pi-daddy 0.27.4 → 0.32.0

package/contracts/debrief/v2/input-pin.json

@@ -1,66 +0,0 @@
-{
-  "repository": "https://github.com/mojomanyana/skill-harness",
-  "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-  "sources": [
-    {
-      "source": "packages/core/src/work-capture.ts",
-      "target": "work-capture.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "a258861619e92d5b41336ee83d41c42fec33212643c22b7d6ace8e55561b98ea"
-    },
-    {
-      "source": "packages/core/src/work-signals.ts",
-      "target": "work-signals.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "5e14a6069bcecfd358b5e3d034a78ee896c6f7f646c8208d8233cb9dd751dca4"
-    },
-    {
-      "source": "packages/core/src/intervention.ts",
-      "target": "intervention.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "05377d1045942334016e7154bb092cf2fdeb4d95c86c2c4170b321f11d9d0312"
-    },
-    {
-      "source": "packages/adapters/src/evidence-archive.ts",
-      "target": "evidence-archive.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "f41fd69daa4326cefad673fbf4eee2e0c44aa12de595d8a9c4deec209fe38807"
-    },
-    {
-      "source": "packages/adapters/src/work-case-archive.ts",
-      "target": "work-case-archive.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "6998556f29c068ae8d5f383b76e913f429235aa90bb6f50e34a20785d870d4a6"
-    },
-    {
-      "source": "packages/adapters/src/work-case-review.ts",
-      "target": "work-case-review.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "d7b374c80f182b20367a3968d9815fffae8ca70a452a5c6f246e7678158c7a7a"
-    },
-    {
-      "source": "packages/adapters/src/work-signal-cases.ts",
-      "target": "work-signal-cases.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "947dc22f35e8f40510e8a37c5630fd38afe2400c112993f322e2bce8af4f467f"
-    },
-    {
-      "source": "packages/adapters/src/work-signal-observation.ts",
-      "target": "work-signal-observation.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "b97b727f2c90634f977abbba837411d01b96eb24c85430ea129c97956b48efac"
-    },
-    {
-      "source": "packages/adapters/src/blind-intervention.ts",
-      "target": "blind-intervention.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "9b73d85927cc3386b9ab2fae7e647793929e360e5fda892e4db2ab692ab756e4"
-    },
-    {
-      "source": "packages/adapters/src/work-candidates.ts",
-      "target": "work-candidates.ts.txt",
-      "commit": "638494af0a0058edf9a9b1b02e57af894ab46ed6",
-      "sha256": "2b0bd7188b9da6951f050e9889ed3fdf5adafbd4b5cc5a81ec417a14fac20117"
-    }
-  ]
-}

package/contracts/debrief/v2/intervention-upstream.md

@@ -1,40 +0,0 @@
-# Frozen intervention comparison primitives — P12 partial, P08 fixture input
-
-This is a SEPARATE family from existing fixed-model `buildComparison`/`compare`. Their same-model/judge/input guards are unchanged. No model is launched here.
-
-`freezeIntervention` binds an investigation digest, common scenario/rubric/fixture/held-out/harness/judge-policy inputs, mode, repetition/criterion/critical thresholds, resource metric and explicit candidate axes. Undeclared model/effort/skill/prompt/configuration changes reject. Multiple changed axes are a package intervention, not evidence of one variable's causal effect. LLM sampling is not claimed deterministic.
-
-`assertInterventionRoles` is a pre-spend check over independently resolved HOST context. Missing roles and proposer/judge/subject canonical identity conflicts refuse. Same subjects may repeat across arms. It does not resolve providers, authenticate arbitrary context or qualify a delivery route. Do not derive qualification or expected evidence digests from incoming arm claims.
-
-`assessIntervention` checks exact host-confirmed evidence digests and frozen input/cell policy. Delivery NOT-MEASURED/ERROR and missing/unknown/suspect cells keep the comparison incomplete; objective failure prevents judging/eligibility. Votes are retained per criterion. Actual output bytes must match per-cell/arm hashes; digests alone are missing evidence. Retained bytes are copied for later blind reads. Cheap failed arms cannot become eligible. Cheapest eligible is only a conditional measurement; routingDefault is always null and adoptionAuthorized false.
-
-`interventionEvidenceFromResults` uses existing schema3 validation and retains complete source results/votes beside the summary. It requires recorded `source_hashes['intervention:manifest']` and `['intervention:inputs']`, matching model/mode/judge/plan, and supplied output bytes. It never stamps missing bindings onto historical runs. Multi-judge conversion is not yet supported rather than choosing a convenient panel vote. The orchestrator that records these bindings and qualifies actual execution remains integration work.
