pi-daddy 0.28.0 → 0.32.1

package/CHANGELOG.md

@@ -12,6 +12,113 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.32.1 — a doubled namespace in `allowed-tools` is explained, not just reported
+
+An `allowed-tools` entry written with a capitalised namespace, such as `Tool:Read`, misses the lower-case prefix test,
+is prefixed a second time on the bare-entry path and becomes `tool:tool:read`; `Workspace:prod` becomes
+`tool:workspace:prod`. That spelling is the one the Agent Skills standard and this package's own README example
+invite. `pi-daddy init` then refuses the definition and named only the mangled identifier, and a spawn refusal said
+the capability was absent from the catalog. Both messages now name the mistake and the entry that was meant. No
+behaviour beyond the wording changes: the refusal, its code and the effective grant are exactly as before.
+
+## 0.32.0 — a child is stopped for inactivity, not by a wall clock (ADR-0076 PR 3e)
+
+A governed child is now stopped when `PI_DADDY_CHILD_IDLE_TIMEOUT` seconds pass with no activity (default fifteen
+minutes; zero or malformed selects the default). Activity is a stdout or stderr byte, a change to the child's pi
+session file, or, on the process executor on Linux, CPU time in the child's process tree or a change in its
+descendants. Every child gets a session file for this: the retention target when one is configured, otherwise a
+private temporary file removed after the run on every path (kept only while an operator keeps a Herdr pane). Note the
+consequence: every child's transcript is on disk for the duration of its run, whether or not retention is on.
+`PI_DADDY_CHILD_TIMEOUT` is unchanged in meaning but is now the runaway ceiling with a six-hour default, so a build
+that runs the test suite is no longer killed at sixty minutes while a hung child is stopped in fifteen. Both executors
+apply the bound; on Herdr the signals are the session file and, when a progress display is attached, the pane text. Lifecycle events carry
+`idleTimeoutMs` beside `deadlineAt`, and a stop records `reason: "idle-timeout"` or `"wall-clock"`; the refusal text
+names the variable that sets the bound that fired. The `governance-event.schema.json` gains the optional field.
+
+## 0.31.0 — the big cleanup: the delegate path and its record, nothing else (BREAKING)
+
+Deleted, by operator decision, everything that was not the three tools, approvals, the ledger, workspaces, executors,
+the activity timeline and the read-only dashboard: the skill-harness learning product (`/grants host`, `/grants
+learning`, daily dashboard host, debrief, blind interventions, adoption policy, experiments, resource budget, intent and
+dispatch control, ordinary-children cancellation), the work DAG (`/grants work`, `pi-daddy work *`) and the work
+ledger v4, the daily view and panel, the check runner and workflow facts (ledger event kinds `check_receipt` and
+`workflow_fact`, refusal codes `CHECK_*`), the `guide` and `current` commands, `PRODUCT-GUIDE.md` and
+`REQUIREMENTS.md`. `pi-daddy-dashboard` takes only `--ledger`, `--once`, `--details`, `--no-color`.
+
+**What to do about it.** The export map is now the root and `contracts/*` only: replace any import from
+`pi-daddy/kernel`, `/ledger`, `/approvals`, `/executors`, `/dashboard`, `/work` or `/learning` with `pi-daddy`. Every
+contract except `contracts/ledger-record/v1` is gone; regenerate consumers from that one. skill-harness is no longer
+referenced. Project files `work.jsonl`, `work-current.json`, `work-setups/`, `work-outcomes/`, `work-policy-registry.json`,
+`work-policies/`, `work-registry-bindings/`, `learning-workspace.json` and `work-last-run.json` under `.pi/pi-daddy/`
+are no longer read or written; delete them when you like.
+
+The repository's `docs/` folder, `CLAUDE.md` and the pre-commit branch guard are gone too; `AGENTS.md` carries the
+rules, the decisions still in force, the measured facts and the roadmap, and `README.md` is the product description.
+
+## 0.30.0 — one record envelope, one namespace, one state directory (ADR-0076 PRs 2 through 3d-i and the cleanup)
+
+**PR 3d-i (BREAKING wire):** every grants-ledger and activity-timeline line is a record envelope
+(`contracts/ledger-record/v1/record.schema.json`); governance events are the `body`, unchanged
+(`governance-event.schema.json`, formerly ledger v3). A damaged file is read up to the damage and refuses appends with
+`LEDGER_DAMAGED` until `pi-daddy ledger repair <path> --yes`. A pre-format `.pi/grants.jsonl` is imported once at
+session start; ledger v2 is archived and no longer read. Consumers that pinned ledger v3 re-pin to
+`ledger-record/v1`; the work ledger keeps its v4 line until PR 3d-ii.
