pi-daddy 0.28.0 → 0.32.0

package/src/delegate.ts

@@ -1,348 +0,0 @@
-/**
- * Governed delegation planning. Owning the spawn makes the grant an argument; each child receives its own
- * environment, and `tool:delegate` determines whether it is a delegator or a leaf.
- */
-
-import { planSpawn } from "./spawn.ts";
-import { ceilingForDefinition, digestDefinition, type DefinitionDigest, type SkillDefinition } from "./definitions.ts";
-import { assertNarrowing, type Capability, type ResolveResult } from "./resolve.ts";
-import { checkRoutingAuthority, checkWorkspaceWildcardRequest } from "./routing-authority.ts";
-import {
-  DELEGATE_CAPABILITY,
-  agentCapability,
-  maySpawnDefinition,
-  normaliseCapability,
-} from "./capabilities.ts";
-
-// Re-exported so the split stays internal: `delegate.ts` has been the import site for these since 0.6.0 and
-// four modules plus the test suite name it. Moving the definitions without moving the door would be churn
-// charged to every caller for a line count they did not cause.
-export { DELEGATE_CAPABILITY, agentCapability, maySpawnDefinition, normaliseCapability } from "./capabilities.ts";
-import {
-  ENV_APPROVED, ENV_DEPTH, ENV_EXECUTION_ID, ENV_FANOUT, ENV_GATED, ENV_GRANT, ENV_LEDGER, ENV_MAX_DEPTH,
-  ENV_PARENT_ID, inheritableGrant,
-} from "./propagation.ts";
-import { inheritApprovals, type InheritableApproval } from "./approval.ts";
-import { suggestForUnknown, unknownCapabilities, type Catalog } from "./catalog.ts";
-import { GovernanceRefusal, refusal, type RefusalCode, type StructuredRefusal } from "./refusals.ts";
-import {
-  digestTask,
-  normaliseCorrelation,
-  type ApprovalBinding,
-  type CorrelationMetadata,
-} from "./correlation.ts";
-import { resolveDelegationApproval } from "./delegation-approval.ts";
-import type { Delegation, DelegationContext, DelegationRequest } from "./delegate-types.ts";
-import { assertCapabilitiesArePropagatable } from "./capabilities.ts";
-import { ENV_ACTIVITY_PARENT_TASK, ENV_ACTIVITY_PATH, ENV_ACTIVITY_ROOT, ENV_ACTIVITY_TASK } from "./activity-timeline.ts";
-export type { Delegation, DelegationContext, DelegationRequest } from "./delegate-types.ts";
-
-export function planDelegation(request: DelegationRequest, ctx: DelegationContext): Delegation {
-  const childDepth = ctx.depth + 1;
-  const denied = (plan: Delegation, code: RefusalCode): Delegation =>
-    plan.reason ? { ...plan, refusal: refusal(code, plan.reason) } : plan;
-  // G6 / B-I3: every refusal carries a result, including the four below that return before `resolve()`
-  // is ever called. The extension guarded its ledger write with `if (ledgerPath && plan.result)`, so
-  // those four governance decisions — disabled, too deep, no task, unknown capability — were never
-  // audited at all. An empty result is the honest record: nothing was resolved, and that is the fact.
-  // Bounded/whitelisted correlation is a REFUSAL, not an exception escaping the planner. It is reachable
-  // from a model-facing tool parameter on all three delegation tools, and throwing from here produced a
-  // governed refusal with no code and no ledger line at all — the ledger file was never even created
-  // (R-112). Caught here so it becomes an ordinary recorded decision.
-  let correlation: CorrelationMetadata | undefined;
-  let correlationRefused: StructuredRefusal | undefined;
-  try {
-    correlation = normaliseCorrelation(request.correlation);
-  } catch (error) {
-    correlationRefused = error instanceof GovernanceRefusal
-      ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
-      : refusal("CORRELATION_INVALID", String(error instanceof Error ? error.message : error));
-  }
-  const taskDigest = digestTask(request.task ?? "");
-  const empty: Delegation = {
-    ok: false,
-    args: [],
-    env: {},
-    effective: [],
-    childDepth,
-    requested: [],
-    taskDigest,
-    ...(correlation ? { correlation } : {}),
-    result: { effective: [], denied: [], clipped: [], gatedBlocked: [], universal: [], subsumedBy: [] },
-  };
-
-  if (correlationRefused) {
-    return { ...empty, reason: correlationRefused.message, refusal: correlationRefused };
-  }
-  if (ctx.maxDepth <= 0) {
-    return denied({ ...empty, reason: "delegation is disabled (maxDepth 0)" }, "DEPTH_EXCEEDED");
-  }
-  if (childDepth > ctx.maxDepth) {
-    return denied({ ...empty, reason: `delegation depth limit reached (${ctx.maxDepth})` }, "DEPTH_EXCEEDED");
-  }
-  if (!request.task?.trim()) return denied({ ...empty, reason: "a delegation needs a task" }, "TASK_MISSING");
-
-  // ADR-0035's routing guards live in `routing-authority.ts` with their rationale; both are checked here,
-  // before anything is said about the target, because they are governance questions about the SESSION.
