pi-daddy 0.28.0 → 0.32.1

package/extensions/init-command.ts

@@ -7,11 +7,12 @@
  * guard exists to defend — every wiring bug this package has had lived in that file.
  */
 
-import { discoverSkillPackages } from "../src/skill-packages.ts";
-import { applyInit, planInit } from "../src/init.ts";
-import { registeredWorkspaceIds } from "../src/workspace.ts";
-import { grantStorePath, projectLedgerPath, saveGrant } from "../src/grant-store.ts";
-import { expandSubsumed, SUBSUMPTION, type Capability } from "../src/resolve.ts";
+import { discoverSkillPackages } from "../src/kernel/skill-packages.ts";
+import { applyInit, GITIGNORE_REINCLUDE_LINES, planInit, settingsIgnoredByGit } from "../src/governance/init.ts";
+import { PI_PROJECT_DIR } from "../src/kernel/project-paths.ts";
+import { registeredWorkspaceIds } from "../src/kernel/workspace.ts";
+import { grantStorePath, projectLedgerPath, saveGrant } from "../src/governance/grant-store.ts";
+import { expandSubsumed, SUBSUMPTION, type Capability } from "../src/kernel/resolve.ts";
 import type { GrantsSession } from "./session.ts";
 
 /**
@@ -55,7 +56,7 @@ export async function runInit(
   const outcome = await applyInit(plan);
   const lines = [
     `grants: ${plan.skills.length} definition(s) from ${packages.map((p) => `${p.name}@${p.version}`).join(", ")}`,
-    `  using ${plan.skills.filter(s => s.referenced).length} enabled definition(s) in place; no copies`,
+    `  using ${plan.skills.filter((s) => s.referenced).length} enabled definition(s) in place; no copies`,
     `  wrote ${outcome.written.length}, kept ${outcome.kept.length} already present` +
       `${outcome.failed.length > 0 ? `, ${outcome.failed.length} FAILED` : ""}`,
   ];
@@ -71,7 +72,7 @@ export async function runInit(
 
   for (const [capability, neededBy] of plan.withheldCapabilities) {
     // **Do not ask a question whose answer cannot matter.** `tool:bash` subsumes `write`, `edit` and
-    // `edit-diff` (`SUBSUMPTION`, `src/resolve.ts`), so once bash is granted those are already conferred.
+    // `edit-diff` (`SUBSUMPTION`, `src/kernel/resolve.ts`), so once bash is granted those are already conferred.
     // The first version asked anyway: an operator could answer *no* to `tool:write`, watch `/grants` allow
     // `build` with `tool:write`, and reasonably conclude the dialog was decorative. It was — that is R-47's
     // shape, a control that appears to do something and does not, inside a control built to prevent it.
@@ -84,11 +85,11 @@ export async function runInit(
       continue;
     }
     // The consequence sentence is per capability, and it reads the gate **in effect for this session** —
-    // `session.gated`, which is `PI_GRANTS_GATED` when the operator set it and `DEFAULT_GATED` otherwise.
+    // `session.gated`, which is `PI_DADDY_GATED` when the operator set it and `DEFAULT_GATED` otherwise.
     //
     // The first version read `DEFAULT_GATED` directly, which is the compile-time constant `["tool:bash"]`, and
     // `tool:bash` is consumed by the branch above — so the branch was **unreachable in every configuration**,
-    // and with `PI_GRANTS_GATED="tool:bash,tool:write"` (the value `renderGrantEnv` itself suggests) the
+    // and with `PI_DADDY_GATED="tool:bash,tool:write"` (the value `renderGrantEnv` itself suggests) the
     // dialog still printed the exact false sentence the fix claimed to remove. Dead code beside a claim that
     // it worked, which is this project's failure mode, in the commit correcting that failure mode.
     // No subsumption closure here, and the absence is deliberate. A `|| SUBSUMPTION[capability]…` disjunct was
@@ -124,7 +125,7 @@ export async function runInit(
   if (saved !== "saved") {
     lines.push(
       `  NOT STORED — ${saved === "busy" ? "another session holds the grant store" : "the store could not be written"}. ` +
-        `Nothing was changed; this session's grant is unchanged. Retry, or export PI_GRANTS_GRANT yourself.`,
+        `Nothing was changed; this session's grant is unchanged. Retry, or export PI_DADDY_GRANT yourself.`,
     );
     ctx.ui.notify(lines.join("\n"), "error");
     return;
@@ -139,7 +140,7 @@ export async function runInit(
 
