pi-daddy 0.32.1 → 0.35.0

package/extensions/context-staging.ts

@@ -0,0 +1,208 @@
+/**
+ * Stage what a granted handoff hands over (ADR-0078).
+ *
+ * The kernel decides WHETHER context crosses and in which mode; this decides what the bytes are, because building
+ * them means reading files and the parent's own session and the kernel does no I/O. It is called only after the
+ * mode has survived the ceiling, the parent's grant and the gate, so a refused handoff reads nothing.
+ *
+ * **What authorises the read.** `context:files` is the authorisation, not `tool:read`: an operator who grants a
+ * definition the right to receive file contents has said so explicitly, in the grant, where a reviewer sees it.
+ * Paths are still confined to the session's working directory, because they are MODEL-supplied and the fence must
+ * not become a way to read `/etc` without holding a tool that can. That confinement is a bound on the parameter,
+ * not a claim of containment: the parent process can already read whatever its own grant allows.
+ *
+ * **What is not staged.** A mode whose input cannot be read — a missing file, an unreadable session — yields a
+ * section saying so rather than silence. A handoff that quietly carried less than it promised would be R-03's
+ * shape, a missing result indistinguishable from an empty one, and the child would have no way to know.
+ */
+import { randomUUID } from "node:crypto";
+import { closeSync, mkdirSync, openSync, readSync, realpathSync, rmSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import {
+  fenceContext,
+  selectPrunedTurns,
+  type ContextRequest,
+  type ContextSection,
+  type PrunableTurn,
+} from "../src/kernel/context-handoff.ts";
+
+/** The parent's session, as much of it as staging needs. Satisfied by pi's `ReadonlySessionManager`. */
+export interface ParentSession {
+  getSessionFile(): string | undefined;
+  getEntries(): Array<{ id: string; type: string }>;
+}
+
+export interface StagingInput {
+  cwd: string;
+  /** Where a forked session is written. One directory per fork, private to this uid. */
+  forkRoot: string;
+  parentSession?: ParentSession;
+}
+
+export interface StagedHandoff {
+  contextPrompt?: string;
+  forkFrom?: { sessionPath: string; sessionDir: string; sessionId: string };
+  /**
+   * Why nothing could be staged. Returned rather than thrown: `planDelegation` is pure and no caller expects it to
+   * throw, so a throw here escaped as a raw error with no ledger record, or as `APPROVAL_FLOW_FAILED` after the
+   * human had already said yes — measured in review.
+   */
+  refusal?: string;
+  /** Remove anything this staging created. A fork writes a copy of the parent's session and must not outlive it. */
+  dispose?: () => void;
+  /** For the ledger: what actually crossed, never what was asked for. Absent when nothing was staged. */
+  record?: {
+    mode: string;
+    sections: number;
+    bytes: number;
+    truncatedBytes: number;
+    keptTurns?: number;
+    droppedTurns?: number;
+    rule?: string;
+  };
+}
+
+/** 64 KiB per file before the fence's own budget sees it, so one large file cannot starve the others. */
+const MAX_FILE_BYTES = 64 * 1024;
+
+export function createHandoffStager(input: StagingInput) {
+  return (granted: ContextRequest, options: { keepTurnIds?: readonly string[] } = {}): StagedHandoff => {
+    if (granted.mode === "fork") return stageFork(input);
+    const sections: ContextSection[] = [];
+    let keptTurns: number | undefined;
+    let droppedTurns: number | undefined;
+    let rule: string | undefined;
+
+    if (granted.mode === "summary")
+      sections.push({ label: "what your parent says you need to know", body: granted.summary ?? "" });
+    if (granted.mode === "files" || granted.mode === "pruned")
+      for (const path of granted.files ?? []) sections.push(readSection(input.cwd, path));
+    if (granted.mode === "pruned") {
+      const all = parentTurns(input.parentSession);
+      const selection = selectPrunedTurns(all, {
+        ...(granted.turns !== undefined ? { turns: granted.turns } : {}),
+        ...(granted.files !== undefined ? { files: granted.files } : {}),
+      });
+      // A selector may only NARROW what the rule offered. Intersecting here rather than trusting the ids is the
+      // whole safety property: whatever a selector returns — a turn the rule dropped, a turn from another session,
+      // an id it invented — it cannot put a turn in front of a child that the deterministic rule did not surface.
+      const chosen =
+        options.keepTurnIds === undefined
+          ? selection.kept
+          : selection.kept.filter((turn) => options.keepTurnIds!.includes(turn.id));
+      keptTurns = chosen.length;
+      droppedTurns = all.length - chosen.length;
+      rule = options.keepTurnIds === undefined ? selection.rule : `${selection.rule}+advice`;
+      for (const turn of chosen) sections.push({ label: `parent turn ${turn.id}`, body: turn.text });
+      if (chosen.length === 0)
+        sections.push({ label: "parent turns", body: "(no turn of your parent's session matched the selection)" });
+    }
+