-  const routing = checkRoutingAuthority(request.boundWorkspaceId, ctx.ownGrant);
-  if (routing) {
-    return denied({
-      ...empty,
-      ...(routing.denied ? { requested: routing.denied, result: { ...empty.result, denied: routing.denied } } : {}),
-      reason: routing.reason,
-    }, routing.code);
-  }
-
-  // ADR-0016. A named definition replaces the model's tool list with an operator-authored ceiling.
-  let requested: Capability[];
-  let systemPrompt: string | undefined;
-  let definitionDigest: DefinitionDigest | undefined;
-  /** The definition being spawned, hoisted so the gate below can name its authorising id (ADR-0024). */
-  let spawned: SkillDefinition | undefined;
-
-  if (request.agent) {
-    const definition = ctx.definitions?.get(request.agent);
-    spawned = definition;
-    // No fallback, deliberately. pi-subagents resolves an unknown type to `general-purpose`, whose
-    // omitted tool list means EVERY tool — so a typo there granted the full surface. An unknown name
-    // here is simply an error.
-    if (!definition) {
-      const known = [...(ctx.definitions?.keys() ?? [])].sort();
-      return denied({
-        ...empty,
-        reason:
-          `unknown agent "${request.agent}"` +
-          (known.length > 0 ? ` — known definitions: ${known.join(", ")}` : " — no definitions were found"),
-      }, "UNKNOWN_DEFINITION");
-    }
-
-    // ADR-0017: authorisation comes BEFORE anything is said about the file. Which definitions this
-    // session may spawn is a governance question about the SESSION; whether the file declares its tools
-    // properly is a diagnostic about the DEFINITION, and answering the second one first would report a
-    // malformed-file error to a caller who was never allowed to spawn it either way.
-    //
-    // Recorded as a denial rather than a bare refusal, deliberately: `denied` is the escalation signal
-    // ADR-0008 designates, and asking to run a definition this session was not granted IS an attempt to
-    // exceed the grant. A refusal that left `denied` empty would keep it out of every audit query.
-    if (!maySpawnDefinition(ctx.ownGrant, definition.name)) {
-      const authorising = agentCapability(definition.name);
-      const held = ctx.ownGrant.filter((c) => c.startsWith("agent:")).sort();
-      return denied({
-        ...empty,
-        requested: [authorising],
-        result: { ...empty.result, denied: [authorising] },
-        reason:
-          `cannot spawn "${definition.name}" — this session does not hold ${authorising} ` +
-          `(the definition lives at ${definition.source}). ` +
-          (held.length > 0
-            ? `It may spawn: ${held.join(", ")}.`
-            : `It may spawn no definitions at all; add ${authorising} to its grant to allow this one.`),
-      }, "DEFINITION_NOT_AUTHORIZED");
-    }
-
-    // ADR-0018. Recorded from here on — after authorisation, because the digest is a fact about a file
-    // this caller was allowed to read, and before every remaining outcome, because a spawn refused for a
-    // malformed declaration is still a spawn of THIS version of the definition.
-    //
-    // Assigned into `empty`, which every subsequent refusal spreads. That is the R-28 discipline applied
-    // to a record field rather than an argument: instead of eight `definitionDigest` spellings that a
-    // ninth return could forget, there is one, and forgetting it is not expressible. The success return
-    // does not spread `empty`, so it names the field explicitly.