   lines.push(
     `  stored at ${grantStorePath(ctx.cwd)} — outside this project, so no child can rewrite it`,
-    `  ledger ${ledger} — default for future pi sessions; PI_GRANTS_LEDGER still overrides it`,
+    `  ledger ${ledger} — default for future pi sessions; PI_DADDY_LEDGER still overrides it`,
   );
   if (granted.length > 0) lines.push(`  GRANTED: ${granted.join(", ")}`);
   if (alreadyConferred.length > 0) {
@@ -154,9 +155,14 @@ export async function runInit(
     lines.push(
       `  ROUTABLE WORKSPACES, listed and NOT granted: ${plan.routableWorkspaces.join(", ")}`,
       `    routing a child to one needs its id in the grant (ADR-0035); add the ones this project may use to ` +
-        `${plan.grantEnvPath}. Which worktree a child starts in is not something a package can declare for you.`,
+        `${plan.settingsPath}. Which worktree a child starts in is not something a package can declare for you.`,
     );
   }
+  if ((await settingsIgnoredByGit(plan.settingsPath)) === true)
+    lines.push(
+      `  NOTE: git ignores ${plan.settingsPath} (your root .gitignore covers ${PI_PROJECT_DIR}/), so the reviewable record ` +
+        `cannot be committed until you add: ${GITIGNORE_REINCLUDE_LINES.join("  ")}`,
+    );
   lines.push(`  live now (${finalGrant.length} capabilities) — no restart. /grants shows the verdicts.`);
   ctx.ui.notify(lines.join("\n"), "info");
 }

package/extensions/reload-environment.ts

@@ -1,7 +1,11 @@
-import { GRANT_ENV_KEYS } from "../src/propagation.ts";
+import { GRANT_ENV_KEYS } from "../src/kernel/propagation.ts";
 
 /** The root baseline and latest child publication for one real Pi session owner. */
-export interface ReloadLifecycle { root: Record<string, string | undefined>; published?: Record<string, string | undefined>; activityRootId?: string }
+export interface ReloadLifecycle {
+  root: Record<string, string | undefined>;
+  published?: Record<string, string | undefined>;
+  activityRootId?: string;
+}
 type SessionOwner = object;
 
 interface ReloadState {
@@ -15,10 +19,10 @@ function state(): ReloadState {
 }
 
 function snapshot(): Record<string, string | undefined> {
-  return Object.fromEntries(GRANT_ENV_KEYS.map(key => [key, process.env[key]]));
+  return Object.fromEntries(GRANT_ENV_KEYS.map((key) => [key, process.env[key]]));
 }
 function same(left: Record<string, string | undefined>, right: Record<string, string | undefined>): boolean {
-  return GRANT_ENV_KEYS.every(key => left[key] === right[key]);
+  return GRANT_ENV_KEYS.every((key) => left[key] === right[key]);
 }
 function withRoot(root: Record<string, string | undefined>): NodeJS.ProcessEnv {
   return { ...process.env, ...root };
@@ -35,7 +39,10 @@ export function beginExtensionLifecycle(): { environment: NodeJS.ProcessEnv; lif
  * A matching latest publication is child state from a known owner, not an explicit replacement for this
  * owner. An unmatched environment change is an explicit root replacement for THIS owner only.
  */
-export function bindReloadLifecycle(owner: SessionOwner, provisional: ReloadLifecycle): {
+export function bindReloadLifecycle(
+  owner: SessionOwner,
+  provisional: ReloadLifecycle,
+): {
   lifecycle: ReloadLifecycle;
   environment: NodeJS.ProcessEnv;
 } {

package/extensions/run-delegation.ts

@@ -12,8 +12,8 @@
  */
 
 import { nativeDelegationContext } from "./delegation-native.ts";
-import { DELEGATE_SUBJECT, shouldSeekApproval } from "../src/approval.ts";
-import { planDelegation } from "../src/delegate.ts";
+import { DELEGATE_SUBJECT, shouldSeekApproval } from "../src/kernel/approval.ts";
+import { planDelegation } from "../src/kernel/delegate.ts";
 import {
   obtainApprovals,
   republishable,
@@ -22,11 +22,11 @@ import {
   type ApprovalOutcome,
   type ApprovalUIContext,
 } from "./approvals.ts";
-import type { InheritableApproval } from "../src/approval.ts";
+import type { InheritableApproval } from "../src/kernel/approval.ts";
 import type { GrantsSession } from "./session.ts";
-import type { CorrelationMetadata } from "../src/correlation.ts";
-import { preflightModel, type ModelCatalogue } from "../src/model-preflight.ts";
-import { GovernanceRefusal, refusal as structuredRefusal } from "../src/refusals.ts";
+import type { CorrelationMetadata } from "../src/kernel/correlation.ts";
+import { preflightModel, type ModelCatalogue } from "../src/kernel/model-preflight.ts";
+import { GovernanceRefusal, refusal as structuredRefusal } from "../src/kernel/refusals.ts";
 import { executePlannedChild, type DelegationOutcome } from "./execute-child.ts";
 import { recordDelegationDecision, type ApprovalLedgerFacts } from "./delegation-ledger.ts";
 import type { ExecutionOccurrenceIds } from "./execution-occurrence.ts";
@@ -155,9 +155,7 @@ export async function planWithApprovals(
       plan = {
         ...plan,
         reason: approval.reason,
-        ...(approval.refusalCode
-          ? { refusal: structuredRefusal(approval.refusalCode, approval.reason) }
-          : {}),
+        ...(approval.refusalCode ? { refusal: structuredRefusal(approval.refusalCode, approval.reason) } : {}),
       };
     }
   } catch (error) {
@@ -204,7 +202,7 @@ export async function runOneDelegation(
    */
   options: {
     /** Actual public execute argument, never read from model-authored correlation or output. */
-    toolCallId?: string; declaredWork?: GrantsSession["declaredWork"];
+    toolCallId?: string;
     /** Progress for the parent's status block (ADR-0032). Display only. */
     onProgress?: (update: {
       /** Appended (process executor: a genuine byte stream). */
@@ -260,13 +258,13 @@ export async function runOneDelegation(
     boundContextId: spec.correlation?.context_id,
   };
 
