pi-daddy 0.27.4 → 0.32.0

package/contracts/ledger/v4/fixtures/work-acceptance.json

@@ -1,57 +0,0 @@
-{
-  "ledgerVersion": 4,
-  "event": "work_acceptance",
-  "eventId": "acceptance",
-  "ts": "2026-09-06T12:00:00.000Z",
-  "payload": {
-    "authorityId": "authority",
-    "binding": {
-      "intent": {
-        "kind": "goal",
-        "id": "goal",
-        "revision": 1,
-        "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-      },
-      "obligation": {
-        "kind": "obligation",
-        "id": "obligation",
-        "revision": 1,
-        "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-      },
-      "artifact": {
-        "kind": "artifact",
-        "id": "artifact",
-        "revision": 1,
-        "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-      },
-      "policy": {
-        "kind": "policy",
-        "id": "policy",
-        "revision": 1,
-        "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-      },
-      "scope": {
-        "kind": "scope",
-        "id": "scope",
-        "revision": 1,
-        "digest": "191d991431d5dcbd940304f916579e57540e0d555e263f6d22a0e8aa4e416233"
-      },
-      "snapshot": {
-        "id": "snapshot",
-        "digest": "6fe1623dda96511e95e862b1f2714f9f909e2bf2b585dbd10af1ff52f3f7b5f8"
-      },
-      "artifactDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-      "evidence": [
-        {
-          "id": "evidence",
-          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-          "event": {
-            "eventId": "occurrence",
-            "digest": "36935a3a42473122ebfb359371131311270253b0959101e047f8f5d75dbf639d"
-          }
-        }
-      ]
-    }
-  },
-  "digest": "219fc728cd50368d7679f3d0db9bdb217c1fac06db6bde07373750a3671a0877"
-}

package/contracts/ledger/v4/fixtures/work-occurrence.json

@@ -1,44 +0,0 @@
-{
-  "ledgerVersion": 4,
-  "event": "work_occurrence",
-  "eventId": "occurrence",
-  "ts": "2026-09-06T12:00:00.000Z",
-  "payload": {
-    "scope": {
-      "kind": "scope",
-      "id": "scope",
-      "revision": 1,
-      "digest": "191d991431d5dcbd940304f916579e57540e0d555e263f6d22a0e8aa4e416233"
-    },
-    "obligation": {
-      "kind": "obligation",
-      "id": "obligation",
-      "revision": 1,
-      "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-    },
-    "executionId": "exec:00000000-0000-4000-8000-000000000001",
-    "parentExecutionId": null,
-    "childId": null,
-    "variantId": null,
-    "artifact": {
-      "kind": "artifact",
-      "id": "artifact",
-      "revision": 1,
-      "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-    },
-    "provenance": "observed",
-    "state": "completed",
-    "labels": {
-      "sessionId": null,
-      "branchLeafId": null,
-      "toolCallId": null,
-      "taskId": null,
-      "workspaceId": null,
-      "definitionDigest": null,
-      "configurationDigest": null,
-      "modelId": null,
-      "effortId": null
-    }
-  },
-  "digest": "36935a3a42473122ebfb359371131311270253b0959101e047f8f5d75dbf639d"
-}

package/contracts/ledger/v4/fixtures/work-revision.json

@@ -1,26 +0,0 @@
-{
-  "ledgerVersion": 4,
-  "event": "work_revision",
-  "eventId": "revision",
-  "ts": "2026-09-06T12:00:00.000Z",
-  "payload": {
-    "revision": {
-      "kind": "scope",
-      "id": "scope",
-      "scopeId": "scope",
-      "revision": 1,
-      "predecessor": null,
-      "contentDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-      "parent": null,
-      "dependencies": [],
-      "ownerId": "owner",
-      "permittedEffects": [
-        "read",
-        "write"
-      ],
-      "policy": null,