-
-## Blind view API
-
-```ts
-const blind = createBlindComparison(manifest, recomputedAssessment);
-const view = blind.view(); // opaque labels + artifact hashes + explicit clue limitation; no configuration/cost
-const bytes = blind.readArtifact(label, artifactHash); // only retained bytes admitted to that label
-blind.choose({kind:'one'|'tie'|'none'|'insufficient', labels:[/* opaque labels, or [] */]});
-const revealed = blind.reveal(); // refuses before choice; different choice refuses after reveal
-```
-
-An optional private seed supports fixtures/host-controlled restoration; real independent views need fresh private randomness, not a public fixed seed. Public view omits identity metadata, but arbitrary artifact text may reveal clues. The host must enforce user/judge identity, persist quality/seed/reveal state before exposure, and expose only the public view/read methods before choice. This in-memory API is not durable human authentication or proof a host did not leak the assessment/configuration. P08 must keep its total five-card budget and real pause/exposure boundaries.
-
-`fixtures/` is generated by actual code from fixed synthetic evidence, retained Layout A/B bytes, fixture role identities and a public zero seed. It is NOT live qualification, real human blinding, efficacy or casting evidence. It supplies a concrete UI contract: blind-view.json before choice; choice.json; reveal.json only afterward.
-
-## Durable local blind review
-
-`retainBlindIntervention(root, manifest, evidence, qualification, author)` explicitly retains a private comparison and returns its immutable archive ID. It checks the actual supplied output bytes and complete assessment before retention; roles remain independently supplied host declarations, not authentication. An independent random seed is retained privately with each new comparison. `openBlindIntervention(root, id, author)` reopens exactly that comparison. Each `view`, `quality`, `readArtifact`, `choose` and `reveal` re-reads verified archive inputs and recomputes the assessment and label mapping; no stored eligibility verdict is trusted. Artifact loss blocks access, including reveal.
-
-The durable adapter intentionally commits ONE immutable initial quality choice, stricter than the in-memory primitive's editable pre-reveal choice. `quality()` reads it without revealing identity/cost; `reveal()` refuses until it exists. Same-choice resubmission is read-only and idempotent; a different choice refuses even after process restart. An atomic directory claim admits one initial writer; a competing writer may observe a conflict or incomplete claim, never overwrite it. Partial/missing/malformed claimed records require explicit recovery, not automatic deletion or another vote. A write/fsync error can follow a committed choice: retain unknown acknowledgement and inspect that same comparison. No automatic retry or filesystem cleanup occurs.
-
-Private archive ownership is required. This is not protection against a malicious same-UID owner deleting/rewriting an archive or creating a separate comparison, remote user authentication, automatic exposure, a claim that artifact content cannot disclose identity, or crash-durability proof beyond successful file/directory synchronization. Choice files live under `blind-decisions/<comparison-id>/choice.json`; archive metadata (including seed/roles/cost) is operator-private, never a dashboard payload. Only the restricted view/artifact/quality methods go to a pre-reveal client. Records are bounded (2MiB input JSON, 8MiB per artifact/64MiB aggregate, 4096 artifacts, 16KiB choice read). No provider call, routing default or adoption is introduced.
-
-Remaining P12: qualified model-backed orchestration, complete panel/authenticated blind workflow, verified role/receipt integration, applicable casting rows/uncertainty/revalidation and live P08 demonstration. Full acceptance and any routing/adoption default remain pending.
-
-```sh
-node scripts/generate-intervention-fixture.mjs --check
-node node_modules/vitest/vitest.mjs run packages/core/test/intervention.test.ts packages/core/test/intervention-results.test.ts packages/core/test/comparison.test.ts
-```

package/contracts/debrief/v2/work-signals-upstream.md

@@ -1,22 +0,0 @@
-# Frozen work signals and explicit review bridge — v1
-
-Additive adapter APIs, not a reinterpretation of `contracts/work-capture/v2`.
-
-1. `retainWorkSignalObservation(root, snapshot, facts)` validates closed bounded host declarations and retains canonical `work-signal-observation-v1` bytes. Returns `{manifestId,inputSha256}`.
-2. `readWorkSignalObservation(root, manifestId)` reopens verified bytes and rederives `work-signals-v1` cases. It rejects missing/corrupt/mismatched/unsupported input; unknown scope stays an explicit issue, not an empty success claim.
-3. `captureWorkSignalCases(root, observationId)` creates immutable case references and a selected batch. Case parser `work-signal-case`/`1` stores `{version:'work-signal-case-v1',observationId,caseId}`; no cached verdict. Batch parser `work-signal-batch`/`1` stores `{version:'work-signal-batch-v1',observationId,candidateIds,visibility:'silent',promotion:'not-authorized'}`. Both source identities bind the referenced observation/case.