-  // ADR-0031: herdr was DEMANDED (`PI_GRANTS_HERDR=1`) and is not answering. Refused rather than relocated —
+  // ADR-0031: herdr was DEMANDED (`PI_DADDY_HERDR=1`) and is not answering. Refused rather than relocated —
   // the operator chose that over falling back, so the ledger can never name a child that ran somewhere nobody
   // chose.
   //
   // **Decided BEFORE the gate, and the ordering is a fix.** This sat after `planWithApprovals`, which opens the
   // approval dialog — so with herdr down a human was asked to approve `tool:bash`, answered *Always*, and was
-  // then refused anyway. Measured: the answer still reached `process.env.PI_GRANTS_APPROVED`, still wrote a
+  // then refused anyway. Measured: the answer still reached `process.env.PI_DADDY_APPROVED`, still wrote a
   // **30-day project-wide** entry to the persisted store, and still produced a ledger line asserting a human
   // approved `bash` for a child that never existed. A refused operation must not leave authority behind, and
   // asking for permission that cannot be used is R-25's fatigue shape with nothing bought.
@@ -281,7 +279,12 @@ export async function runOneDelegation(
     session.modelResolutionCache,
     session.allowUnresolvedModels,
   );
-  const {extra,refusal:nativeRefusal}=await nativeDelegationContext(session,ids,budget,Boolean(executorRefusal||modelRefusal));
+  const { extra, refusal: nativeRefusal } = await nativeDelegationContext(
+    session,
+    ids,
+    budget,
+    Boolean(executorRefusal || modelRefusal),
+  );
   executorRefusal ||= nativeRefusal;
   let preparedWorkspace: PreparedWorkspace | undefined;
   let approvalOutcome: ApprovalOutcome | undefined;
@@ -309,9 +312,10 @@ export async function runOneDelegation(
         plan = gated.plan;
         approvalOutcome = gated.approval;
       } catch (error) {
-        const value = error instanceof GovernanceRefusal
-          ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
-          : structuredRefusal("WORKSPACE_LEASE_STALE", `workspace setup failed (${String(error)})`);
+        const value =
+          error instanceof GovernanceRefusal
+            ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
+            : structuredRefusal("WORKSPACE_LEASE_STALE", `workspace setup failed (${String(error)})`);
         plan = { ...plan, ok: false, reason: value.message, refusal: value };
       }
     }
@@ -340,8 +344,14 @@ export async function runOneDelegation(
   // The capability decision provisions the child, so this append remains load-bearing and fails closed.
   try {
     await recordDelegationDecision({
-      session, plan, ids, agent: spec.agent, taskFrom, taskFromExecutionId,
-      approval: approvalOutcome, approvalFacts,
+      session,
+      plan,
+      ids,
+      agent: spec.agent,
+      taskFrom,
+      taskFromExecutionId,
+      approval: approvalOutcome,
+      approvalFacts,
     });
   } catch (error) {
     plan = {
@@ -389,7 +399,7 @@ export async function runOneDelegation(
     childId: ids.childId,
     executionId: ids.executionId,
     parentExecutionId: ids.parentExecutionId,
-    toolCallId: options.toolCallId, declaredWork: options.declaredWork,
+    toolCallId: options.toolCallId,
     cwd: ctx.cwd,
     preparedWorkspace,
     signal,