-      "digest": "191d991431d5dcbd940304f916579e57540e0d555e263f6d22a0e8aa4e416233"
-    }
-  },
-  "digest": "166a77a5c489dd37a350c6f0faa1058ea8ca4e764f35d8d21a19a083c6291c0a"
-}

package/contracts/ledger/v4/fixtures/work-snapshot.json

@@ -1,73 +0,0 @@
-{
-  "ledgerVersion": 4,
-  "event": "work_snapshot",
-  "eventId": "snapshot",
-  "ts": "2026-09-06T12:00:00.000Z",
-  "payload": {
-    "snapshot": {
-      "snapshotId": "snapshot",
-      "scope": {
-        "kind": "scope",
-        "id": "scope",
-        "revision": 1,
-        "digest": "191d991431d5dcbd940304f916579e57540e0d555e263f6d22a0e8aa4e416233"
-      },
-      "revisions": [
-        {
-          "kind": "artifact",
-          "id": "artifact",
-          "revision": 1,
-          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-        },
-        {
-          "kind": "goal",
-          "id": "goal",
-          "revision": 1,
-          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-        },
-        {
-          "kind": "obligation",
-          "id": "obligation",
-          "revision": 1,
-          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-        },
-        {
-          "kind": "policy",
-          "id": "policy",
-          "revision": 1,
-          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-        }
-      ],
-      "bindings": [
-        {
-          "intent": {
-            "kind": "goal",
-            "id": "goal",
-            "revision": 1,
-            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-          },
-          "obligation": {
-            "kind": "obligation",
-            "id": "obligation",
-            "revision": 1,
-            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-          },
-          "artifact": {
-            "kind": "artifact",
-            "id": "artifact",
-            "revision": 1,
-            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-          },
-          "policy": {
-            "kind": "policy",
-            "id": "policy",
-            "revision": 1,
-            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-          }
-        }
-      ],
-      "digest": "6fe1623dda96511e95e862b1f2714f9f909e2bf2b585dbd10af1ff52f3f7b5f8"
-    }
-  },
-  "digest": "28dcb24ddd9d81bee400fd94dc07850794faabdf62419178f3dd64269ab013d8"
-}

package/contracts/ledger/v4/ledger-event.schema.json

@@ -1,162 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/mojomanyana/pi-daddy/contracts/ledger/v4/ledger-event.schema.json",
-  "title": "pi-daddy candidate ledgerVersion 4 work event",
-  "description": "One closed work-v4 event, not a grant or authority receipt. Strict text ingestion additionally verifies duplicate members, exact numeric tokens, canonical sets, digests and byte/depth limits. Projection separately resolves graphs and explicit host authority; schema conformance never proves acceptance.",
-  "oneOf": [
-    { "$ref": "#/$defs/workRevisionEvent" },
-    { "$ref": "#/$defs/workSnapshotEvent" },
-    { "$ref": "#/$defs/workOccurrenceEvent" },
-    { "$ref": "#/$defs/workAcceptanceEvent" }
-  ],
-  "$defs": {
-    "id": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]{0,127}$" },
-    "digest": { "type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[0-9a-f]{64}$" },
-    "revisionNumber": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 },
-    "timestamp": {
-      "type": "string", "format": "date-time", "minLength": 24, "maxLength": 24,
-      "pattern": "^(?!0000)[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\\.[0-9]{3}Z$",
-      "$comment": "The runtime always verifies the calendar date, independently of a schema validator's format support."