-4. `createWorkSignalReviewer(root,batchId,operatorAuthor)` exposes `list(offset=0,limit=5)`, `history(caseManifestId)` and `decide({caseManifestId,priorDecisionId,disposition,note})`. Decisions use the existing durable lock/CAS/history writer and `decision_schema:1`. No new history engine or worker control path.
-
-Each selected case is rederived from its original input on access, including immediately before decision storage. Case membership in the exact observation is checked; a valid case from a different observation cannot be substituted. Missing original input blocks decisions. `list` additionally returns `observationId` and observation `issues`, so unresolved scope with zero cards is not hidden. Counts describe the selected batch, not exhaustive live work or calibration denominators.
-
-Defect cards have `capture_schema:3` and explicit `overdue_checkpoint`, `reopened_acceptance`, or `intent_conflict` reason/metrics. Coverage issues retain `capture_schema:2`. Both remain silent/unresolved/causal-not-established nominations. The old `createWorkCaseReviewer` accepts only its original v2 batch contract and REFUSES these new batches. A UI must opt into this bridge and these card versions; existing pi-daddy pinned v2 clients are not upgraded by this library addition.
-
-`operatorAuthor` and supplied facts are conditional host declarations, not authentication. Retained inputs do not prove the truth/availability of external referenced evidence, active branch, an authenticated human pause or authority to expose/promote/adopt. Live source capture, actual dashboard version selection, privacy/role authority and automatic pause/exposure policy remain integration work.
-
-Limits: closed input arrays at most256 entries, input bytes at most1MiB, selected batch at most1024 unique case manifest IDs, batch/case payload reads at most128KiB, pages at most5. Existing non-expiring decision locks and1MiB history bound remain. Trusted local archive integrity is not hostile same-UID containment, rollback resistance or a storage quota.
-
-`captureArchivedWorkSignals(root,workManifestId,independentWorkContext,facts)` additionally consumes the pinned real Work-v4 reader. It derives scope, binding identities, coverage and acceptance from the actual projection rather than accepting replacement fields from the signal caller. Its `archived-work-signals-v1` link retains the raw source identity, producer pin, full projection, frozen observation and review batch references. Missing/malformed/unselected work refuses. Missing authority remains coverage, even when a supplied objective fact says FAIL.
-
-This adapter's `work-v4-revision-digests-v1` binding profile uses obligation/intent/policy/artifact REVISION digests, not artifact content digests; prior-acceptance facts must use the same profile. A valid P01 selection with multiple bindings for the same obligation digest is currently refused by the narrower signal profile, never collapsed. The retained full projection preserves detailed coverage/problems; the signal projection remains conservative. Supplied checkpoint/outcome facts and Work context still need independent host provenance/authorization. No live collection or authentication is created by this mapping. Original work bytes are verified at capture; the case reader subsequently verifies its retained input, not every external artifact mentioned in that input.
-
-Changing rule semantics requires a new explicit observation format/reader. Preserve old inputs, outcomes and decision corrections; never silently relabel a saved nomination or erase an unknown result.

package/contracts/dispatch-control/v1/README.md

@@ -1,109 +0,0 @@
-# P05 bounded dispatch control v1 — contract for P15
-
-Later local continuation: [actual P01 intent application](../../intent-control/v1/README.md) supplies
-scope/priority/alternative adapters under a separate v3 resource binding and intent protocol. The matrix
-below remains the contract for **this v1 dispatch-only protocol**, not a permanent claim of external blockers.
-
-Implemented local candidate; overall review and formal acceptance pending. This is **not general live
-worker steering**. No new dashboard authority database, model judgment, worker prompt, terminal typing,
-Herdr control call or background reconciler is introduced. P04 status remains read-only and unchanged.
-
-## Exact action matrix
-
-| Request | Supported target/boundary | Result |
-| --- | --- | --- |
-| `pause-dispatch` | One independently bound **v2 resource budget**; application only under the reservation lock with zero active reservations | Pause future reservations; never interrupt admitted work |
-| `resume-dispatch` | Same exact budget and zero-reservation boundary | Re-enable only its original fixed limits; no scope/effect expansion |
-| Busy pause/resume | Same budget, original live permits still outstanding | Pending; admission barrier blocks new reservations; explicit authorized reconciliation after settlement |
-| `cancel-execution` | No atomic durable request-to-live-executor cancellation primitive implemented | Explicit unsupported/not-applied, never ordinary steering or terminal fallback |
-| `revise-scope`, `reprioritize`, `select-alternative` | No supported atomic P01 revision application adapter supplied | Explicit unsupported/not-applied; work-v4 remains sole intent source |
-| Targeted live pi/Herdr steering | No verified atomic session/target/safe-boundary mechanism established | BLOCKED; pane/title/PID/idle/last-entry facts are not authority |
-| Arbitrary bash/model/shared-write or alternative budget/lease stores | Outside the partial P06 profile | BLOCKED; no global dispatch/containment claim |
-
-The useful demonstrated route is `prepareDigestProfile(v2Binding)` / `runDigestProfile`: its actual existing
-reservation seam obeys the gate. Preparation probes are not workload dispatch and are not disabled by the
-workload gate. Other budgets and executors that do not use this binding are not governed. The boundary is
-**verified reservation quiescence**, not global process silence or an authenticated live-pi safe point.