-    definitionDigest = digestDefinition(definition);
-    Object.assign(empty, { definitionDigest });
-
-    const ceiling = ceilingForDefinition(definition);
-    if (ceiling.undeclared) {
-      return denied({
-        ...empty,
-        reason:
-          `agent "${definition.name}" declares no \`allowed-tools\`, so it cannot be spawned — add one ` +
-          `to ${definition.source}. An undeclared capability set is treated as NONE, never as everything.`,
-      }, "UNDECLARED_TOOLS");
-    }
-    if (ceiling.patterns.length > 0) {
-      return denied({
-        ...empty,
-        reason:
-          `agent "${definition.name}" restricts a tool with a pattern (${ceiling.patterns.join(", ")}), ` +
-          `which pi's --tools cannot express — it matches whole tool names only. Granting the bare tool ` +
-          `would widen the declaration and dropping it would silently narrow, so neither is done.`,
-      }, "CEILING_PATTERNS_UNRESOLVED");
-    }
-    requested = ceiling.capabilities;
-    systemPrompt = definition.body;
-  } else {
-    requested = (request.tools ?? []).map(normaliseCapability);
-  }
-
-  // Unknown is reported before denied, and separately: "does not exist here" and "you lack authority"
-  // have different causes and different fixes. Collapsing them hides typos and stale grants.
-  if (ctx.catalog) {
-    const unknown = unknownCapabilities(requested, ctx.catalog);
-    if (unknown.length > 0) {
-      // Name the likely intent where there is one. `ceilingForDefinition` refuses to TRANSLATE names
-      // (lowercasing and no more), so an author who wrote Claude Code's `Glob` gets `tool:glob` and a
-      // refusal — correct, and previously unhelpful, because pi's equivalent is `find` and no amount of
-      // staring at "not present in this session's catalog" says so. The hint changes nothing about the
-      // refusal; it just stops the author having to guess which of nine built-ins was meant.
-      const hints = unknown
-        .map((c) => {
-          const s = suggestForUnknown(c, ctx.catalog!);
-          return s === null ? null : `${c} → did you mean ${s}?`;
-        })
-        .filter((h): h is string => h !== null);
-      return denied({
-        ...empty,
-        requested,
-        reason:
-          `unknown capabilit${unknown.length === 1 ? "y" : "ies"}: ${unknown.join(", ")} — not present in ` +
-          `this session's catalog (typo, or an uninstalled package?)` +
-          (hints.length > 0 ? ` — ${hints.join("; ")}` : ""),
-      }, "UNKNOWN_TOOL");
-    }
-  }
-
-  // See `checkWorkspaceWildcardRequest`: refused for a HOLDER (the ledger must not record authority the
-  // child will not receive), and left to `resolve()` for anyone else, so the probe lands in `denied`.
-  const wildcardRequest = checkWorkspaceWildcardRequest(requested, ctx.ownGrant);
-  if (wildcardRequest) {
-    return denied({ ...empty, requested, reason: wildcardRequest.reason }, wildcardRequest.code);
-  }
-
-  const { result, approvalBinding, bindingMismatch } = resolveDelegationApproval({
-    task: request.task,
-    agent: request.agent,
-    boundWorkspaceId: request.boundWorkspaceId,
-    boundContextId: request.boundContextId,
-    requested,
-    parentGrant: ctx.ownGrant,
-    gated: ctx.gated,
-    approved: ctx.approved,
-    spawned,
-    definitionDigest,
-    correlation,
-    parentId: ctx.spawnId ?? `d${ctx.depth}`,
-  });
-  if (approvalBinding) Object.assign(empty, { approvalBinding });
-
-  if (result.denied.length > 0) {
-    return denied({
-      ...empty,
-      requested,
-      result,
-      reason: `cannot grant ${result.denied.join(", ")} — this session does not hold it (capability escalation blocked)`,
-    }, "CAPABILITY_ESCALATION");
-  }
-  // ADR-0011: narrowing is checked BEFORE the gate, and the order is load-bearing rather than
-  // stylistic. `assertNarrowing` refuses regardless of approval, so with the old order this returned
-  // "requires explicit approval" for a delegation that could never be approved — telling the operator
-  // to go and find a human who cannot help. `shouldSeekApproval` now also refuses to prompt in this
-  // case; this reordering makes the reported *reason* agree with what actually blocks the spawn.
-  try {
-    assertNarrowing(result);
-  } catch (error) {
-    // ADR-0011's narrowing invariant is the hardest rule this package enforces, and it was the one
-    // refusal an external controller could not identify by code (R-109).