-    },
-    "executionId": {
-      "type": "string", "minLength": 41, "maxLength": 41,
-      "pattern": "^[eE][xX][eE][cC]:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
-    },
-    "revisionKind": { "enum": ["scope", "goal", "node", "obligation", "artifact", "policy"] },
-    "occurrenceProvenance": { "enum": ["declared", "observed"] },
-    "occurrenceState": { "enum": ["unknown", "starting", "running", "completed", "failed"] },
-    "identity": {
-      "type": "object", "additionalProperties": false, "required": ["id", "digest"],
-      "properties": { "id": { "$ref": "#/$defs/id" }, "digest": { "$ref": "#/$defs/digest" } }
-    },
-    "eventRef": {
-      "type": "object", "additionalProperties": false, "required": ["eventId", "digest"],
-      "properties": { "eventId": { "$ref": "#/$defs/id" }, "digest": { "$ref": "#/$defs/digest" } }
-    },
-    "revisionRef": {
-      "type": "object", "additionalProperties": false, "required": ["kind", "id", "revision", "digest"],
-      "properties": {
-        "kind": { "$ref": "#/$defs/revisionKind" }, "id": { "$ref": "#/$defs/id" },
-        "revision": { "$ref": "#/$defs/revisionNumber" }, "digest": { "$ref": "#/$defs/digest" }
-      }
-    },
-    "scopeRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "const": "scope" } } }] },
-    "intentRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "enum": ["goal", "node"] } } }] },
-    "goalParentRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "enum": ["scope", "goal"] } } }] },
-    "obligationRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "const": "obligation" } } }] },
-    "artifactRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "const": "artifact" } } }] },
-    "policyRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "const": "policy" } } }] },
-    "inventoryRef": { "allOf": [{ "$ref": "#/$defs/revisionRef" }, { "type": "object", "properties": { "kind": { "enum": ["goal", "node", "obligation", "artifact", "policy"] } } }] },
-    "workRevision": {
-      "type": "object", "additionalProperties": false,
-      "required": ["kind", "id", "revision", "scopeId", "predecessor", "contentDigest", "parent", "dependencies", "ownerId", "permittedEffects", "policy", "digest"],
-      "properties": {
-        "kind": { "$ref": "#/$defs/revisionKind" }, "id": { "$ref": "#/$defs/id" }, "revision": { "$ref": "#/$defs/revisionNumber" },
-        "scopeId": { "$ref": "#/$defs/id" }, "predecessor": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/revisionRef" }] },
-        "contentDigest": { "$ref": "#/$defs/digest" }, "parent": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/revisionRef" }] },
-        "dependencies": { "type": "array", "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/obligationRef" } },
-        "ownerId": { "$ref": "#/$defs/id" },
-        "permittedEffects": { "type": "array", "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/id" } },
-        "policy": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/policyRef" }] }, "digest": { "$ref": "#/$defs/digest" }
-      },
-      "allOf": [
-        {
-          "if": { "type": "object", "properties": { "revision": { "const": 1 } } },
-          "then": { "type": "object", "properties": { "predecessor": { "type": "null" } } },
-          "else": { "type": "object", "properties": { "predecessor": { "$ref": "#/$defs/revisionRef" } } }
-        },
-        { "oneOf": [
-          { "type": "object", "properties": { "kind": { "const": "scope" }, "parent": { "type": "null" }, "dependencies": { "type": "array", "maxItems": 0 }, "policy": { "type": "null" } } },
-          { "type": "object", "properties": { "kind": { "const": "goal" }, "parent": { "$ref": "#/$defs/goalParentRef" }, "dependencies": { "type": "array", "maxItems": 0 }, "policy": { "type": "null" } } },
-          { "type": "object", "properties": { "kind": { "const": "node" }, "parent": { "$ref": "#/$defs/intentRef" }, "dependencies": { "type": "array", "maxItems": 0 }, "policy": { "type": "null" } } },
-          { "type": "object", "properties": { "kind": { "const": "obligation" }, "parent": { "$ref": "#/$defs/intentRef" }, "policy": { "$ref": "#/$defs/policyRef" } } },
-          { "type": "object", "properties": { "kind": { "enum": ["artifact", "policy"] }, "parent": { "type": "null" }, "dependencies": { "type": "array", "maxItems": 0 }, "permittedEffects": { "type": "array", "maxItems": 0 }, "policy": { "type": "null" } } }
-        ] }
-      ],
-      "$comment": "Runtime also requires scopeId=id for scope, same kind/id and exact predecessor revision+1, canonical list ordering, and own digest equality. Graph scope/history checks require the complete event snapshot."