-P06's original live owner settles its own permit after executor finalization; orphan reservations remain
-active across restart. There is no PID/TTL/receipt-based recovery or general worker-state inference.
-
-## Authority and revision
-
-The host retains the independently created budget binding and supplies independent `DispatchAuthority`
-declarations: its exact authority digest plus at most 128 approved request digests. These are trusted host
-inputs, not request metadata, authentication credentials or a wire-authority loader. A host must not derive
-approval from an incoming request/claimed result or merely copy its identifiers. Defaults are denied.
-No mutable approval list is persisted. Existing trusted-store/same-UID/rollback limitations still apply;
-this library is not a remote authentication boundary or a revocable distributed authority service.
-
-`DispatchRequest` has a closed version `1.0`, immutable request ID, exact `bindingDigest`, expected **dispatch
-revision**, action and nullable execution target. That revision is operational budget state, **not a P01
-scope revision**. Requests cannot rewrite P01 intent or claim acceptance. `targetExecutionId` is non-null
-only for the distinct unsupported cancellation route. Wire input uses `parseDispatchRequest` (4096-byte
-limit, duplicate-aware/exact numeric parsing); `request.schema.json` describes the decoded closed shape.
-Do not first round lossy numeric tokens through JSON.parse and call them validated original wire bytes.
-
-Use `dispatchRequestDigest` over the complete canonical request to join independent approval. Missing/wrong
-authority refuses; then unsupported route, stale revision and another pending decision refuse. One approved
-request advances dispatch revision immediately, including when busy; stale UI cannot supersede it. A busy
-admission barrier prevents new reservations while existing work drains. The application itself waits for
-zero active reservations under the same non-stale-recoverable lock used by reserve/settle. A barrier is not
-a claim that pause has already applied, or that the active worker stopped.
-
-```ts
-import { createDispatchBudget, openResourceBudget } from 'pi-daddy/resource-budget';
-import { parseDispatchRequest } from 'pi-daddy/dispatch-control';
-// One-time host creation under an explicitly owned private parent; persist binding independently.
-const binding = await createDispatchBudget({ directory, authorityDigest, limits });
-const budget = openResourceBudget(binding);
-const controls = budget.controls(independentHostDeclarations); // or null: no authority
-const request = parseDispatchRequest(operatorRequestBytes);
-const result = await controls.request(request);
-const observed = await controls.inspect(); // read-only; never calls request/reconcile
-// Only an explicit authorized controller operation may apply pending work:
-const reconciled = await controls.reconcile(request.requestId);
-```
-
-## Durable request / decision / application / outcome
-
-No parallel intent store: controls extend the existing pinned `budget.jsonl` transaction and reservation
-replay. **Explicit binding/header version 2.0** opts into these semantics; unchanged `createResourceBudget`
-still creates v1.0 and retains its v1 static return type. Old v1 readers reject a v2 binding rather than
-silently skipping controls. No conversion/reset/in-place upgrade API exists.
-
-- `control-request` atomically records the exact request and its approved/refused decision. Approved state
-  starts pending with boundary-pending outcome; refusals are not-applied/refused. Each ID occupies one slot.
-- `control-apply` records application of the one approved pending request and projects its paused/enabled
-  outcome. It is invalid when reservations are active. No transport callback or caller-supplied receipt
-  may mark application. `reserve` replays and enforces both committed pause and the pending barrier.
-- `DispatchSnapshot` version `dispatch-control-snapshot-v1` includes exact binding digest, revision, paused
-  flag, **admission: blocked-pending|paused|enabled**, immutable records and `acceptance:not-assessed`.
-  Freshness is `snapshot-unknown`. Readback is not work acceptance or new host authorization.
-- An exact duplicate ID/digest only reads the existing result, including pending. It never applies, emits
-  another record or repeats an effect. Reusing an ID for another digest rejects. Reconciliation explicitly
-  names one exact request ID and rechecks its independently supplied approval and boundary; another ID
-  cannot reconcile the pending request. Repeated reconciliation is idempotent.