-    return denied(
-      { ...empty, requested, result, reason: String(error instanceof Error ? error.message : error) },
-      "NARROWING_VIOLATED",
-    );
-  }
-  if (result.gatedBlocked.length > 0) {
-    const code = bindingMismatch ? "APPROVAL_SCOPE_MISMATCH" : "GATED_UNAPPROVED";
-    const suffix = bindingMismatch ? " (an approval exists, but its task/workspace/context scope does not match)" : "";
-    return denied(
-      { ...empty, requested, result, reason: `${result.gatedBlocked.join(", ")} requires explicit approval${suffix}` },
-      code,
-    );
-  }
-
-  const canSubDelegate = result.effective.includes(DELEGATE_CAPABILITY);
-  const plan = planSpawn({
-    effective: result.effective,
-    prompt: request.task,
-    model: request.model,
-    provider: request.provider,
-    thinking: request.thinking,
-    skillPaths: ctx.skillPaths,
-    contextFiles: ctx.contextFiles,
-    systemPrompt,
-    sessionFile: ctx.sessionFile,
-    print: ctx.interactive ? false : undefined,
-  });
-
-  // R-32. A `skill:` capability the catalog cannot place is refused rather than dropped. Dropping it
-  // would hand back a child whose grant claims a skill it does not have — the ledger would record a
-  // capability that never reached the process, which is precisely the kind of lie an audit trail must
-  // not contain. `unknownCapabilities` above catches names absent from the catalog entirely; this
-  // catches one that is known but whose path we could not resolve, which is a different fault.
-  if (plan.unresolvedSkills.length > 0) {
-    return denied({
-      ...empty,
-      requested,
-      result,
-      reason:
-        `cannot locate ${plan.unresolvedSkills.join(", ")} on disk — granted but unresolvable, so the ` +
-        `child would silently lack it`,
-    }, "DEFINITION_UNREADABLE");
-  }
-
-  // `-e` loads even under `--no-extensions`. A delegate-capable child loads the governance extension;
-  // a leaf gets only the no-tool observer. Neither path alters --tools or the computed grant.
-  const args = [...plan.args];
-  const observer = canSubDelegate ? ctx.extensionPath : ctx.observerExtensionPath;
-  if (observer) args.splice(args.length - 1, 0, "-e", observer);
-
-  // `inheritableGrant`, not `result.effective` directly: this is the path a DELEGATED child's grant
-  // actually travels, and the "held but never inherited" rule for `tool:*` and `workspace:*` was enforced
-  // only in `childEnv`. A parent holding `workspace:*` could request it for its child and this line handed
-  // it over, so the rule ADR-0035 advertises held by accident — masked downstream rather than enforced
-  // here. One spelling of the rule, called from both paths.
-  const inheritable = inheritableGrant(result.effective);
-  const env: Record<string, string> = {
-    [ENV_GRANT]: (assertCapabilitiesArePropagatable(inheritable), inheritable.join(",")),
-    [ENV_DEPTH]: String(childDepth),
-    [ENV_MAX_DEPTH]: String(ctx.maxDepth),
-  };
-  // The child's own share of the subtree budget, and its identity. Both attenuate downward like depth: a
-  // child can never be handed more budget than its parent had left, so the total bound holds across
-  // process boundaries with no shared state.
-  if (ctx.fanoutBudget !== undefined) env[ENV_FANOUT] = String(ctx.fanoutBudget);
-  if (ctx.childSpawnId) env[ENV_PARENT_ID] = ctx.childSpawnId;
-  if (ctx.childExecutionId) env[ENV_EXECUTION_ID] = ctx.childExecutionId;
-  if (ctx.gated.length > 0) env[ENV_GATED] = ctx.gated.join(",");
-  // Approvals ride down with the grant, but only ever for what this child actually received — so
-  // `approved ⊆ grant` holds at every level (ADR-0010). Written even when empty, so this object states
-  // the child's approval set outright rather than leaving it to whatever the caller merges over; see
-  // `mergeChildEnv`, which is what actually stops the parent's value leaking through.
-  // Clamped to what the child actually INHERITS, not to what it was granted. The two differ only for a
-  // non-inheritable wildcard, and passing down an approval for a capability the child does not hold would
-  // leave banked authority with nothing to spend it on — `childEnv` clamps to `inheritable` for the same
-  // reason on the other path.
-  env[ENV_APPROVED] = inheritApprovals(ctx.approved ?? [], inheritable).join(",");
-  if (ctx.ledgerPath) env[ENV_LEDGER] = ctx.ledgerPath;
-  // These local observation values are per-child argv environment, never process-global grant state.
-  // A child cannot acquire a tool or a larger grant by receiving them.
