !target || target.startsWith("-"))
+      return {
+        command: "help",
+        force: false,
+        errors: ["ledger needs: repair <path> [--yes] | import <source> <target>"],
+      };
+    const unknown = flags.filter((f) => f !== "--yes");
+    if (unknown.length) return { command: "help", force: false, errors: [`unknown option "${unknown[0]}"`] };
+    return { command: "ledger-repair", force: false, errors: [], ledgerPath: target, yes: flags.includes("--yes") };
+  }
+  if (command !== "init") return { command: "help", force: false, errors: [`unknown command "${command}"`] };
   const errors: string[] = [];
-  let dir: string | undefined;
   let force = false;
-  let id: string | undefined, outcome: string | undefined;
-  for (let i = 0; i < rest.length; i += 1) {
-    const arg = rest[i];
-    if (arg === "--force" && !work) {
+  let dir: string | undefined;
+  for (let i = 0; i < tail.length; i += 1) {
+    const arg = tail[i];
+    if (arg === "--force") {
       force = true;
-    } else if (arg === "--id" && work && workVerb === "add") {
-      const value = rest[i + 1];
-      if (value === undefined || value.startsWith("-")) errors.push("--id needs a value");
-      else { id = value; i += 1; }
-    } else if (arg === "--outcome" && work && workVerb === "add") {
-      const value = rest[i + 1];
-      if (value === undefined || value.startsWith("-")) errors.push("--outcome needs text");
-      else { outcome = value; i += 1; }
     } else if (arg === "--dir") {
-      const value = rest[i + 1];
-      // A flag is not a path. Without this, `--dir --force` consumed the flag as the directory AND left
-      // force on, then reported "nothing to scaffold" and exited 0 — the outcome this CLI's own comments
-      // call the worst available failure for a scaffolding command.
+      // A flag is never a path: `init --dir --force` used to scaffold into a directory named `--force`.
+      const value = tail[i + 1];
       if (value === undefined || value.startsWith("-")) errors.push("--dir needs a path");
       else {
         dir = value;
         i += 1;
       }
     } else {
-      // Was `rest.filter((a, i) => … && i !== dirIndex + 1)`, and with `--dir` absent `dirIndex` is -1, so
-      // the exemption became `i !== 0` and the FIRST argument was never checked. `init --Force` therefore
-      // parsed as a valid no-op run: it kept every file and exited 0, which is indistinguishable from a
-      // deliberate second run. Found by a reviewer, not by a test, because this file had none.
       errors.push(`unknown option ${arg}`);
     }
   }
-
-  if (work && workVerb !== "add") return { command: workVerb === "list" ? "work-list" : "work-show", force: false, errors, ...(dir ? { dir } : {}) };
-  if (work) {
-    if (!id && !errors.some(error => error.startsWith("--id"))) errors.push("--id needs a value");
-    if (!outcome && !errors.some(error => error.startsWith("--outcome"))) errors.push("--outcome needs text");
-    return { command: "work-add", force: false, errors, ...(id ? { id } : {}), ...(outcome ? { outcome } : {}), ...(dir ? { dir } : {}) };
-  }
   return { command: "init", dir, force, errors };
 }
 