-- No acknowledgement or a thrown I/O/cleanup error means the caller must retain **unknown application**;
-  it must not assume success or silently retry a new ID. A complete append may precede an error, including
-  fsync/close/lock-cleanup failure: this is not a no-write/no-effect-on-error guarantee. Inspect/reconcile
-  the exact ID in the bound store. A pending record is not application; a complete current application
-  record is readback, not proof of crash durability, authenticated remote delivery or live worker state.
-
-Mandatory failures reject, including after bytes were written. Partial/invalid/replaced journals refuse
-further admission; no truncation, alternate store or recovery credit is attempted. Capacity is bounded by
-128 request records and at most 128 applications in addition to the existing attempt/settlement limits,
-2305 total v2 lines and 2 MiB. Cumulative attempts/bytes are never refunded. Read-only inspections use
-O_RDONLY, no lock creation, bounded descriptor/path consistency checks and no write/control callbacks.
-Concurrent changes can make an inspection fail; no old state is substituted.
-
-## Evidence and exclusions
-
-Ordinary owned fixtures exercise real file locking, cross-process duplicate delivery, exact independent
-fixture declarations, busy original permits, stale revisions, missing authority, mandatory-sync failure,
-source replacement/partial data, read-only byte/directory preservation and actual probed fixed-digest
-execution behind the gate. They do not qualify hostile same-UID writers, rollback resistance, complete
-controller-crash cleanup or installed/live pi/Herdr operation. No native/model test messages were sent.
-
-P02 native branch/availability gaps, P04 unqualified live freshness/transport, and P06 arbitrary-effect and
-aggregate CPU/memory/PID/disk/provider-money limitations remain. P15 must preserve this exact bounded matrix,
-unknown acknowledgements, independent approval, request identity and acceptance separation.

package/contracts/dispatch-control/v1/request.schema.json

@@ -1,19 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "title": "P05 bounded dispatch request v1 (not authority)",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["version", "requestId", "bindingDigest", "expectedRevision", "action", "targetExecutionId"],
-  "properties": {
-    "version": { "const": "1.0" },
-    "requestId": { "type": "string", "pattern": "^[a-zA-Z0-9:_-]{1,128}$" },
-    "bindingDigest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
-    "expectedRevision": { "type": "integer", "minimum": 0, "maximum": 128 },
-    "action": { "enum": ["pause-dispatch", "resume-dispatch", "cancel-execution", "revise-scope", "reprioritize", "select-alternative"] },
-    "targetExecutionId": { "anyOf": [{ "type": "null" }, { "type": "string", "pattern": "^[a-zA-Z0-9:_-]{1,128}$" }] }
-  },
-  "anyOf": [
-    { "properties": { "action": { "const": "cancel-execution" }, "targetExecutionId": { "type": "string" } } },
-    { "properties": { "action": { "enum": ["pause-dispatch", "resume-dispatch", "revise-scope", "reprioritize", "select-alternative"] }, "targetExecutionId": { "type": "null" } } }
-  ]
-}

package/contracts/effect-profile/v1/README.md

@@ -1,124 +0,0 @@
-# P06 local candidate: a fixed digest boundary and durable resource accounting
-
-**Version 1.0, local only; overall review and formal acceptance pending.** This is not a sandbox for pi,
-bash, arbitrary JavaScript, model invocations, or writable workspaces. Existing delegation/check behavior
-is unchanged. The one supported new operation is `linux-bwrap-digest-v1`: hash at most 16 KiB of byte input
-with a fixed trusted worker and return its digest/length on stdout. It is useful for independently checking
-small evidence payloads, not executing an arbitrary factory order. Full P06 remains only partially covered.
-
-The unchanged executable guard checks Linux, resolved Node then exact bwrap/prlimit paths, regular-file
-type, no group/other write bits, and size<=256MiB. Refusals keep the original error message and add exact
-path/details plus RUNTIME_NOT_REGULAR / RUNTIME_WRITABLE / RUNTIME_TOO_LARGE. Independent read-only CI
-telemetry observes all prerequisites; conforms:false is not namespace success and does not skip tests.
-No installation, shared chmod, runner provisioning or host policy weakening is performed. Actual remote
-24.20 predicate remains unknown in the old logs; Node22's missing bwrap remains a provisioning blocker.
-
-## Public API
-
-`pi-daddy/resource-budget`: `createResourceBudget`, `openResourceBudget`, `resourceBindingDigest` and types.
-`pi-daddy/effect-profile`: `prepareDigestProfile`, `runDigestProfile`, `DIGEST_PROFILE` and types.
-Both are also exported from the root. Historical dist is not a build of these exports.