-    },
-    "obligationBinding": {
-      "type": "object", "additionalProperties": false, "required": ["intent", "obligation", "artifact", "policy"],
-      "properties": {
-        "intent": { "$ref": "#/$defs/intentRef" }, "obligation": { "$ref": "#/$defs/obligationRef" },
-        "artifact": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/artifactRef" }] }, "policy": { "$ref": "#/$defs/policyRef" }
-      }
-    },
-    "workSnapshot": {
-      "type": "object", "additionalProperties": false, "required": ["snapshotId", "scope", "revisions", "bindings", "digest"],
-      "properties": {
-        "snapshotId": { "$ref": "#/$defs/id" }, "scope": { "$ref": "#/$defs/scopeRef" },
-        "revisions": { "type": "array", "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/inventoryRef" } },
-        "bindings": { "type": "array", "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/obligationBinding" } },
-        "digest": { "$ref": "#/$defs/digest" }
-      },
-      "$comment": "Runtime orders bindings by obligation ref, rejects duplicate obligation keys, and checks digests. Projection validates unique selected entities, exact bindings, same-scope ancestors, predecessors and dependencies."
-    },
-    "occurrenceLabels": {
-      "type": "object", "additionalProperties": false,
-      "required": ["sessionId", "branchLeafId", "toolCallId", "taskId", "workspaceId", "definitionDigest", "configurationDigest", "modelId", "effortId"],
-      "properties": {
-        "sessionId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
-        "branchLeafId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
-        "toolCallId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
-        "taskId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
-        "workspaceId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
-        "definitionDigest": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/digest" }] },
-        "configurationDigest": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/digest" }] },
-        "modelId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
-        "effortId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] }
-      }
-    },
-    "occurrencePayload": {
-      "type": "object", "additionalProperties": false,
-      "required": ["scope", "obligation", "executionId", "parentExecutionId", "childId", "variantId", "artifact", "provenance", "state", "labels"],
-      "properties": {
-        "scope": { "$ref": "#/$defs/scopeRef" }, "obligation": { "$ref": "#/$defs/obligationRef" }, "executionId": { "$ref": "#/$defs/executionId" },
-        "parentExecutionId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/executionId" }] },
-        "childId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] }, "variantId": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/id" }] },
-        "artifact": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/artifactRef" }] },
-        "provenance": { "$ref": "#/$defs/occurrenceProvenance" }, "state": { "$ref": "#/$defs/occurrenceState" }, "labels": { "$ref": "#/$defs/occurrenceLabels" }
-      },
-      "$comment": "Runtime rejects self-parent execution identity. Provenance is wire evidence, never acceptance authority."
-    },
-    "evidenceRef": {
-      "type": "object", "additionalProperties": false, "required": ["id", "digest", "event"],
-      "properties": { "id": { "$ref": "#/$defs/id" }, "digest": { "$ref": "#/$defs/digest" }, "event": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/eventRef" }] } }
-    },
-    "acceptanceBinding": {
-      "type": "object", "additionalProperties": false,
-      "required": ["snapshot", "scope", "intent", "obligation", "artifact", "artifactDigest", "policy", "evidence"],
-      "properties": {
-        "snapshot": { "$ref": "#/$defs/identity" }, "scope": { "$ref": "#/$defs/scopeRef" }, "intent": { "$ref": "#/$defs/intentRef" },
-        "obligation": { "$ref": "#/$defs/obligationRef" }, "artifact": { "$ref": "#/$defs/artifactRef" }, "artifactDigest": { "$ref": "#/$defs/digest" },
-        "policy": { "$ref": "#/$defs/policyRef" }, "evidence": { "type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/evidenceRef" } }
-      }
-    },
-    "acceptancePayload": {
-      "type": "object", "additionalProperties": false, "required": ["authorityId", "binding"],
-      "properties": { "authorityId": { "$ref": "#/$defs/id" }, "binding": { "$ref": "#/$defs/acceptanceBinding" } }