package/extensions/session-environment.ts

@@ -1,20 +1,33 @@
-import { parseInherited } from "../src/approval.ts";
-import { DELEGATE_CAPABILITY } from "../src/delegate.ts";
-import { budgetFromEnv } from "../src/fanout.ts";
-import { WILDCARD } from "../src/pi-tools.ts";
+import { parseInherited } from "../src/kernel/approval.ts";
+import { DELEGATE_CAPABILITY } from "../src/kernel/delegate.ts";
+import { budgetFromEnv } from "../src/kernel/fanout.ts";
+import { WILDCARD } from "../src/kernel/pi-tools.ts";
 import {
-  depthConfig, deriveOwnGrant, gatedFromEnv, ENV_APPROVED, ENV_DEPTH, ENV_EXECUTION_ID, ENV_FANOUT,
-  ENV_GATED, ENV_GRANT, ENV_LEDGER, ENV_MAX_DEPTH, ENV_PARENT_ID, parseList,
-} from "../src/propagation.ts";
+  depthConfig,
+  deriveOwnGrant,
+  gatedFromEnv,
+  ENV_APPROVED,
+  ENV_DEPTH,
+  ENV_EXECUTION_ID,
+  ENV_FANOUT,
+  ENV_GATED,
+  ENV_GRANT,
+  ENV_LEDGER,
+  ENV_MAX_DEPTH,
+  ENV_PARENT_ID,
+  parseList,
+} from "../src/kernel/propagation.ts";
 import { storedGrantSessionState } from "./stored-grant-session.ts";
-import { chooseExecutor, ENV_HERDR } from "../src/executor.ts";
-import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/model-preflight.ts";
+import { chooseExecutor, ENV_HERDR } from "../src/executors/executor.ts";
+import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/kernel/model-preflight.ts";
 import type { ReloadLifecycle } from "./reload-environment.ts";
 import { ENV_GOVERNANCE, type GrantsSession } from "./session.ts";
 
 /** Rebuild every authority-bearing factory input once session_start identifies its real SDK owner. */
 export function reconcileSessionEnvironment(
-  session: GrantsSession, environment: NodeJS.ProcessEnv, lifecycle: ReloadLifecycle,
+  session: GrantsSession,
+  environment: NodeJS.ProcessEnv,
+  lifecycle: ReloadLifecycle,
 ): void {
   const grantRaw = environment[ENV_GRANT];
   const stored = storedGrantSessionState(grantRaw, session.storeCwd);
@@ -33,7 +46,8 @@ export function reconcileSessionEnvironment(
   session.ownSpawnId = environment[ENV_PARENT_ID]?.trim() || `d${session.depth}`;
   session.ownExecutionId = environment[ENV_EXECUTION_ID]?.trim() || undefined;
   session.fanoutBudget = budgetFromEnv(environment[ENV_FANOUT]);
-  session.mayDelegate = !session.governed || session.inherited.includes(DELEGATE_CAPABILITY) || session.inherited.includes(WILDCARD);
+  session.mayDelegate =
+    !session.governed || session.inherited.includes(DELEGATE_CAPABILITY) || session.inherited.includes(WILDCARD);
   session.allowUnresolvedModels = environment[ENV_ALLOW_UNRESOLVED_MODELS] === "1";
   session.reloadLifecycle = lifecycle;
   session.activityRootId = lifecycle.activityRootId ?? session.activityRootId;

package/extensions/session-report.ts

@@ -17,12 +17,22 @@
  */
 
 import { existsSync } from "node:fs";
-import { legacyApprovalsPath, sharedApprovalsPath } from "../src/approval-store.ts";
-import { verifyLedger } from "../src/ledger.ts";
-import { AGENT_WILDCARD } from "../src/resolve.ts";
+import { legacyApprovalsPath, sharedApprovalsPath } from "../src/governance/approval-store.ts";
+import { verifyLedger } from "../src/governance/ledger.ts";
+import { AGENT_WILDCARD } from "../src/kernel/resolve.ts";
 import { planWithApprovals } from "./run-delegation.ts";
 import type { GrantsSession } from "./session.ts";
 import { renderSpawnableSummary, summariseSpawnable } from "./spawn-summary.ts";
+import {
+  approvalsPath,
+  grantStorePath,
+  legacyGrantEnvPath,
+  legacyProjectLedgerPath,
+  legacyUserApprovalsPath,
+  legacyUserGrantStorePath,
+  projectLedgerPath,
+  projectSettingsPath,
+} from "../src/kernel/project-paths.ts";
 