-
-```ts
-const binding = await createResourceBudget({
-  directory: '/operator-private/new-budget', // fresh child of a canonical owner-private directory
-  authorityDigest: independentlySelectedPolicyDigest,
-  limits: { maxAttempts: 8, maxInputBytes: 65536, maxConcurrent: 2 },
-});
-// Persist this detached/frozen binding in the trusted controller, separately from its journal.
-const profile = await prepareDigestProfile(binding); // actual bounded native probes; may reject
-const result = await runDigestProfile(profile, {
-  attempt: { attemptId: 'exec:unique', orderId: 'order:a', experimentId: 'experiment:b',
-    kind: 'primary', parentAttemptId: null },
-  bytes: Buffer.from('evidence'),
-}, signal);
-```
-
-The byte input and identity are detached before asynchronous work. No input is interpreted as code, an
-option, path, command, environment, lease store or destination. Byte input is base64-encoded in process
-argv; this is **not a secret-transport API**. Worker output is just digest/length, not raw input. The
-profile token is process-local and opaque: a JSON roundtrip or receipt-shaped object cannot admit work.
-The public producer validator/retention manifest is not an admission capability or work approval.
-
-## Actual boundary and supported/unsupported matrix
-
-| Route/property | Disposition |
-| --- | --- |
-| Linux bwrap user/mount/PID/network namespace setup | Observed supported on the measured WSL2 host; re-probed per prepared handle |
-| Owned outside-file read/write; mutation of owned read-only mount | Actual fixture attempts denied (`ENOENT`, `EROFS`), allowed fixture read succeeds |
-| Reach host loopback listener | Actual owned listener remains unreachable from the network namespace |
-| Untrusted code / shell / child launch API | Not exposed by this profile; Node permission child-process tripwire also actually denies spawn |
-| Worker cancellation | Existing `runChild` signal/deadline path; actual owned namespace worker/helpers observed stopped |
-| Cgroup aggregate CPU/memory/PID enforcement | Unsupported: no writable delegated cgroup measured |
-| `prlimit` | Per-process CPU/FD tripwire only, not aggregate limits; V8 heap flag is not an OS memory cap |
-| Persistent destinations / writable or shared workspace roots / alternative lease stores | Unsupported; absent from the closed API, no host workspace/store mounted |
-| Arbitrary pi/bash/model profiles; provider-money hard cap | Unsupported before workload launch; no fallback or inferred/posthoc dollar allowance |
-
-The launcher uses existing `/usr/bin/bwrap`, `/usr/bin/prlimit` and the current trusted Node executable.
-It drops capabilities **inside the child**, clears its environment, creates new namespaces and exposes
-only read-only system runtime directories plus the fixed Node binary. No host capability configuration,
-installation, privilege escalation or service/cgroup configuration changes are performed. The preparation
-probe alone mounts a fresh owned read-only fixture. That exact fixture is removed only after every awaited
-probe child has settled, on success and failure; removal failure is loud and does not replace an earlier
-probe failure. Old or caller-selected directories are never cleanup targets. The production worker mounts no user workspace.
-The production Node worker has permission mode enabled; Node permission mode by itself is not claimed
-as a hostile-JavaScript sandbox. Only fixed package code executes, so ungoverned descendants are not an
-admitted operation. Internal Node/helper threads/processes are not separate billable attempts.
-
-The selected binary fingerprints are pinned and rechecked before each workload. The operator/kernel,
-trusted package code, runtime installation and control-owned filesystem are the trust boundary. Runtime
-updates during an invocation, malicious same-UID host writers, rollback of trusted storage, kernel/runtime
-exploits and hostile-process containment are not qualified. Read-only bind mounts do not freeze a host
-administrator's runtime files. This route therefore cannot be relabelled a general shared-root sandbox.
-No user payload launches merely because executables exist or a caller claims a profile name.
-
-## What is actually reserved
-
-One independently retained `BudgetBinding` pins the canonical private directory and journal device/inode,
-external authority digest and closed limits. The budget is **one scope across all orders and experiments**
-using that binding, not a new allowance per logical name. A different binding is a different explicit
-scope, never proof of sharing an aggregate limit. There is exactly one fixed journal/lock location; the
-API offers no alternative lease-store override. Binding/header mismatch or physical replacement fails.
-
-Admission reserves **one cumulative attempt, its full input-byte count, and one active invocation slot**
-before the existing execution seam is called. Those are the only aggregate hard counters claimed. A
-maximum of 1024 attempts, 16 MiB cumulative inputs and 32 active invocations is configurable downward.
-No aggregate CPU, memory, disk, PID or money cap is asserted. Bounded trusted preparation probes are
-control/setup work, not admitted user attempts. There are no provider calls or money estimates.