-  if (ctx.activity?.taskId && ctx.childExecutionId) {
-    env[ENV_ACTIVITY_PATH] = ctx.activity.path;
-    env[ENV_ACTIVITY_ROOT] = ctx.activity.rootId;
-    env[ENV_ACTIVITY_TASK] = ctx.childExecutionId;
-    env[ENV_ACTIVITY_PARENT_TASK] = ctx.activity.taskId;
-  }
-
-  return {
-    ok: true,
-    args,
-    env,
-    effective: result.effective,
-    result,
-    childDepth,
-    requested,
-    childId: ctx.childSpawnId,
-    executionId: ctx.childExecutionId,
-    taskDigest,
-    ...(correlation ? { correlation } : {}),
-    ...(approvalBinding ? { approvalBinding } : {}),
-    ...(definitionDigest ? { definitionDigest } : {}),
-  };
-}

package/src/delegation-approval.ts

@@ -1,126 +0,0 @@
-import { DELEGATE_SUBJECT, type InheritableApproval } from "./approval.ts";
-import { agentCapability, workspaceCapability } from "./capabilities.ts";
-import {
-  approvalBindingsEqual,
-  buildApprovalBinding,
-  type ApprovalBinding,
-  type CorrelationMetadata,
-} from "./correlation.ts";
-import type { DefinitionDigest, SkillDefinition } from "./definitions.ts";
-import { AGENT_WILDCARD, WORKSPACE_WILDCARD, resolve, type Capability, type ResolveResult } from "./resolve.ts";
-
-/**
- * Resolve the approval half of one delegation after its requested capability set is known.
- *
- * Kept as one function because the ordering is security-relevant: compute the unapproved and potential
- * effective sets first, derive the exact binding from those trusted values, then decide which approvals
- * match. An approval must never define the scope against which it is checked.
- */
-export function resolveDelegationApproval(input: {
-  task: string;
-  agent?: string;
-  requested: Capability[];
-  parentGrant: Capability[];
-  gated: Capability[];
-  approved?: InheritableApproval[];
-  spawned?: SkillDefinition;
-  definitionDigest?: DefinitionDigest;
-  /**
-   * Present iff this call is task-bound. Most values remain labels; optional tree_sha/last_change_seq enter
-   * the binding only to narrow a supplied approval to the upstream tree state that was reviewed.
-   */
-  correlation?: CorrelationMetadata;
-  /** Trusted: an id that was resolved against the operator registry and leased. Never a caller claim. */
-  boundWorkspaceId?: string;
-  /** Caller-declared label. Narrows the binding only; asserts nothing about enforcement. */
-  boundContextId?: string;
-  parentId: string;
-}): { result: ResolveResult; approvalBinding?: ApprovalBinding; bindingMismatch: boolean } {
-  const subject = input.agent ?? DELEGATE_SUBJECT;
-  const unapproved = resolve({
-    requested: input.requested,
-    parentGrant: input.parentGrant,
-    gated: input.gated,
-    approved: [],
-  });
-
-  /**
-   * Authorities the PARENT is spending on this one delegation, gated as such.
-   *
-   * ADR-0024 established the shape for `agent:<name>`: the id is gated as the parent's authority to run
-   * that definition *now*, and never joins requested/effective, because that would hand the child authority
-   * to recursively spawn itself. ADR-0035 added a second member of the category — `workspace:<id>`, the
-   * authority to route this child somewhere — and shipped without it, so `PI_GRANTS_GATED=workspace:prod`
-   * was accepted, recorded, and silently inert: no human was ever asked. The ADR claimed the opposite in
-   * three places.
-   *
-   * A LIST rather than two variables on purpose. This is the third namespace whose authorising id is gated
-   * per-delegation rather than granted downward, and the first two were written as one special case each;
-   * a fourth should extend an array, not add a third `if` and a third field to thread through.
-   */
-  const authorisingCapabilities: Capability[] = [];
-  const gateAuthority = (authorising: Capability, wildcard: Capability) => {
-    if (input.gated.includes(authorising) || input.gated.includes(wildcard)) {
-      authorisingCapabilities.push(authorising);
-      unapproved.gatedBlocked = [...unapproved.gatedBlocked, authorising];
-    }
-  };
-  if (input.spawned) gateAuthority(agentCapability(input.spawned.name), AGENT_WILDCARD);
-  // Trusted: `boundWorkspaceId` is set only from a routing spec resolved against the operator registry,
-  // never from a model-supplied `correlation` claim (R-110).