 /**
  * The slice of pi's context this module needs: a working directory and somewhere to speak.
@@ -55,6 +65,40 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
   // different reason for not migrating: splitting it by `cwd` would be lossless, and it is still declined
   // because one-shot migration code in the layer with nine defects buys less than one re-approval costs.
   try {
+    // ADR-0076 PR 3c moved the user-level stores under one pi-daddy/ directory WITHOUT migration (operator
+    // decision, following ADR-0020). Name what was left behind, so "why does it ask again" has an answer.
+    for (const [label, legacy, current, action] of [
+      [
+        "grant store",
+        legacyUserGrantStorePath(ctx.cwd),
+        grantStorePath(ctx.cwd),
+        "run /grants init to record this project's grant again",
+      ],
+      [
+        "approvals",
+        legacyUserApprovalsPath(ctx.cwd),
+        approvalsPath(ctx.cwd),
+        "answer the gate again; stored approvals are not migrated",
+      ],
+      [
+        "project ledger",
+        legacyProjectLedgerPath(ctx.cwd),
+        projectLedgerPath(ctx.cwd),
+        "it is imported once at session start; the old file is kept untouched",
+      ],
+      [
+        "grants.env",
+        legacyGrantEnvPath(ctx.cwd),
+        projectSettingsPath(ctx.cwd),
+        "it is no longer written or read; a shell that still sources it points PI_DADDY_LEDGER at the old ledger — delete the file",
+      ],
+    ] as const) {
+      if (existsSync(legacy) && !existsSync(current))
+        ctx.ui.notify(
+          `grants: ${label} found at its pre-0.30 location ${legacy} and not at ${current} — ${action}.`,
+          "warning",
+        );
+    }
     if (existsSync(sharedApprovalsPath())) {
       ctx.ui.notify(
         `grants: ignoring ${sharedApprovalsPath()} — approvals are now stored one file per governed ` +
@@ -83,17 +127,21 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
   // `agent:*` grants no tools, but it authorises every definition in BOTH skill roots — including
   // `~/.pi/agent/skills/`, which other software installs into, so ADR-0017's "an operator-authored
   // file" is not true of everything it covers. Paired with a shell that is every body on disk running
-  // with `bash`. `docs/SPEC.md` calls the combination poor and nothing detected it, which is R-47's
+  // with `bash`. The README calls the combination poor and nothing detected it, which is R-47's
   // shape in a control shipped one day later.
-  if (session.ownGrant.includes(AGENT_WILDCARD) && session.gated.length === 0 && session.ownGrant.includes("tool:bash")) {
+  if (
+    session.ownGrant.includes(AGENT_WILDCARD) &&
+    session.gated.length === 0 &&
+    session.ownGrant.includes("tool:bash")
+  ) {
     ctx.ui.notify(
-      `grants: PI_GRANTS_GRANT pairs agent:* with tool:bash and gates nothing — every SKILL.md in ` +
+      `grants: PI_DADDY_GRANT pairs agent:* with tool:bash and gates nothing — every SKILL.md in ` +
         `this project AND in ~/.pi/agent/skills (which other tools install into) may run with a shell. ` +
-        `Enumerate the agent: ids you mean, or leave PI_GRANTS_GATED at its default so bash is asked for.`,
+        `Enumerate the agent: ids you mean, or leave PI_DADDY_GATED at its default so bash is asked for.`,
       "warning",
     );
   }
-  // REMOVED 2026-08-21. This warned that an `agent:` id in `PI_GRANTS_GATED` "does NOT gate spawning that
+  // REMOVED 2026-08-21. This warned that an `agent:` id in `PI_DADDY_GATED` "does NOT gate spawning that
   // definition — a human is never asked". It was R-47's PARTIAL fix (0.11.1) and became false one release
   // later at 0.12.0, when ADR-0024's gate landed (`4673348`, "gating a definition asks before it runs") and
   // a gated `agent:<name>` began blocking the spawn until somebody approved it. ADR-0024's own Costs section
@@ -108,7 +156,7 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
   // no live case is the next stale claim. R-134.
   // R-34. `verifyLedger` existed and nothing ran it, so a torn line was detectable and undetected —
   // and a check an operator has to know to run is not a control, it is a feature. Setting
-  // `PI_GRANTS_LEDGER` already means "I want an audit trail"; noticing that the trail is damaged is
+  // `PI_DADDY_LEDGER` already means "I want an audit trail"; noticing that the trail is damaged is
   // part of keeping one.
   //
   // Corruption only, deliberately. The escalation count is a *query* — `/grants ledger` answers it —
@@ -122,7 +170,7 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
   // where an operator asked a direct question and deserves the failure — and this call is the only one
   // that makes it inside the blanket catch below. So an unreadable ledger threw here and cancelled every
   // remaining control **in silence**: no alarm, and not even the `holding [...]` line that is the one
-  // sign governance is on. Confirmed by execution — `PI_GRANTS_LEDGER` naming a directory produced ZERO
+  // sign governance is on. Confirmed by execution — `PI_DADDY_LEDGER` naming a directory produced ZERO
   // notifications from a governed session. A trail that cannot be read at all is a worse failure than a
   // torn line, and it was the one case this control said nothing about.
   if (session.ledgerPath) {
@@ -142,7 +190,7 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
         `grants: ledger ${session.ledgerPath} could not be read ` +
           `(${(error as { code?: string }).code ?? String(error)}) — nothing can be verified about this ` +
           `audit trail, and the first spawn will refuse rather than proceed unrecorded. Check that ` +
-          `PI_GRANTS_LEDGER names a writable FILE.`,
+          `PI_DADDY_LEDGER names a writable FILE.`,
         "error",
       );
     }
@@ -183,7 +231,8 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
     ctx.ui.notify(`grants: executor — ${session.executor.disclosure}`, "error");
   }
 