@@ -133,7 +137,9 @@ async function init(cwd: string, force: boolean): Promise<number> {
     console.log(
       `pi-daddy init: no enabled configured skills or unregistered npm package declares skills (a package.json "pi": {"skills": [...]} ` +
         `field). Nothing to scaffold.\n\nLooked in:\n` +
-        skillPackageRoots(cwd).map((r) => `  ${r}\n`).join("") +
+        skillPackageRoots(cwd)
+          .map((r) => `  ${r}\n`)
+          .join("") +
         `\n  pi install npm:principal-pi-skills    # seven skills, and registers it with pi\n` +
         `  npm install principal-pi-skills      # or pin it in this project instead`,
     );
@@ -158,7 +164,9 @@ async function init(cwd: string, force: boolean): Promise<number> {
     console.log(
       `found ${pkg.name}@${pkg.version} — ${pkg.skills.length} skill(s), ` +
         `${declaring} declaring allowed-tools` +
-        (pkg.unreadable.length > 0 ? `, ${pkg.unreadable.length} declared but unreadable (${pkg.unreadable.join(", ")})` : "") +
+        (pkg.unreadable.length > 0
+          ? `, ${pkg.unreadable.length} declared but unreadable (${pkg.unreadable.join(", ")})`
+          : "") +
         // Counted on this line as well as named below it: a reader who stops at the first line must not
         // read "0 skill(s)" as "this package ships none".
         (pkg.refused.length > 0 ? `, ${pkg.refused.length} REFUSED` : ""),
@@ -171,21 +179,22 @@ async function init(cwd: string, force: boolean): Promise<number> {
   // `--force` is destructive and says so at the moment it acts, not only in `--help` — which is the one
   // place the operator running the command is not reading.
   if (force) {
-    const existing = plan.skills.filter(s => !s.referenced).length;
+    const existing = plan.skills.filter((s) => !s.referenced).length;
     console.log(
       `\n--force: rewriting up to ${existing} SKILL.md cop${existing === 1 ? "y" : "ies"} from the installed\n` +
-        `packages. Any \`allowed-tools\` you wrote in them is DISCARDED. .pi/grants.env is never rewritten.`,
+        `packages. Any \`allowed-tools\` you wrote in them is DISCARDED. settings.json is never rewritten.`,
     );
   }
 
   const outcome = await applyInit(plan, { force });
   const short = (path: string) => relative(cwd, path) || path;
-  for (const skill of plan.skills.filter(s => s.referenced)) console.log(`using ${short(skill.sourcePath)} (enabled in Pi; no copy)`);
+  for (const skill of plan.skills.filter((s) => s.referenced))
+    console.log(`using ${short(skill.sourcePath)} (enabled in Pi; no copy)`);
   for (const path of outcome.written) console.log(`wrote ${short(path)}`);
   for (const path of outcome.kept) console.log(`kept  ${short(path)} (already present — left exactly as it is)`);
   for (const failure of outcome.failed) console.error(`FAILED ${short(failure.path)}: ${failure.error}`);
 
-  report(plan);
+  await report(plan);
   // A refusal is a non-zero exit so CI can see it: a package that tried to write a capability into the
   // grant through a name or a declaration is a fact a build should be able to fail on.
   return outcome.failed.length > 0 || refused.length > 0 ? 1 : 0;
@@ -210,7 +219,7 @@ function reportRefusal(pkg: SkillPackage, refusal: RefusedSkill): string {
       return (
         `${head} declares ${refusal.detail.join(", ")} — that is root authority, not a description of what ` +
         `the skill needs, and a package may not hand it to itself. ${refusal.detail.includes("tool:*") ? "tool:* satisfies EVERY capability" : "agent:* authorises every definition on disk"}. ` +
-        `Add it by hand to PI_GRANTS_GRANT if you genuinely mean it.`
+        `Add it by hand to PI_DADDY_GRANT if you genuinely mean it.`
       );
     case "not-utf8":
       return `${head} is not valid UTF-8, so it cannot be copied verbatim — pi-daddy will not rewrite its bytes.`;
@@ -218,7 +227,7 @@ function reportRefusal(pkg: SkillPackage, refusal: RefusedSkill): string {
 }
 
 /** What the operator has to do next, and what pi-daddy deliberately did not do for them. */
-function report(plan: InitPlan): void {
+async function report(plan: InitPlan): Promise<void> {
   const undeclared = plan.skills.filter((s) => s.withheld === "undeclared");
   const patterned = plan.skills.filter((s) => s.withheld === "pattern");
 
@@ -231,7 +240,7 @@ function report(plan: InitPlan): void {
         `${undeclared.map((s) => s.name).join(", ")}.\n` +
         `Each copy carries a commented \`allowed-tools:\` line. pi-daddy does not choose ceilings — that\n` +
         `decision is what you review and commit, so it is yours to write. Then add each \`agent:<name>\`\n` +
-        `to PI_GRANTS_GRANT in .pi/grants.env.`,
+        `to the grant in ${SETTINGS_REL}.`,
     );
   }
 