-
-Primary, retry, shadow and explicitly governed descendant attempts all consume allowance; non-primary
-attempts require an existing parent reference in the same scope. A duplicate attempt ID is rejected,
-including redelivery after completion. Cancellation/failure never refunds attempts or bytes. The live
-controller releases only the active slot, after executor settlement; a mandatory settlement failure still
-rejects even if the worker exited zero. Existing finalization helpers preserve primary errors.
-
-Reopening preserves all outstanding charges/slots. An exited PID, timeout, new controller, late result or
-receipt-shaped data does **not** reclaim an orphan. Only the original live permit can settle its exact
-reservation; exact repeated settlement is idempotent and contradictory late settlement rejects. There is
-no recovery/reclaim API. Exhausted orphan capacity requires a separately designed, authorized quiescent
-reconciliation—not deleting a journal, new lease store, renamed directory or pretending a retry is free.
-
-The private journal is strict bounded JSONL, opened without symlink following, validated against independent
-binding/counters, serialized with the existing no-stale-recovery lock, and fsynced before launch. Incomplete
-writes fail closed without truncation/repair. A completed append can precede a cleanup error: no exactly-once
-blind retry guarantee. Creation is explicit/exclusive; reopening never creates/reset state. This relies on
-a trusted durable filesystem and sole cooperative host protocol, not tamper-proof consensus storage.
-
-Opt-in P02 retention records exact attempt/parent IDs, actual raw/result bytes and runtime outcomes. It is
-still `not-assessed`, and missing native session/branch fields do not become complete evidence.
-
-## Checks and limitations
-
-Direct Node tests (retained dependencies only):
-
-```sh
-node --test packages/pi-daddy/test/resource-budget.test.ts packages/pi-daddy/test/effect-profile.test.ts
-```
-
-These native effect tests require the demonstrated Linux/bwrap/Node primitive and deliberately fail rather
-than silently count unavailable containment as a passing qualification. Arithmetic tests include real
-cross-process contention, duplicate delivery, byte/count exhaustion, cancellation/restart, replaced stores,
-partial journals and immutable authority. Native tests use disposable owned fixtures and a local listener,
-not provider traffic or an untrusted hostile executable. A forwarding spawn observer verifies zero real
-spawn calls for unsupported inputs and a real post-spawn mandatory-accounting failure. No production test
-control, guard bypass, model review/test, installation or mutation machinery is introduced.

package/contracts/execution-retention/v1/README.md

@@ -1,109 +0,0 @@
-# Execution retention 1.0 — producer contract for P03
-
-Opt-in candidate API: `pi-daddy/execution-retention` (also the root export). This is a new archive
-manifest, **not** ledger v3/v4, a check-receipt schema revision, or acceptance authority. The TypeScript
-wire definition is `src/execution-retention.ts::ExecutionRetentionManifest`.
-
-## Activation and actual wiring
-
-The operator sets `PI_GRANTS_EXECUTION_ARCHIVE` to an absolute, private, operator-owned archive directory.
-No model-facing parameter is added. `delegate`, `delegate_all` and `delegate_chain` carry the actual
-public execute call ID into their shared governed executor. Each launch has its existing unique
-execution ID and parent execution ID; logical child names are NOT join keys. `runNamedCheck` uses the
-same retention writer and also accepts host `retentionDirectory` and `toolCallId` options. Unknown check
-parentage stays null. No correlation claim supplies any of these identities.
-
-The archive is asynchronous observation. Required provisioning/lease/check ledger writes retain their
-previous failure semantics; archive publication is never awaited on the worker path. No extra worker
-turn, prompt, message, extension or Herdr RPC is introduced. Herdr observation reuses existing reads.
-Absent configuration disables archival without changing spawn argv or granting any authority.
-
-## Directory and wire contract
-
-Each admitted observation gets a random archive ID, independent of the logical name and execution ID:
-
-```
-<operator-directory>/<archiveId>/manifest.json
-<operator-directory>/<archiveId>/<kind>-<sha256>.bin
-```
-
-The manifest is a small JSON object plus LF, atomically renamed from `manifest.pending`. Blob paths
-are relative basenames. Existing blobs are not overwritten; unexpected pre-existing blobs fail the
-observation. Completed generations remain readable while a new checkpoint publishes. Superseded blob
-files are retained, not deleted. External archival owns retention duration and garbage collection.
-
-- `version`: exactly `1.0`; reject unknown versions.
-- `identity`: execution/parent/child/public-call identity; executor; task, definition and configuration
-  digests; resolved workspace ID. Configuration hashes the exact plan argv/effective grant/timeout, or
-  the check's explicit executable/argv/access/bounds. It does **not** dump environment or credentials.