-  if (!session.governed) info.push("grants: governance off by PI_DADDY_GOVERNANCE; observation and the local timeline remain independent.");
+  if (!session.governed)
+    info.push("grants: governance off by PI_DADDY_GOVERNANCE; observation and the local timeline remain independent.");
   if (session.governed) {
     info.push(
       `grants: depth ${session.depth}/${session.maxDepth}, holding [${session.ownGrant.join(", ") || "nothing"}]`,

package/extensions/session.ts

@@ -14,15 +14,15 @@
  * copy of `ownGrant` before observation is exactly how a stale upper bound would become an enforced one.
  */
 import { randomUUID } from "node:crypto";
-import { parseInherited, type InheritableApproval } from "../src/approval.ts";
-import type { ApprovalBinding } from "../src/correlation.ts";
-import { createApprovalGateProvider } from "../src/approval-prompt.ts";
-import { makeCatalog, skillPathsFromCatalog, type Catalog } from "../src/catalog.ts";
-import type { SkillDefinition } from "../src/definitions.ts";
-import { DELEGATE_CAPABILITY, type DelegationContext } from "../src/delegate.ts";
-import { budgetFromEnv } from "../src/fanout.ts";
-import { chooseExecutor, ENV_HERDR, type ExecutorChoice } from "../src/executor.ts";
-import { WILDCARD } from "../src/pi-tools.ts";
+import { parseInherited, type InheritableApproval } from "../src/kernel/approval.ts";
+import type { ApprovalBinding } from "../src/kernel/correlation.ts";
+import { createApprovalGateProvider } from "../src/governance/approval-prompt.ts";
+import { makeCatalog, skillPathsFromCatalog, type Catalog } from "../src/kernel/catalog.ts";
+import type { SkillDefinition } from "../src/kernel/definitions.ts";
+import { DELEGATE_CAPABILITY, type DelegationContext } from "../src/kernel/delegate.ts";
+import { budgetFromEnv } from "../src/kernel/fanout.ts";
+import { chooseExecutor, ENV_HERDR, type ExecutorChoice } from "../src/executors/executor.ts";
+import { WILDCARD } from "../src/kernel/pi-tools.ts";
 import {
   childEnv,
   depthConfig,
@@ -39,17 +39,16 @@ import {
   ENV_PARENT_ID,
   GRANT_ENV_KEYS,
   parseList,
-} from "../src/propagation.ts";
-import type { Capability } from "../src/resolve.ts";
-import { loadDefinitions } from "../src/definitions.ts";
-import { buildCatalog } from "../src/catalog.ts";
-import { ENV_WORKSPACE_REGISTRY } from "../src/workspace.ts";
-import type { GrantStoreRefusalReason } from "../src/grant-store.ts";
+} from "../src/kernel/propagation.ts";
+import type { Capability } from "../src/kernel/resolve.ts";
+import { loadDefinitions } from "../src/kernel/definitions.ts";
+import { buildCatalog } from "../src/kernel/catalog.ts";
+import { ENV_WORKSPACE_REGISTRY } from "../src/kernel/workspace.ts";
+import type { GrantStoreRefusalReason } from "../src/governance/grant-store.ts";
 import { republishable } from "./approvals.ts";
 import { storedGrantSessionState } from "./stored-grant-session.ts";
-import { nativeSessionRootFromEnv, type NativeSessionHost } from "../src/native-session-target.ts";
-import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/model-preflight.ts";
-import type { DeclaredWorkState } from "../src/work-command.ts";
+import { nativeSessionRootFromEnv, type NativeSessionHost } from "../src/executors/native-session-target.ts";
+import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/kernel/model-preflight.ts";
 import { beginExtensionLifecycle, rememberChildPublication, type ReloadLifecycle } from "./reload-environment.ts";
 import { reconcileSessionEnvironment } from "./session-environment.ts";
 /**
@@ -63,27 +62,48 @@ import { reconcileSessionEnvironment } from "./session-environment.ts";
  * `/grants`. Both executors still enforce the identical grant: the plan is the same, only the place it runs
  * differs.
  *
- * The table itself is a pure function in `../src/executor.ts`; re-exported here because this is where every
- * other `PI_GRANTS_*` name lives and a reader looking for it will look here.
+ * The table itself is a pure function in `src/executors/executor.ts`; re-exported here because this is where every
+ * other `PI_DADDY_*` name lives and a reader looking for it will look here.
  */
-export { ENV_HERDR } from "../src/executor.ts";
+export { ENV_HERDR } from "../src/executors/executor.ts";
 /**
  * herdr workspace for spawned panes — re-exported from where it is actually READ.
  *
  * It was declared here and read nowhere: `resolveWorkspace` reads the string literal, so the constant and the
  * literal could drift with nothing binding them. Re-exporting the single definition keeps this the place a reader
- * looks for a `PI_GRANTS_*` name without letting two spellings exist.
+ * looks for a `PI_DADDY_*` name without letting two spellings exist.
  *
  * Omitting the variable no longer means "let herdr choose": it falls back to the parent's own
  * `HERDR_WORKSPACE_ID`, because a child in a different workspace from the session that spawned it makes switching
  * to it a workspace hop (ADR-0032). This name is the operator's explicit override.
  */
-export { ENV_HERDR_WORKSPACE } from "../src/herdr-cli.ts";
+export { ENV_HERDR_WORKSPACE } from "../src/executors/herdr-cli.ts";
+import {
+  ENV_ACTIVITY_PARENT_TASK,
+  ENV_ACTIVITY_PATH,
+  ENV_ACTIVITY_ROOT,
+  ENV_ACTIVITY_TASK,
+} from "../src/products/activity-timeline.ts";
+import { ENV_HERDR_KEEP_PANE, ENV_GOVERNANCE } from "../src/kernel/env-names.ts";
+export { ENV_HERDR_KEEP_PANE, ENV_GOVERNANCE } from "../src/kernel/env-names.ts";
+import { adoptLegacyEnvironment } from "../src/kernel/env-names.ts";