@@ -239,7 +248,7 @@ function report(plan: InitPlan): void {
     const needed = [...plan.withheldCapabilities].map(([c, who]) => `${c} (${who.join(", ")})`).join(", ");
     console.log(
       `\nWITHHELD BY DEFAULT: ${needed}.\n` +
-        `These can change your machine, so they are written COMMENTED in .pi/grants.env along with the\n` +
+        `These can change your machine, so they are listed under \`withheld\` in settings.json along with the\n` +
         `\`agent:\` ids of the definitions that need them. Uncomment deliberately — that is the decision.`,
     );
   }
@@ -256,8 +265,8 @@ function report(plan: InitPlan): void {
     const blocked = plan.skills.filter((s) => s.withheld === "needs-withheld").map((s) => s.name);
     console.log(
       `\nROUTABLE WORKSPACES: ${plan.routableWorkspaces.join(", ")}.\n` +
-        `Routing a child to one needs its id in PI_GRANTS_GRANT (ADR-0035); without it the delegation is\n` +
-        `refused WORKSPACE_NOT_AUTHORIZED. They are listed COMMENTED in .pi/grants.env and never granted for\n` +
+        `Routing a child to one needs its id in PI_DADDY_GRANT (ADR-0035); without it the delegation is\n` +
+        `refused WORKSPACE_NOT_AUTHORIZED. They are listed under \`routableWorkspaces\` in settings.json and never granted for\n` +
         `you — which worktree a child starts in is not something a package can declare.` +
         (blocked.length > 0
           ? `\nUntil you grant one, these cannot be spawned: ${blocked.join(", ")} — add the capability, then\n` +
@@ -268,12 +277,17 @@ function report(plan: InitPlan): void {
 
   console.log(
     `\nLive grant (${plan.grant.length} capabilities): ${plan.grant.join(", ")}\n\n` +
-      `  $EDITOR .pi/grants.env         # review it, then commit it\n` +
-      `  source .pi/grants.env && pi    # /grants lists every definition and its verdict`,
+      ((await settingsIgnoredByGit(plan.settingsPath)) === true
+        ? `  NOTE: git ignores ${SETTINGS_REL} (root .gitignore covers ${PI_PROJECT_DIR}/); add ${GITIGNORE_REINCLUDE_LINES.join(" and ")} to commit it\n`
+        : "") +
+      `  $EDITOR ${SETTINGS_REL}   # review it, then commit it\n` +
+      `  pi                                   # /grants lists every definition and its verdict`,
   );
 }
 
 export async function main(argv: string[]): Promise<number> {
+  const adoptedLegacy = adoptLegacyEnvironment(process.env);
+  if (adoptedLegacy.length > 0) console.error(legacyEnvironmentWarning(adoptedLegacy));
   const parsed = parseArgs(argv);
 