-  if (input.boundWorkspaceId) {
-    gateAuthority(workspaceCapability(input.boundWorkspaceId), WORKSPACE_WILDCARD);
-  }
-
-  const potential = resolve({
-    requested: input.requested,
-    parentGrant: input.parentGrant,
-    gated: input.gated,
-    // If the definition also declares its own authorising `agent:<name>`, the same approval unblocks
-    // that requested child capability too; excluding it here would bind a smaller set than we provision.
-    approved: unapproved.gatedBlocked,
-  });
-  const approvalBinding = input.correlation
-    ? buildApprovalBinding({
-        task: input.task,
-        requested: input.requested,
-        effective: potential.effective,
-        definitionSha256: input.definitionDigest?.sha256,
-        parentId: input.parentId,
-        workspaceId: input.boundWorkspaceId,
-        contextId: input.boundContextId,
-        treeSha: input.correlation?.tree_sha,
-        lastChangeSeq: input.correlation?.last_change_seq,
-      })
-    : undefined;
-
-  const forSubject = (input.approved ?? []).filter((approval) => approval.subject === subject);
-  const approvedCapabilities = forSubject
-    .filter((approval) =>
-      approvalBinding
-        ? approvalBindingsEqual(approval.binding, approvalBinding)
-        : approval.binding === undefined,
-    )
-    .map((approval) => approval.capability);
-  const bindingMismatch = approvalBinding !== undefined && forSubject.some(
-    (approval) => approval.binding !== undefined && !approvalBindingsEqual(approval.binding, approvalBinding),
-  );
-  const result = resolve({
-    requested: input.requested,
-    parentGrant: input.parentGrant,
-    gated: input.gated,
-    approved: approvedCapabilities,
-  });
-  // Filtered against what `resolve()` already listed, not just against approvals. In the ORDINARY chained
-  // configuration — route the child to `prod` AND grant it `workspace:prod` so it can route onward — the
-  // authorising id and the requested id are spelled identically, so appending unconditionally produced
-  // `gatedBlocked: ["workspace:prod","workspace:prod"]`, which reached the refusal text a model reads
-  // (*"workspace:prod, workspace:prod requires explicit approval"*) and the append-only ledger, whose schema
-  // has no `uniqueItems`. The old `agent:`-only code had the same shape and never hit it, because a
-  // self-recursive `agent:X` ceiling is not a thing anybody writes.
-  const stillGated = authorisingCapabilities.filter(
-    (c) => !approvedCapabilities.includes(c) && !result.gatedBlocked.includes(c),
-  );
-  if (stillGated.length > 0) result.gatedBlocked = [...result.gatedBlocked, ...stillGated];
-  return { result, ...(approvalBinding ? { approvalBinding } : {}), bindingMismatch };
-}

package/src/dispatch-control.ts

@@ -1,81 +0,0 @@
-import { createHash } from "node:crypto";
-import { canonicalWorkJson, copyWorkJson, parseWorkJson } from "./work-ledger-json.ts";
-
-export interface DispatchRequest {
-  version: "1.0"; requestId: string; bindingDigest: string; expectedRevision: number;
-  action: "pause-dispatch" | "resume-dispatch" | "cancel-execution" | "revise-scope" | "reprioritize" | "select-alternative";
-  targetExecutionId: string | null;
-}
-/** Independent trusted host declarations, NOT a wire request field or a file loaded by the controller. */
-export interface DispatchAuthority { authorityDigest: string; requestDigests: readonly string[] }
-export interface DispatchRecord {
-  request: Readonly<DispatchRequest>; digest: string;
-  decision: "approved" | "authority-unavailable" | "unsupported" | "stale" | "busy";
-  application: "pending" | "applied" | "not-applied";
-  outcome: "boundary-pending" | "paused" | "enabled" | "refused";
-}
-export interface DispatchState { revision: number; paused: boolean; records: DispatchRecord[] }
-export interface DispatchSnapshot {
-  version: "dispatch-control-snapshot-v1"; bindingDigest: string; freshness: "snapshot-unknown"; revision: number; paused: boolean;
-  admission: "blocked-pending" | "paused" | "enabled"; acceptance: "not-assessed";
-  records: readonly Readonly<DispatchRecord>[];
-}
-const hex = (x: unknown): x is string => typeof x === "string" && /^[a-f0-9]{64}$/.test(x);
-const id = (x: unknown): x is string => typeof x === "string" && /^[a-zA-Z0-9:_-]{1,128}$/.test(x);
-export function controlShape(value: unknown, keys: string[]): asserts value is Record<string, unknown> {