+
+**Earlier on this line (PR 2):** source layered under `src/{kernel,governance,executors,products}`
+
+**Cleanup (same unreleased line, BREAKING):** five features are deleted: the bwrap digest effect profile,
+factory orders, measured orders and sessions, the producer IPC bridge, and `delegate_all`'s primary/shadow mode
+with `/grants variants`. Their exports, contracts and CI steps are gone; `fixed-experiment-v2` charters are
+refused. The learning flow, dashboard, work plans and activity timeline are unchanged. The package README is a
+page; the older documents are under `docs/archive/`.
+
+**PR 3c (same unreleased line, BREAKING for operators):** every project file lives under `.pi/pi-daddy/`
+(`grants.jsonl`, `work.jsonl`, `work-current.json`, `work-setups/`, `work-outcomes/`, `work-policy-registry.json`,
+`work-policies/`, `work-registry-bindings/`, `learning-workspace.json`, `work-last-run.json`, `activity.jsonl`,
+`content/`), and every user-level store under `<agent dir>/pi-daddy/` (`grants/`, `approvals/`,
+`workspace-leases/`). **Nothing is migrated** (operator decision following ADR-0020): a session that finds a store
+at its old location and not at the new one says so at start; run `/grants init` again and answer the gate again.
+The old project ledger is left in place for the single-ledger release to import. `pi-daddy init` no longer writes
+`.pi/grants.env`; it writes `.pi/pi-daddy/settings.json`, the same reviewable record as JSON, plus a
+`.gitignore` that keeps everything else in that directory out of commits. **The default child timeout is sixty
+minutes** (was twenty; ADR-0038 dated note); an inactivity-based deadline is the next PR after the ledger format.
+
+**PR 3b (same unreleased line, BREAKING for operators and importers):** every `PI_GRANTS_*` environment
+variable is now `PI_DADDY_*` (same suffix; `PI_GRANTS_LEDGER` becomes `PI_DADDY_LEDGER`, which the dashboard
+already used for the same path). Legacy names are still read for one minor release with a warning; children are
+spawned with the new names only. The export map is nine keys: `pi-daddy`, `pi-daddy/kernel`, `pi-daddy/ledger`,
+`pi-daddy/approvals`, `pi-daddy/executors`, `pi-daddy/dashboard`, `pi-daddy/work`, `pi-daddy/learning` and
+`pi-daddy/contracts/*`. Every previous per-file subpath (`pi-daddy/spawn`, `pi-daddy/workspace`, …) is gone;
+import the layer barrel that holds it.
+`pi-daddy/contracts/*` deliberately exports every file under `contracts/`, READMEs included, where eighteen
+curated patterns were exported before. `PI_DADDY_GOVERNANCE` can no longer be set through the planner's
+`childEnv` hook: it is a governance key and the guard now refuses by the closed list, not by prefix.
+
+**PR 3a (same unreleased line):** the source is formatted with Prettier at width 120 and CI checks it; the
+module-size guard counts statements and caps lines at 200 characters; two tests that asserted the wording of
+repository documents were deleted. No runtime behaviour changed; seventeen long message and embedded-script
+strings were split with identical bytes.
+
+Internal restructure with no wire change. Export keys in `package.json` are unchanged and every subpath
+still resolves; the compiled files moved from `dist/<name>.js` to `dist/<layer>/<name>.js`, so anything that
+deep-imported a `dist/` file by path must use the export map instead. `pi-daddy/workspace` still exports the
+lease functions (now from `governance/workspace-public.ts`). **One type change:** the planner's
+`DelegationContext.activity` field is replaced by `childEnv?: (child) => Record<string,string>`; the kernel
+refuses any `PI_GRANTS_*` key from it. `test/layering.test.ts` enforces that no import points upward.
+
+## 0.28.1 — activity timeline safety and clearer outcomes
+
+- Render private prompt/final detail content as safe literal text: terminal controls are escaped, deliberate
+  line breaks are retained, and long detail lines wrap to the panel width. Metadata receives the same
+  control escaping; color-disabled output cannot gain ANSI/OSC sequences from retained content.
+- Clarify the default activity tree with semantic labels/colors, stable short selectors, compact quiet history,
+  separate parent-turn/child outcomes, and visible observed child-failure totals. Completion is not acceptance.
+- Pi's public extension/theme surface still cannot apply a per-extension background to ordinary assistant
+  transcript messages, so prompt/response backgrounds remain unchanged and no transcript is mutated.
+- The retained screenshot's `Herdr did not activate the bundled Pi lifecycle reporter before prompt dispatch`
+  launcher error remains unresolved: no retained demo session/log was inspected in that pass to prove a packet-local cause,
+  so no launcher behavior changed in this patch.