+
+/** The activity timeline's per-child observation identity, handed to the kernel through `childEnv` (ADR-0076). */
+export function activityChildEnv(activity: { rootId: string; path: string; taskId?: string } | undefined) {
+  return (child: { childExecutionId?: string }): Readonly<Record<string, string>> =>
+    activity?.taskId && child.childExecutionId
+      ? {
+          [ENV_ACTIVITY_PATH]: activity.path,
+          [ENV_ACTIVITY_ROOT]: activity.rootId,
+          [ENV_ACTIVITY_TASK]: child.childExecutionId,
+          [ENV_ACTIVITY_PARENT_TASK]: activity.taskId,
+        }
+      : {};
+}
 /** Keep each child's pane after it finishes, for inspection. Off by default: fan-out would flood it. */
-export const ENV_HERDR_KEEP_PANE = "PI_GRANTS_HERDR_KEEP_PANE";
-export const ENV_GOVERNANCE = "PI_DADDY_GOVERNANCE";
-export interface VariantRunAccounting {runId:string;primaryExecutionId:string;shadowExecutionIds:string[];state:"running"|"settled";outcomes:null|{executionId:string;role:"primary"|"shadow";ok:boolean;reason:string|null}[]}
 export interface GrantsSession extends NativeSessionHost {
+  /** Legacy PI_GRANTS_* names adopted at construction (ADR-0076 PR 3b); the session-start warning names them. */
+  readonly adoptedLegacyEnv: readonly string[];
   /** False only for the explicit PI_DADDY_GOVERNANCE opt-out; otherwise roots are observed-bound. */
   governed: boolean;
   /** The upper bound handed down by the delegator, before this session's own tools are observed. */
@@ -129,9 +149,6 @@ export interface GrantsSession extends NativeSessionHost {
   /** Stable root identity plus current turn, used only to join local activity facts. */
   activityRootId: string;
   activity?: { rootId: string; path: string; taskId?: string };
-  declaredWork?: DeclaredWorkState; // Explicit operator selection; absence leaves execution visibly unbound.
-  /** Primary-return fan-outs retained by this original session; bounded and human-readable via /grants variants. */
-  readonly variantRuns: Map<string, VariantRunAccounting>;
   /** Root identity keyed to ctx.sessionManager once session_start supplies it. */
   reloadLifecycle: ReloadLifecycle;
   /** Approval keys approved for this session. In memory only — this dies with the process. */
@@ -237,7 +254,14 @@ export async function loadProjectDefinitions(session: GrantsSession, cwd: string
   });
   session.catalog = await session.catalogReady;
 }
-export function createGrantsSession(extensionPath: string | undefined, lifecycle?: ReloadLifecycle, observerExtensionPath?: string): GrantsSession {
+export function createGrantsSession(
+  extensionPath: string | undefined,
+  lifecycle?: ReloadLifecycle,
+  observerExtensionPath?: string,
+): GrantsSession {
+  // ADR-0076 PR 3b: legacy PI_GRANTS_* names are adopted BEFORE the first environment read and before the
+  // reload snapshot, or an operator on the old names would get an ungoverned wildcard root (review finding).
+  const adoptedLegacyEnv = adoptLegacyEnvironment(process.env);
   const started = lifecycle ? undefined : beginExtensionLifecycle();
   const activeLifecycle = lifecycle ?? started!.lifecycle;
   const environment = lifecycle ? process.env : started!.environment;
@@ -265,16 +289,17 @@ export function createGrantsSession(extensionPath: string | undefined, lifecycle
   const { depth, maxDepth } = bounds;
   const emptyCatalog = makeCatalog([]);
   const session: GrantsSession = {
+    adoptedLegacyEnv,
     governed,
     inherited,
     depth,
     maxDepth,
     malformedBounds: bounds.malformed,
     // ADR-0012: `bash` is gated by DEFAULT — but only in a governed session. An ungoverned one
-    // (no PI_GRANTS_GRANT) still blocks nothing, so "governance is opt-in" holds exactly where it always
+    // (no PI_DADDY_GRANT) still blocks nothing, so "governance is opt-in" holds exactly where it always
     // did. Inside a session the operator already chose to govern, handing a child `bash` hands it an
     // ungoverned-descendant escape hatch, and doing that silently is what changes here.
-    // `PI_GRANTS_GATED=""` turns the default off; absent and empty are deliberately distinguishable.
+    // `PI_DADDY_GATED=""` turns the default off; absent and empty are deliberately distinguishable.
     gated: governed ? gatedFromEnv(environment[ENV_GATED]) : parseList(environment[ENV_GATED]),
     // Presence wins, including an explicitly empty value for a one-run opt-out. The store is eligible only
     // when ENV_GRANT was absent above, preserving the environment as the child's single authority channel.
@@ -306,7 +331,6 @@ export function createGrantsSession(extensionPath: string | undefined, lifecycle
     extensionPath,
     observerExtensionPath,
     activityRootId,
-    variantRuns: new Map(),
     reloadLifecycle: activeLifecycle,
     sessionApprovals: new Set<string>(),
     sessionApprovalBindings: new Map<string, ApprovalBinding>(),
@@ -327,7 +351,7 @@ export function createGrantsSession(extensionPath: string | undefined, lifecycle
       ledgerPath: session.ledgerPath,
       extensionPath: session.extensionPath,
       observerExtensionPath: session.observerExtensionPath,
-      activity: session.activity,
+      childEnv: activityChildEnv(session.activity),
       catalog: await session.catalogReady,
       // R-32: where each granted skill lives, so `planSpawn` can pass `--skill` for those and only those.
       // Derived from the catalog's own `source`, so it cannot drift from what was discovered.