-  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)) ||
-    Reflect.ownKeys(value).length !== keys.length || keys.some(k => { const d = Object.getOwnPropertyDescriptor(value, k); return !d?.enumerable || !Object.hasOwn(d, "value"); })) throw new TypeError("closed dispatch control data required");
-}
-export function dispatchRequest(input: DispatchRequest): Readonly<DispatchRequest> {
-  controlShape(input, ["version", "requestId", "bindingDigest", "expectedRevision", "action", "targetExecutionId"]);
-  if (input.version !== "1.0" || !id(input.requestId) || !hex(input.bindingDigest) || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0 || input.expectedRevision > 128 ||
-    !["pause-dispatch", "resume-dispatch", "cancel-execution", "revise-scope", "reprioritize", "select-alternative"].includes(input.action) ||
-    !(input.targetExecutionId === null || id(input.targetExecutionId)) || (input.action === "cancel-execution" ? input.targetExecutionId === null : input.targetExecutionId !== null)) throw new TypeError("invalid dispatch request");
-  return Object.freeze({ version: input.version, requestId: input.requestId, bindingDigest: input.bindingDigest,
-    expectedRevision: input.expectedRevision, action: input.action, targetExecutionId: input.targetExecutionId });
-}
-export function parseDispatchRequest(text: string): Readonly<DispatchRequest> {
-  if (typeof text !== "string" || Buffer.byteLength(text) > 4096) throw new TypeError("bounded dispatch JSON required");
-  return dispatchRequest(parseWorkJson(text) as unknown as DispatchRequest);
-}
-export function dispatchRequestDigest(input: DispatchRequest): string {
-  return createHash("sha256").update(canonicalWorkJson(copyWorkJson(dispatchRequest(input)))).digest("hex");
-}
-export function dispatchAuthority(input: DispatchAuthority | null): Readonly<DispatchAuthority> | null {
-  if (input === null) return null;
-  controlShape(input, ["authorityDigest", "requestDigests"]);
-  const copy = copyWorkJson(input.requestDigests);
-  if (!hex(input.authorityDigest) || !Array.isArray(copy) || copy.length > 128 || !copy.every(hex) || new Set(copy).size !== copy.length) throw new TypeError("invalid independent dispatch authority");
-  return Object.freeze({ authorityDigest: input.authorityDigest, requestDigests: Object.freeze([...copy] as string[]) });
-}
-export function dispatchDecision(state: DispatchState, request: DispatchRequest, authorized: boolean, otherPending = false): DispatchRecord["decision"] {
-  if (!authorized) return "authority-unavailable";
-  if (!["pause-dispatch", "resume-dispatch"].includes(request.action)) return "unsupported";
-  if (request.expectedRevision !== state.revision) return "stale";
-  if (otherPending || state.records.some(r => r.application === "pending")) return "busy";
-  return "approved";
-}
-/** Replay operational controls only; no work-intent or acceptance projection is maintained here. */
-export function replayDispatch(state: DispatchState, event: Record<string, unknown>, bindingDigest: string, active: number, otherPending = false): void {
-  if (event.type === "control-request") {
-    controlShape(event, ["type", "request", "decision"]);
-    const request = dispatchRequest(event.request as DispatchRequest), decision = event.decision as DispatchRecord["decision"];
-    if (state.records.length >= 128 || request.bindingDigest !== bindingDigest || state.records.some(r => r.request.requestId === request.requestId) ||
-      !["approved", "authority-unavailable", "unsupported", "stale", "busy"].includes(decision) ||
-      dispatchDecision(state, request, decision !== "authority-unavailable", otherPending) !== decision) throw new Error("invalid dispatch decision sequence");
-    state.records.push({ request, digest: dispatchRequestDigest(request), decision,
-      application: decision === "approved" ? "pending" : "not-applied", outcome: decision === "approved" ? "boundary-pending" : "refused" });
-    if (decision === "approved") state.revision++;
-  } else {
-    controlShape(event, ["type", "requestId"]);
-    const record = state.records.find(r => r.request.requestId === event.requestId);
-    if (event.type !== "control-apply" || !record || record.application !== "pending" || active !== 0) throw new Error("unverified dispatch application boundary");
-    state.paused = record.request.action === "pause-dispatch";