+    const fenced = fenceContext(sections);
+    return {
+      contextPrompt: fenced.text,
+      record: {
+        mode: granted.mode,
+        sections: sections.length,
+        bytes: Buffer.byteLength(fenced.text),
+        truncatedBytes: fenced.truncatedBytes,
+        ...(keptTurns !== undefined ? { keptTurns, droppedTurns, rule } : {}),
+      },
+    };
+  };
+}
+
+/**
+ * A fork replaces the session file the inactivity deadline would otherwise watch, because pi refuses `--fork`
+ * beside `--session`. The directory is ours and holds exactly one session, so the activity probe watches the
+ * directory instead of a fixed path — pi names the file `<timestamp>_<id>.jsonl` and only the id half is ours.
+ */
+function stageFork(input: StagingInput): StagedHandoff {
+  const sessionPath = input.parentSession?.getSessionFile();
+  if (!sessionPath)
+    // Not a silent downgrade to `none`: the parent asked for its whole session to cross and it has none to give.
+    return { refusal: "context: fork needs the parent's session file, and this session is not persisted" };
+  const sessionId = randomUUID();
+  const sessionDir = resolve(input.forkRoot, `fork-${sessionId}`);
+  try {
+    mkdirSync(sessionDir, { recursive: true, mode: 0o700 });
+  } catch (error) {
+    return { refusal: `context: fork could not allocate ${sessionDir} (${String(error)})` };
+  }
+  // The ledger records the SIZE of what crossed, because a fork is the largest handoff there is and recording it
+  // as zero bytes would make the audit trail understate exactly the mode that deserves the most scrutiny.
+  let bytes = 0;
+  let entries = 0;
+  try {
+    bytes = statSync(sessionPath).size;
+    entries = input.parentSession?.getEntries().length ?? 0;
+  } catch {
+    /* an unreadable parent session is still a fork pi will attempt; the record says 0 rather than guessing */
+  }
+  return {
+    forkFrom: { sessionPath, sessionDir, sessionId },
+    dispose: () => rmSync(sessionDir, { recursive: true, force: true }),
+    record: { mode: "fork", sections: 1, bytes, truncatedBytes: 0, keptTurns: entries, droppedTurns: 0 },
+  };
+}
+
+/** Read one named file, confined to the working directory, saying so in the fence when it cannot be read. */
+function readSection(cwd: string, path: string): ContextSection {
+  const refuse = (why: string) => ({ label: path, body: `(refused: ${why})` });
+  if (isAbsolute(path)) return refuse("an absolute path");
+  let absolute: string;
+  let root: string;
+  try {
+    // `realpath`, not `resolve`: `resolve`/`relative` are LEXICAL, so a symlink inside the working directory
+    // pointing anywhere at all passed the check — measured in review with `cwd/link.txt -> /tmp/outside.txt`,
+    // whose contents duly appeared inside the fence. A repository full of `node_modules/.bin` symlinks makes that
+    // the ordinary case rather than a contrived one.
+    root = realpathSync(resolve(cwd));
+    absolute = realpathSync(resolve(cwd, path));
+  } catch (error) {
+    return { label: path, body: `(could not be read: ${error instanceof Error ? error.message : String(error)})` };
+  }
+  const within = relative(root, absolute);
+  if (within.startsWith("..") || within === "" || isAbsolute(within))
+    return refuse("outside this session's working directory");
+  try {
+    const stats = statSync(absolute);
+    // A FIFO satisfies `statSync` and then never returns from a read, which would block the whole pi session with
+    // no watchdog — and the path is model-supplied, so it is reachable rather than theoretical.
+    if (!stats.isFile()) return refuse("not a regular file");
+    const note = stats.size > MAX_FILE_BYTES ? ` (first ${MAX_FILE_BYTES} of ${stats.size} bytes)` : "";
+    return { label: `${path}${note}`, body: readBounded(absolute, MAX_FILE_BYTES) };
+  } catch (error) {
+    return { label: path, body: `(could not be read: ${error instanceof Error ? error.message : String(error)})` };
+  }
+}
+
+/**
+ * Read at most `budget` BYTES, without pulling the rest of the file into the parent first.
+ *
+ * `readFileSync(...).slice(budget)` reads the whole file and then slices by UTF-16 code units, so a large file in
+ * the repository stalled the parent and the "(first N of M bytes)" label was wrong for any multi-byte content.
+ */
+function readBounded(path: string, budget: number): string {
+  const handle = openSync(path, "r");
+  try {
+    const buffer = Buffer.alloc(budget);
+    const read = readSync(handle, buffer, 0, budget, 0);
+    return new TextDecoder("utf-8", { fatal: false }).decode(buffer.subarray(0, read)).replace(/\uFFFD+$/, "");
+  } finally {
+    closeSync(handle);
+  }
+}
+
+/** The parent's message turns, reduced to what the selection rule needs. Never pi's own types past this point. */
+function parentTurns(session?: ParentSession): PrunableTurn[] {
+  if (!session) return [];
+  try {
+    return session
+      .getEntries()
+      .filter((entry) => entry.type === "message")
+      .map((entry) => ({ id: entry.id, text: JSON.stringify((entry as { message?: unknown }).message ?? entry) }));
+  } catch {
+    return [];
+  }
+}