package/extensions/spawn-summary.ts

@@ -11,7 +11,7 @@
  * **Decided by the real planner, and — since a reviewer caught it — no longer re-classified afterwards.**
  * The first version read two fields of `plan.result` and invented a category from them, which is the very
  * thing this header claimed to have made inexpressible: `planDelegation` has six refusals that leave both
- * fields empty, so a session at its depth limit, or one with a malformed `PI_GRANTS_MAX_DEPTH`, was told its
+ * fields empty, so a session at its depth limit, or one with a malformed `PI_DADDY_MAX_DEPTH`, was told its
  * **files** were written wrong while `/grants` in the same session said "delegation is disabled (maxDepth
  * 0)". That is R-28's shape inside the fix for R-28's shape. The planner's own `reason` is now printed for
  * anything the two designated signals do not explain.
@@ -23,12 +23,12 @@
  * and `/grants` run after any request is the settled answer.
  */
 
-import type { SkillDefinition } from "../src/definitions.ts";
+import type { SkillDefinition } from "../src/kernel/definitions.ts";
 import type { GatedPlan } from "./run-delegation.ts";
 
 /** Why a definition is not spawnable right now. Three causes, three different fixes. */
 export type WithheldReason =
-  /** The grant lacks `agent:<name>`, or lacks a tool the ceiling declares. Fix: widen `PI_GRANTS_GRANT`. */
+  /** The grant lacks `agent:<name>`, or lacks a tool the ceiling declares. Fix: widen `PI_DADDY_GRANT`. */
   | "capability"
   /** Everything is held, but a gated capability needs a human yes first. Fix: spawn it and answer. */
   | "approval"
@@ -108,7 +108,7 @@ export async function summariseSpawnable(
       notChecked: 0,
       sessionBlocked:
         `this session holds no tool:delegate, so it has no delegate tool at all — nothing can be spawned, ` +
-        `whatever any definition declares. Add tool:delegate to PI_GRANTS_GRANT to make this session a ` +
+        `whatever any definition declares. Add tool:delegate to PI_DADDY_GRANT to make this session a ` +
         `delegator rather than a leaf.`,
     };
   }
@@ -120,7 +120,7 @@ export async function summariseSpawnable(
       sessionBlocked:
         session.maxDepth <= 0
           ? `spawning is disabled for this session (max depth ${session.maxDepth}), so no definition can ` +
-            `run whatever its file says. If you did not set PI_GRANTS_MAX_DEPTH to 0, check the warning ` +
+            `run whatever its file says. If you did not set PI_DADDY_MAX_DEPTH to 0, check the warning ` +
             `above: a malformed value disables spawning deliberately.`
           : `this session is at its depth limit (${session.depth} of ${session.maxDepth}), so it may not ` +
             `spawn — a definition refused here is not a problem with its file.`,