+
 ## 0.28.0 — unified activity timeline and default-on operation
 
 - Combine root turns, delegated agents and observed/declared skill activity in one filtered timeline with history.
@@ -779,129 +886,6 @@ One breaking change, and it is a type.
   SIGTERM nothing else in the process is listening for. **No signal handler is installed**, deliberately —
   one here would suppress Node's default termination and turn pi's "interrupt this turn" into "exit pi".
 
-## 0.11.0 is a breaking change: per-project approvals, and an inherited yes names its instructions
-
-Four decisions taken together after the first independent review of this package's approval layer
-(ADR-0020…ADR-0023). Two of them break compatibility.
-
-- **Approvals are stored one file per project**, under `$PI_CODING_AGENT_DIR/grants-approvals/`. The
-  single shared file could not express two checkouts holding an approval for a same-named definition —
-  `review`, `deploy`, i.e. what happens the moment you reuse your own conventions — and every write
-  touched every project's data, which is where four defects came from. **The old file is ignored, not
-  migrated**, and reported once; re-approve when next asked.
-- **`PI_GRANTS_APPROVED` carries a body digest**: `capability@subject#sha256`. A child verifies it against
-  the definition **it** loaded, because a child is a fresh process that re-reads from disk — so a
-  `git pull` mid-tree could otherwise let a descendant run rewritten instructions under a yes given about
-  the old ones. A 0.10 parent and a 0.11 child do not understand each other's format.
-- **The task is never stored.** `taskAtApproval` is gone: it put model-authored text in an always-on file
-  outside your repository for 30 days, which this package's own rule forbids — and it displayed as though
-  it scoped the approval, which it never did.
-- **`agent:*` exists.** "May spawn any of our definitions, but never hand over `write`" was previously
-  unexpressible; the only wildcard was `tool:*`, which is authority to grant every tool. `agent:*` confers
-  no tool authority. Do not pair it with `tool:bash`.
-
-## 0.9.0 / 0.10.0: an approval is pinned to the *instructions* as well as the tools
-
-**ADR-0018 and ADR-0019.** Two changes, and the second was a repair.
-
-**Every spawn naming a definition now records a `definitionDigest`** — `{name, source, sha256}` over the
-body, which is the exact text passed to the child as `--append-system-prompt`. So the ledger answers *"did
-these four children run the same instructions?"* and *"has this definition changed since?"*. It does not
-answer *what the instructions said*: the digest identifies text without reproducing it. **The task string
-is never recorded, in any field, by decision** — it is assembled by the model from the parent's context and
-could carry anything the parent could see.
-
-**`always` approvals were unreachable and are not any more.** `offeredScopes` gated that scope on the
-interceptor path, which 0.7.0 deleted — so **no version from 0.7.0 to 0.9.0 could create a persisted
-approval at all**, and the whole store was guarding a file nothing could write. `delegate({agent: X})` now
-approves against **`X`** and offers `always`; `delegate({tools: […]})` keeps the fixed `<delegate>` subject
-and is still never offered it. A persisted entry pins the definition's `allowed-tools` **and** its body
-digest, so rewriting what a child is told to do voids the approval (`instructions-changed`) — strictly
-stronger than ADR-0010 designed, since the ceiling check alone could never have seen a body change. An
-entry carrying no body pin fails closed: unverifiable is not unchanged.
-
-## 0.8.0 is a breaking change: spawning a definition requires `agent:<name>`
-
-**ADR-0017.** The catalog has always emitted `agent:<name>` for every definition and the parser has always
-accepted it, but **nothing ever checked it** (R-35). The only gate on `delegate({agent: "deploy"})` was
-whether that definition's `allowed-tools` fitted inside the session's grant — so governance covered what a
-child *can do* and never *which operator-authored instructions it was given*, and an operator could not
-say "this session may spawn `review` but not `deploy`".
-
-**What you must change:** an enumerated `PI_GRANTS_GRANT` now needs an `agent:` id per definition it may
-spawn. `PI_GRANTS_GRANT="tool:read,tool:delegate"` can spawn nothing by name; add `agent:review` to allow
-that one. `tool:*` satisfies any of them, so an **ungoverned session is unaffected** and `delegate({tools:
-[…]})` is untouched. The refusal names the missing capability and lists what the session *may* spawn.
-
-It attenuates like every other capability: a definition's own `allowed-tools` may list `agent:other`,
-which is how a delegator is told which definitions **it** may spawn — and a parent can never hand down one
-it does not hold. The id authorises; it is never passed to `--tools`.