-    },
-    "revisionPayload": {
-      "type": "object", "additionalProperties": false, "required": ["revision"], "properties": { "revision": { "$ref": "#/$defs/workRevision" } }
-    },
-    "snapshotPayload": {
-      "type": "object", "additionalProperties": false, "required": ["snapshot"], "properties": { "snapshot": { "$ref": "#/$defs/workSnapshot" } }
-    },
-    "workRevisionEvent": {
-      "type": "object", "additionalProperties": false, "required": ["ledgerVersion", "event", "eventId", "ts", "payload", "digest"],
-      "properties": { "ledgerVersion": { "const": 4 }, "event": { "const": "work_revision" }, "eventId": { "$ref": "#/$defs/id" }, "ts": { "$ref": "#/$defs/timestamp" }, "payload": { "$ref": "#/$defs/revisionPayload" }, "digest": { "$ref": "#/$defs/digest" } }
-    },
-    "workSnapshotEvent": {
-      "type": "object", "additionalProperties": false, "required": ["ledgerVersion", "event", "eventId", "ts", "payload", "digest"],
-      "properties": { "ledgerVersion": { "const": 4 }, "event": { "const": "work_snapshot" }, "eventId": { "$ref": "#/$defs/id" }, "ts": { "$ref": "#/$defs/timestamp" }, "payload": { "$ref": "#/$defs/snapshotPayload" }, "digest": { "$ref": "#/$defs/digest" } }
-    },
-    "workOccurrenceEvent": {
-      "type": "object", "additionalProperties": false, "required": ["ledgerVersion", "event", "eventId", "ts", "payload", "digest"],
-      "properties": { "ledgerVersion": { "const": 4 }, "event": { "const": "work_occurrence" }, "eventId": { "$ref": "#/$defs/id" }, "ts": { "$ref": "#/$defs/timestamp" }, "payload": { "$ref": "#/$defs/occurrencePayload" }, "digest": { "$ref": "#/$defs/digest" } }
-    },
-    "workAcceptanceEvent": {
-      "type": "object", "additionalProperties": false, "required": ["ledgerVersion", "event", "eventId", "ts", "payload", "digest"],
-      "properties": { "ledgerVersion": { "const": 4 }, "event": { "const": "work_acceptance" }, "eventId": { "$ref": "#/$defs/id" }, "ts": { "$ref": "#/$defs/timestamp" }, "payload": { "$ref": "#/$defs/acceptancePayload" }, "digest": { "$ref": "#/$defs/digest" } }
-    }
-  }
-}

package/contracts/ordinary-control/v1/README.md

@@ -1,59 +0,0 @@
-# Ordinary original-child control v1 — explicit local host integration
-
-Package-root `ordinaryChildrenFor(originalExtensionAPI)` returns the port associated during actual grants
-extension factory registration. The original owning bootstrap must retain that object; a copy/name/path
-cannot look it up. Call BEFORE ordinary children run. Late opt-in is allowed but permanently labels missed
-original lifetimes; empty rows then cannot certify quiescence. Defaults stay untracked/ephemeral unless
-separately enabled (native file retention and cancellation capture are distinct opt-ins).
-
-The actual shared execute-child wrapper retains an original AbortController per execution and composes
-it with caller and lease signals. It never replaces the caller promise, primary result or existing process/
-Herdr timer/close path. No model tool schema exposes this port. No peer process or PID/pane is recovered.
-`inspect()` is process-local read-only status, NOT persisted authority or a clean durability acknowledgement.
-`quiescent()` additionally refuses unknown ownership, required control failure or unretained history. A
-best-effort terminal lifecycle/lease observation failure remains visible as `control:failed` beside the
-worker outcome, but does not turn a known-settled child into a permanent execution boundary. A boundary
-already known to be unavailable refuses an intent hold before installing it; it never blocks unrelated
-ordinary admission while claiming reconciliation could make progress.
-
-Cancellation shape:
-
-```
-{ version: "ordinary-cancel-v1", requestId, bindingDigest, expectedRevision,
-  target: { executionId, parentExecutionId, toolCallId } }
-```
-
-Use actual execution UUIDs and nullable original parent UUID / actual tool-call ID (bounded256 characters),
-never logical child position. `ordinaryCancellation` validates/detaches; `ordinaryCancellationDigest` hashes
-the closed request. Independently supply `{bindingDigest, requestDigests}`. Approved digest is not inferred
-from request shape, worker output or the port's existence. Synchronous CAS precedes original abort; result
-`abort-requested` means completion is still owned by the original caller, not certified terminated.