   if (parsed.command === "version") {
@@ -293,31 +307,64 @@ export async function main(argv: string[]): Promise<number> {
     console.log(USAGE);
     return 0;
   }
-  if(parsed.command==="guide"||parsed.command==="current"){
-    console.log(await readFile(new URL(parsed.command==="guide"?"../PRODUCT-GUIDE.md":"../REQUIREMENTS.md",import.meta.url),"utf8"));return 0;
-  }
-  if (parsed.command === "work-list" || parsed.command === "work-show") {
-    const cwd=resolvePath(parsed.dir??process.cwd());
-    if(parsed.command==="work-list") {const setups=await listWorkSetups(cwd);console.log(setups.map((s,i)=>`${i+1}. ${panelText(s.setup.outcome)} — ${s.setup.tasks.length} tasks; up to ${s.setup.maxParallel} parallel`).join("\n")||"No saved multi-task setups. In Pi: /grants work");}
-    else {const state=await loadDeclaredWork(resolvePath(cwd,".pi/work-current.json")),view=state?await workPresentation(state):null;console.log(view?[panelText(view.outcome),...view.obligations.map(o=>`- ${panelText(o.outcome)}`)].join("\n"):state?"Selected legacy work; outcome text unavailable":"No work selected. In Pi: /grants work");}
-    return 0;
+  if (parsed.command === "ledger-import") {
+    const source = resolvePath(process.cwd(), parsed.ledgerPath!),
+      target = resolvePath(process.cwd(), parsed.importTarget!);
+    const result = await importLegacyLedger(source, target);
+    if (result.skipped === "source-missing") {
+      console.error(`pi-daddy: no such file: ${source}`);
+      return 1;
+    }
+    if (result.skipped === "target-exists") {
+      console.error(`pi-daddy: ${target} already exists; import writes only into a new file`);
+      return 1;
+    }
+    console.log(
+      `pi-daddy: imported ${result.imported} record(s) from ${source} into ${target}; the source is untouched` +
+        (result.stoppedAt !== null ? `. Stopped at unparsable source line ${result.stoppedAt}.` : "."),
+    );
+    return result.stoppedAt === null ? 0 : 1;
   }
-  if (parsed.command === "work-add") {
-    const declared = await declareWork({
-      cwd: resolvePath(parsed.dir ?? process.cwd()),
-      id: parsed.id!,
-      outcome: parsed.outcome!,
-    });
+  if (parsed.command === "ledger-repair") {
+    const path = resolvePath(process.cwd(), parsed.ledgerPath!);
+    const preview = await repairLedger(path, { apply: false });
+    if (preview.missing) {
+      console.error(`pi-daddy: no such file: ${path}`);
+      return 1;
+    }
+    if (preview.preFormat) {
+      console.error(
+        `pi-daddy: ${path} predates the record format; repairing it would delete it whole. ` +
+          `Run \`pi-daddy ledger import ${path} <target>\` instead. Nothing was changed.`,
+      );
+      return 1;
+    }
+    if (preview.dropped.length === 0) {
+      console.log(`pi-daddy: ${path} is intact (${preview.keptLines} records); nothing to repair`);
+      return 0;
+    }
+    // Line numbers and sizes only: a torn line can contain exactly the task text this program never prints.
     console.log(
-      `pi-daddy work: declared ${declared.id}\n` +
-      `  ledger    ${declared.ledgerPath}\n` +
-      `  selection ${declared.statePath}\n\n` +
-      `Ordinary governed delegations from this project will record attempts after the Pi extension loads it.\n` +
-      `Run /reload in an existing Pi session, then /grants dashboard. Runtime success is not acceptance.`,
+      `pi-daddy: ${path} is damaged after record ${preview.keptLines}; ${preview.dropped.length} line(s) would be dropped:\n` +
+        preview.dropped
+          .map((line, i) => `  line ${preview.keptLines + i + 1}: ${Buffer.byteLength(line, "utf8")} bytes`)
+          .join("\n"),
     );
+    if (preview.droppedParseable > 0)
+      console.log(
+        `pi-daddy: WARNING — ${preview.droppedParseable} of those lines still parse as records. This looks like damage in the ` +
+          `middle of the file, not a torn tail; repairing drops every record after it. Inspect before you truncate.`,
+      );
+    if (!parsed.yes) {
+      console.log(
+        "pi-daddy: preview only. Re-run with --yes to truncate the damaged tail; intact records are never rewritten.",
+      );
+      return 1;
+    }
+    const result = await repairLedger(path, { apply: true });
+    console.log(`pi-daddy: dropped ${result.dropped.length} line(s); ${result.keptLines} records remain`);
     return 0;
   }
-
   // ABSOLUTE, always. `readSkill` compares a resolved entry against the package directory, and a relative
   // `--dir` made that comparison false for every entry: every declared skill of every package was reported
   // "declared but unreadable", nothing was copied, a degenerate grants.env was written anyway, and the exit