-  Task/definition/configuration digests are pins, **not retained instruction bytes**.
-- `native`: actual process PID or actual Herdr pane/tab/launch name. Session ID and branch leaf are null
-  in this slice. An explicitly supplied `--session` path can be recorded, but does not prove existence.
-- `state`: `running` checkpoint or `terminal`; no terminal manifest means observation is incomplete.
-- `outcome`: nullable numeric exit code and signal, timeout/abort/truncation/failure flags. A check whose
-  control record fails can have child exit code 0 and `failed:true`; its required receipt failure still throws.
-- `content`: `stdout`, `stderr`, `paneSnapshot`, `result`, `checkReceipt`, `session`. Every member is either
-  `{status:"missing",path:null,sha256:null,bytes:null}` or
-  `{status:"retained",path:<basename>,sha256:<hex>,bytes:<length>}`. `retained` means the producer wrote those
-  exact bytes before publishing that checkpoint, **not** that an external archive still possesses them.
-- `coverage`: `complete:false` and explicit loss reasons. This slice never claims evidence completeness.
-- `acceptance`: always `not-assessed`. No receipt, tool result, terminal outcome or digest implies acceptance.
-
-`stdout`/`stderr` are separate raw bytes, including available structured JSON output, not parsed into
-trusted facts. Their cross-stream interleaving is not reconstructed. `result` is the exact executor's
-assembled UTF-8 result before delegation display trimming; for checks its digest matches the returned
-receipt's `output_sha256`. `paneSnapshot` replaces prior snapshots and is not a session transcript.
-`checkReceipt` contains **the complete JSON serialization of the actual CheckReceipt plus LF**, including
-all fields, not just `receipt_id`. Available receipt bytes survive later required ledger failure; that
-failure still rejects the check. Absent receipt content stays missing.
-
-## Bounds, loss, and privacy
-
-At most 32 admitted observations are active. Each buffers at most 1 MiB of stream/snapshot data,
-plus separate 1 MiB allowances for an indivisible result and an indivisible receipt. Oversize receipts
-or results are missing, never represented by partial retained bytes. Streams may drop with explicit
-loss reasons. Checkpoints coalesce; this is not an unbounded event queue. Archive errors become `lost`;
-returned tool details may still say `pending` when publication has not completed. Treat pending,
-missing files, invalid hashes, running-only checkpoints and all coverage gaps as incomplete, not success.
-A whole producer-process crash can prevent final publication; this is not an fsync/crash-durability promise.
-External hosts may call `flush()` at quiescence with their own timeout; worker control never does so.
-
-No auth files, ambient environment dump, task text, monitoring state, or native transcript directory is
-harvested. Retained output is untrusted and **can itself contain secrets printed by a worker**; no general
-secret-redaction claim is made. Opt in only at an access-controlled harness archive boundary with an
-appropriate content-handling policy. This is not malicious-filesystem race containment.
-
-## Explicit prerequisite gap
-
-Existing governed plans normally use `--no-session`. Existing Herdr replies used here expose pane/tab
-identity, not a verified pi session ID, session file, or active branch. This slice does not change that
-privacy/control default, read auth/session directories, invent a session join, or infer branch identity
-from output. Therefore native session/transcript retention and verified session/branch TUI joins remain
-**missing** pending a separately agreed native identity/session-export seam. P03 must not treat pane ID,
-logical name, process PID, a requested session path, or output-shaped labels as that seam.
-
-## Public consumer example
-
-After a fresh build (the owner's historical dist is NOT current compiled proof):
-
-```js
-import { readFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { verifyRetainedBytes } from 'pi-daddy/execution-retention';
-
-const m = JSON.parse(await readFile(manifestPath, 'utf8'));
-if (m.version !== '1.0') throw Error('unsupported retention version');
-const ref = m.content.checkReceipt;
-let bytes;
-if (ref.status === 'retained' && /^checkReceipt-[a-f0-9]{64}\.bin$/.test(ref.path)) {
-  try { bytes = await readFile(join(dirname(manifestPath), ref.path)); } catch { /* missing */ }
-}
-const observed = verifyRetainedBytes(ref, bytes); // retained | missing | mismatch
-// Even retained + terminal is NOT accepted work. Reconstruct independent P01 authority separately.
-```
-
-Apply archive size/path policies before reading untrusted manifests/blobs; never follow arbitrary paths.
-`test/execution-retention.test.ts` supplies ordinary producer/consumer fixtures: real credential-free
-fixture processes through public concurrent tools, interrupted structured bytes, complete real check
-receipt generation with a **synthetic Git identity transport**, and deterministic Herdr replies. These
-are not real pi/model/Herdr integration, real Git candidate assurance, installed smoke or formal acceptance.