-Exact duplicate reads original result without effect or needing new authority. Different bytes under the
-same request ID, stale revision, changed target, missing original handle and copied ports refuse.
-
-Opted-in controllers retain up to1024 occurrence records and1024 requests. Capacity is non-refunding;
-failed admission uses original workspace finalization. Ordinary successful worker output survives terminal
-observation failure, which is separately marked failed. An executor exception remains unknown. Neither
-unknown nor full bytes grants retry/recovery permission. Large transport frames may refuse their existing
-byte bound rather than truncate a purported complete registry.
-
-Existing dashboard config may ADD `ordinaryDigest: port.bindingDigest`; old configs/hashes remain unchanged.
-Pass that original port as `open/createDashboardHost({ordinary:port,...})`. Approval additionally needs
-`authority.ordinary`; operation `ordinary-cancel` carries the exact request above through the existing
-manual `dashboardHostAction`/socket. The existing host claim/result journal binds request ID/tip/selection
-and blocks failed-ack replay. No new persistent cancellation/decision database. Reconnect without the
-original port can inspect other retained state but cannot cancel; process restart never restores handles.
-
-For approved intent changes, the existing host additionally takes an original admission hold (at most32,
-revision-changing). Busy direction waits in the existing host journal; original children continue. New
-ordinary execution refuses at its original admission seam. The hold spans native asynchronous application
-and any native resource pending state, and releases only after explicit successful native/host readback.
-Unknown/failed host acknowledgement never releases it. This is not an expiry/unlock/recovery API; do not
-run an older host writer against a new pending ordinary operation. Guide reconciliation does not mandate
-generic entity/topology/opaque-policy editing; those unsupported extensions need concrete scope/semantics.
-
-A failed final host sync can coexist with actual abort, charged effects and a later readable result. The
-host stays failed/unknown and duplicate request is readback only. Caller cancellation still works and a
-completed fanout sibling remains in the original result. Manual presentation refuses known nonquiescence,
-but this does not establish an atomic deployed TUI pause, source completeness, human/module authentication,
-P01 acceptance or hostile same-UID confinement. Wider live host association requires separate B/C evidence.

package/contracts/producer-ipc/v1/README.md

@@ -1,137 +0,0 @@
-# Producer IPC v1 — local, explicit host integration
-
-This is a **separate opt-in fixed model-free emitter**, not an operation on `linux-bwrap-digest-v1`,
-not a new P11 experiment opcode, and not permission to run a model. Digest/hold operations and their
-null model/effort/skills contract are unchanged. Ordinary pi extensions, tools and runtime-injection
-restrictions are unchanged. No SDK, credentials, provider configuration or networking client is imported.
-Historical `dist` is not this candidate: compile the exact pinned source into a fresh private output.
-
-## Callable API
-
-Exports are available from `pi-daddy` and `pi-daddy/producer-ipc`:
-
-- `producerIpcBinding(value)` validates and detaches/freezes the closed binding below.
-- `producerIpcBindingDigest(binding)` hashes its canonical UTF-8 JSON bytes.
-- `producerIpcDemand(binding)` produces an existing v4 `AttemptDemand`: primary, no parent;
-  attempt ID = execution ID, input digest = binding digest, input bytes = **whole parent binding**.
-- `createProducerIpcHost({ owner, binding, exchange })` creates a single-use original host capability.
-- `startProducerIpc({ owner, permit, binding, host, signal, timeoutMs })` consumes an **already reserved**
-  original permit and returns a `Promise<ProducerIpcRun>`. It never reserves a replacement itself.
-
-```ts
-import {
-  openResourceBudget, resourceBindingDigest, newExecutionId,
-  producerIpcBinding, producerIpcDemand, createProducerIpcHost, startProducerIpc,
-} from 'pi-daddy';
-
-// Existing independently retained v4 budget. Use ONE original module graph and owner object.