-    record.application = "applied"; record.outcome = state.paused ? "paused" : "enabled";
-  }
-}
-export function freezeDispatch(state: DispatchState, bindingDigest: string, otherPending = false): Readonly<DispatchSnapshot> {
-  return Object.freeze({ version: "dispatch-control-snapshot-v1", bindingDigest, freshness: "snapshot-unknown", revision: state.revision, paused: state.paused,
-    admission: otherPending || state.records.some(r => r.application === "pending") ? "blocked-pending" : state.paused ? "paused" : "enabled",
-    acceptance: "not-assessed", records: Object.freeze(state.records.map(r => Object.freeze({ ...r }))) });
-}

package/src/effect-profile-runtime.ts

@@ -1,46 +0,0 @@
-import { createHash } from "node:crypto";
-import { lstat, readFile, realpath } from "node:fs/promises";
-
-export const DIGEST_PROFILE = "linux-bwrap-digest-v1" as const;
-export const DIGEST_WORKER = `const b=Buffer.from(process.argv[1],'base64');if(b.length>16384)process.exit(90);process.stdout.write(JSON.stringify({bytes:b.length,sha256:require('node:crypto').createHash('sha256').update(b).digest('hex')})+'\\n');`;
-export interface DigestRuntime { node: string; fingerprints: Readonly<Record<string, string>> }
-function executableDetails(path: string, st: { isFile(): boolean; mode: number; size: number }) {
-  return { path, regular: st.isFile(), mode: (st.mode & 0o7777).toString(8), size: st.size,
-    predicates: { notRegular: !st.isFile(), writable: (st.mode & 0o022) !== 0, oversize: st.size > 256 * 1024 * 1024 } };
-}
-/** Read-only independent observations; no installation, admission or namespace qualification. */
-export async function inspectDigestPrerequisites() {
-  const observations = [];
-  for (const requested of [process.execPath, "/usr/bin/bwrap", "/usr/bin/prlimit"]) {
-    try { const path = requested === process.execPath ? await realpath(requested) : requested;
-      const details = executableDetails(path, await lstat(path)); observations.push({ requested, ...details, conforms: !Object.values(details.predicates).some(Boolean) });
-    } catch (error) { observations.push({ requested, conforms: false, error: { code: (error as NodeJS.ErrnoException).code ?? null, message: String(error) } }); }
-  }
-  return { version: "digest-prerequisites-v1", platform: process.platform, nodeVersion: process.version, execPath: process.execPath,
-    conforms: process.platform === "linux" && observations.every(o => o.conforms), observations, qualification: "not-assessed" };
-}
-export async function digestRuntime(): Promise<DigestRuntime> {
-  if (process.platform !== "linux") throw new Error("Linux user/mount/PID/network namespaces required");
-  const node = await realpath(process.execPath), fingerprints: Record<string, string> = {};
-  for (const path of [node, "/usr/bin/bwrap", "/usr/bin/prlimit"]) {
-    const st = await lstat(path);
-    if (!st.isFile() || (st.mode & 0o022) !== 0 || st.size > 256 * 1024 * 1024) {
-      const details = executableDetails(path, st), code = details.predicates.notRegular ? "RUNTIME_NOT_REGULAR" : details.predicates.writable ? "RUNTIME_WRITABLE" : "RUNTIME_TOO_LARGE";
-      throw Object.assign(new Error("unsupported mutable runtime executable"), { code, path, details });
-    }
-    fingerprints[path] = createHash("sha256").update(await readFile(path)).digest("hex");
-  }
-  return Object.freeze({ node, fingerprints: Object.freeze(fingerprints) });
-}
-/** Internal fixed boundary builder. No user command/environment/workspace/destination interface. */
-export function digestNamespaceArgs(runtime: DigestRuntime, code: string, args: string[], fixture?: string): string[] {
-  return ["--unshare-all", "--die-with-parent", "--new-session", "--cap-drop", "ALL",
-    "--ro-bind", "/usr", "/usr", "--ro-bind", "/lib", "/lib", "--ro-bind", "/lib64", "/lib64",
-    "--dir", "/runtime", "--ro-bind", runtime.node, "/runtime/node",
-    ...(fixture ? ["--ro-bind", fixture, "/input"] : []),
-    "--proc", "/proc", "--dev", "/dev", "--clearenv", "--chdir", "/", "--",
-    "/usr/bin/prlimit", "--cpu=2:2", "--nofile=64:64", "--", "/runtime/node",
-    // No arbitrary code enters the production worker. Permission flags are additional tripwires,
-    // not a claim that Node's permission model is a hostile-JavaScript sandbox.
-    ...(fixture ? [] : ["--permission"]), "--max-old-space-size=32", "-e", code, ...args];
-}