-
-**Also fixed, and required for the above (R-36):** `deriveOwnGrant` filtered the inherited grant against
-the session's *observed tools*, which silently dropped `skill:` and `agent:` capabilities at the first
-provider request. A child holding `skill:review` therefore could not re-grant it, and `/grants` stopped
-listing it. Only `tool:` and `ext:` are filtered now — an observation says nothing about a namespace that
-is not tools.
-
-## 0.7.0 is a breaking change: this package is now the spawner, not a fence
-
-**ADR-0016.** Earlier versions were a governance layer wrapped around `@tintinweb/pi-subagents`: the
-product was a `tool_call` interceptor that decided whether *someone else's* spawn was permissible. It
-could refuse or allow, never narrow, because that package's `Agent` tool has no `tools` parameter — a
-ceiling no amount of local work could lift.
-
-This version spawns children itself, so **the grant is an argument rather than a veto**. What changed:
-
-- **`delegate({agent, task})` spawns a definition by name.** Definitions are **Agent Skills
-  (`SKILL.md`)** files — the open standard, already read by 16+ tools — and their `allowed-tools` field
-  becomes the grant. The spec calls that field *"pre-approved"* and **experimental**; it declares intent
-  and blocks nothing. Passed through `--tools` it becomes structural. **The standard declares intent;
-  this package makes it enforced.**
-- **`delegate_all` runs several children concurrently**, each with its own grant, its own instructions,
-  and no knowledge of the others.
-- **Two executors, one plan**: a captured child process (default) or a visible, attachable **herdr** pane
-  (`PI_GRANTS_HERDR=1`).
-- **Skills and context files are no longer inherited.** Previously a child spawned with `--tools read`
-  still loaded every skill the operator had, plus `CLAUDE.md` — measured, `docs/probes/g16-herdr`. So the
-  `skill:` capability namespace enforced nothing. It does now.
-- **A cardinality bound.** A subtree *budget* caps how many descendants may exist at all, because the old
-  `delegate` bounded that to one only by accident of being blocking.
-- **Removed:** the pi-subagents ceiling port (`agent-types.ts`, `interceptor.ts`). The `tool_call` hook
-  remains as a **tripwire** that refuses third-party spawn tools — installing one is a single command,
-  and a silently ungoverned descendant is the thing this package exists to prevent.
-
-Built because that guarantee does not exist elsewhere. `@tintinweb/pi-subagents` provisions statically per
-agent type and cannot be narrowed per spawn; `pi-fabric` provisions dynamically but **cannot constrain a
-recursive child at all** (measured: `docs/probes/pi-fabric-eval`).
-
-## Earlier
-
-### 0.6.0
-
-- **The approvals store moved out of the workspace** and a legacy in-workspace file is ignored with a
-  warning (see *Approving a gated capability*).
-- **`PI_GRANTS_APPROVED` carries `capability@subject` pairs** and `once` no longer crosses a boundary
-  (**ADR-0014**). A 0.5.x parent and a 0.6.x child do not understand each other's format.
-- **`bash` is gated by default** in a governed session, and gating is closed under subsumption, so
-  `PI_GRANTS_GATED=tool:write` also gates `bash` (**ADR-0012**). Set `PI_GRANTS_GATED=""` for the old
-  behaviour.
-- **`delegate` is registered only when the session may delegate**, which is what the docs always claimed.
-- Library entry points are compiled to `dist/`, so consumer imports work at all.
-
-### 0.5.0 — hardening from two independent reviews
-
-- **G1 · the argv channel.** Closed; see *Propagation is race-free by construction*.
-- **G6 · the ledger.** It reported allowed wildcard spawns as escalation attempts, and dropped every
-  refusal decided before resolution. Both fixed at the type level, so a new early exit cannot reintroduce
-  them.
-- **G7 · configuration.** Malformed bounds fail closed and say so; ungoverned sessions publish nothing; the
-  catalog is awaited rather than raced.
-- **G8 · child processes.** Caps, timeout, abort-before-spawn, real errors for failed children.
-- **ADR-0011 · universal capabilities** are refused on every path, and a wildcard-holding delegator no
-  longer bypasses a configured gate. Spawns that succeeded in 0.4.0 therefore fail — and **that reliance was
-  never sound**, since each of them handed a child either the entire catalog or a capability an operator had
-  explicitly gated. There is deliberately no override flag; the ledger names the capability and the reason.
-
 ---
 
-Requires pi ≥ 0.83.0, Node ≥ 22.19. MIT.
+Versions before 0.13.0 (never published) were moved to `../../docs/archive/CHANGELOG-prepublication.md` (repository `docs/archive/`) on 2026-09-21.