-const owner = openResourceBudget(existingExperimentBudget);
-const binding = producerIpcBinding({
-  version: 'producer-ipc-v1', budgetDigest: resourceBindingDigest(existingExperimentBudget),
-  orderId: existingOrderId, experimentId: existingExperimentId, executionId: newExecutionId(),
-  charterSha256: independentlyFrozenHostCharterHash, invocationId: allowedHostInvocationId,
-});
-const [permit] = await owner.reserveBatch([producerIpcDemand(binding)]);
-const port = createProducerIpcHost({ owner, binding,
-  async exchange(frames, context) {
-    // Actual one-use Readable replay of original child stdout, validated after EOF AND child exit.
-    // No parent identity, charter hash, credentials, URL, model payload or host socket in frames.
-    const observation = await trustedHost.exchangeSubscriptionSdk(
-      frames, hostOnlySdkBinding, hostOnlyTransport, context.binding.charterSha256, context.signal,
-    );
-    // Host-owned journal references ONLY, not votes/output/acceptance or transport authentication.
-    return { claimRef: originalClaimReference(observation), responseRef: originalResponseReference(observation) };
-  },
-});
-const run = await startProducerIpc({ owner, permit, binding, host: port,
-  signal: originalCallerAbortController.signal, timeoutMs: 30_000 });
-const observed = await run.result;        // Bounded observation; NEVER release a hold from this.
-const final = await run.completion;       // Waits for original child, invoked host, required accounting.
-const mechanicallyComplete = final.outcome === 'completed' && final.settlement === 'acknowledged';
-// Even mechanicallyComplete is NOT live qualification, model correctness, a grant or P01 acceptance.
-```
-
-`trustedHost`, SDK binding, transport, expiring approval and reference selection are **host-owned**.
-The example's `exchangeSubscriptionSdk(..., sourceSignal?)` is the coordinator-supplied local29a API;
-this producer does not import, ship, execute or authenticate it. The host must independently validate
-its charter/approval and enforce its own journal, invocation uniqueness, request/response/call budgets,
-subscription-only route and source cancellation. Reading this document supplies none of that authority.
-All coding/evaluated model execution remains on the user's existing Codex subscription only; no live call
-was made in these tests. The producer's inert callback fixtures are not a substitute for that host.
-
-## Frame, identity and evidence contracts
-
-`ProducerIpcBinding` has exactly `version, budgetDigest, orderId, experimentId, executionId,
-charterSha256, invocationId`. Hashes are lowercase SHA-256; execution ID is an existing-format `exec:UUID`;
-other IDs are 1..128 ASCII alphanumeric/colon/underscore/hyphen characters. Reordered input properties
-canonicalize to that listed order. Whole binding bytes are charged, **not** provider request/token bytes.
-The independently retained binding plus its persisted reservation digest supplies correlation, not a new
-journal or a recovered permit. Old digest-input reservations cannot be relabelled as IPC reservations.
-
-Child capability/output is exactly UTF-8 `JSON.stringify({id: binding.invocationId, sequence: 1})+'\n'`.
-Sequence 1 is **per invocation**, not the host journal's global claim ordinal. The child gets only that
-base64-encoded frame in argv; this is not secret transport. The parent captures at most 1024 raw bytes,
-requires original stdout EOF and successful original child completion, then checks byte equality, not a
-permissive JSON parse. Wrong identity/sequence, extra/duplicate fields, whitespace, malformed UTF-8, missing
-LF, repeated or oversized output cannot dispatch. There is no prefix dispatch or response channel to child.
-The host receives a **buffered replay**, not a live bidirectional child pipe. It must consume that original
-stream before acknowledgement; the producer never reconstructs a frame from host identity metadata.
-
-`exchange(frames: Readable, context: { binding, signal }): Promise<{ claimRef, responseRef }>` is called
-at most once per original host port. Both references are 1..128 characters from the same ASCII ID alphabet;
-extra payload/decision fields refuse. They are unverified evidence references, never policy or votes.
-The child has already exited before host exchange starts; the resource hold spans both serial lifetimes.
-This does **not** place the host, SDK or model execution inside the child namespace.
-
-## Lifetime and failures
-
-`run.started` resolves `spawned | not-spawned`; spawn is not readiness. `run.readiness` resolves
-`frame-ready | not-ready` only after original child evidence is available. Both can remain pending during
-unknown underlying I/O. `run.child` is the frozen original `ChildRunResult | null`; null means no executor
-result was obtained, not a successful child. An actual spawn error is `not-spawned`; an exception after
-spawn without an executor result is `unknown` and returns failed/unknown completion **without settlement**.
-Actual code, signal, text, abort/timeout/truncation are retained.
-`run.inspect()` only returns a frozen process-local snapshot; no reopen/retry/reconcile/settlement occurs.
-
-`result` is the first terminal **effect observation**, with `outcome`, closed `reason`, current child/host
-state, frame hash, references and settlement state. It is immutable; it may say child/host/settlement are
-pending. `completion` returns later evidence without upgrading cancelled/timed-out/failed outcome.
-Late valid host references can appear there while the earlier result remains unchanged.
-A completed effect plus `settlement: failed-or-unknown` is **not successful completion**, even if a later
-budget read sees complete settlement bytes or zero active slots. No read repairs this receipt.
-
-Original caller cancellation is composed with a bridge-owned deadline and forwarded to both existing
-`runChild` and host I/O. `timeoutMs` is an integer 50..30000, includes admission/runtime preparation after
-claim, and is checked again at asynchronous control boundaries. It bounds an observation, not blocked
-kernel I/O or synchronous host JavaScript. The fixed child retains its 3000ms/50ms grace/3500ms hard cap,
-1024-byte combined output cap and unchanged binary/namespace/per-process CPU/FD/heap guards.
-There is no security-policy modification, alternate command, fixture mount, environment or fallback API.
-
-Original v4 permits are branded to their creating owner object. Copies, separately reopened owners,
-different bindings, already settled/in-progress settlement and consumed permits refuse. A valid exclusive
-handoff blocks early calls to the old public `permit.settle`; the original private settlement closure is
-held until child and invoked host acknowledge. The original locked admission check rejects a pending/paused
-barrier before launch; a failed admission still settles a charged failure. Claims are process-local and
-single-use even after failure. There is no crash/receipt/PID/path/module-copy recovery.
-
-Cancellation/timeout does not free an unknown lifetime: an uncooperative host or unacknowledged child keeps
-`completion` pending and the active reservation held. When both acknowledge, original accounting releases
-only the active slot. Attempts and whole-binding bytes stay charged on success, failure and cancellation.
-Pending dispatch reconciliation still needs explicit original authority after quiescence. A host port must
-return/reject only after its owned I/O acknowledges termination; the bridge cannot prove remote server
-termination from promise rejection, authenticate journal references, or enforce provider-money/cgroup caps.
-
-## Behavioral evidence / exclusions
-
-`test/producer-ipc.test.ts` uses the actual unchanged namespace launcher for positive stream/correlation
-and real forwarded Node children for malformed/oversized/identity/EOF negatives. Test-only forwarding never
-adds a production alternate launcher. `test/producer-ipc-lifetime.test.ts` forces real process liveness
-under delayed signal delivery, no-readiness cancellation/timeout, host cancellation/late acknowledgement,
-existing admission barriers, persisted-binding mismatch, reuse, spawn/setup errors and mandatory sync/close
-failures after complete bytes. Signal/EOF and
-filesystem fault injection is labelled; it is not evidence that the local kernel naturally lost them.
-
-These are local mechanical tests, not live SDK/Herdr/model operation, human/role authentication, Ubuntu24
-support, the cause of historical namespace denials, or overall/native-P01 acceptance. Original review,
-seq226 and retained/inconclusive P17D remain unchanged. No ordinary model-driven controller choice, full
-factory scheduling, generic mutation, rescue/retry/refund or publication is introduced.