package/extensions/delegate-chain.ts

@@ -41,6 +41,7 @@ import { GovernanceRefusal, refusal, type StructuredRefusal } from "../src/kerne
 import { chainApprovalFacts, newChainApprovalAudit, rememberChainApproval } from "./chain-approval-facts.ts";
 import { newExecutionId } from "../src/kernel/execution-id.ts";
 import { planChain, type GateRequest } from "./chain-plan.ts";
+import { contextShape } from "./context-shape.ts";
 import { preflightModel } from "../src/kernel/model-preflight.ts";
 import { assertDelegationAuthority } from "./delegation-authority.ts";
 
@@ -83,6 +84,7 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
         { description: "Requested Pi thinking level; unsupported model/level combinations fail in the child." },
       ),
     ),
+    context: Type.Optional(contextShape()),
     correlation: Type.Optional(correlationShape()),
     workspace: Type.Optional(
       Type.Object({

package/extensions/delegation-ledger.ts

@@ -39,6 +39,8 @@ export async function recordDelegationDecision(input: {
       taskFrom: input.taskFrom,
       taskFromExecutionId: input.taskFromExecutionId,
       requested: plan.requested,
+      // ADR-0078: what crossed, recorded as a fact about this child rather than as the parent's request.
+      ...(plan.handoffRecord ? { handoff: plan.handoffRecord } : {}),
       parentGrant: session.ownGrant,
       result: plan.result,
       blocked: !plan.ok,

package/extensions/delegation.ts

@@ -36,6 +36,7 @@ import { type GrantsSession } from "./session.ts";
 import { newDelegationOccurrence } from "./execution-occurrence.ts";
 import { correlationShape as buildCorrelationShape } from "./correlation-shape.ts";
 import { assertDelegationAuthority } from "./delegation-authority.ts";
+import { contextShape } from "./context-shape.ts";
 
 /**
  * Wire a set of children to pi's partial-result channel — ADR-0032.
@@ -189,6 +190,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
     tools: Type.Optional(Type.Array(Type.String(), { description: "Capabilities, when no 'agent' fits." })),
     model: Type.Optional(Type.String({ description: "Model as provider/id. Defaults to this session's." })),
     thinking: thinkingShape,
+    context: Type.Optional(contextShape()),
     correlation: Type.Optional(correlationShape),
     workspace: Type.Optional(workspaceShape),
   });
@@ -221,6 +223,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       }),
     ),
     thinking: thinkingShape,
+    context: Type.Optional(contextShape()),
     correlation: Type.Optional(correlationShape),
     workspace: Type.Optional(workspaceShape),
   });
@@ -247,6 +250,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
           tools: params.tools,
           model: params.model,
           thinking: params.thinking,
+          context: params.context,
           correlation: params.correlation,
           workspace: params.workspace,
         },

package/extensions/effort-advice.ts

@@ -0,0 +1,99 @@
+/**
+ * The first decision point that consults an advisor (ADR-0077, roadmap PR 8): how hard a child should think.
+ *
+ * **Why this one.** It is the shape the boundary was designed for. The options are not invented by the advisor —
+ * they are the thinking levels this session's own model reports it supports (`supportedModelEfforts`), so the
+ * advisor picks among things the caller already had, which is the entire permitted verb list. It touches no
+ * capability, no gate and no grant: the worst an advisor can do here is make a child think harder or less hard
+ * than a human would have chosen, and the ledger says it did.
+ *
+ * **Only when the caller said nothing.** An explicit `thinking` on the call is the operator's or the model's own
+ * choice and is never second-guessed; advice fills a blank, it does not overrule. With no advisor, no key, no
+ * answer, a timeout or an unrecognised response, the blank stays blank and the child is spawned exactly as it is
+ * today — which is the property that keeps advisors optional rather than load-bearing.
+ */
+import { supportedModelEfforts } from "../src/kernel/model-preflight.ts";
+import type { Advisor } from "../src/advisors/advisor.ts";
+
+/** What pi's resolved catalogue entry carries that decides which efforts exist. */
+interface ResolvedModel {
+  reasoning: boolean;
+  thinkingLevelMap?: Partial<Record<string, string | null>>;
+}
+
+export const EFFORT_PURPOSE = "child-effort";
+
+export async function adviseEffort(input: {
+  /** The session, read here rather than passed as an advisor: an argument can be severed and nothing notices. */
+  session: { advisorSession: { advisor: Advisor } };
+  /** Absent means the caller chose one; nothing is asked and nothing is recorded. */
+  requested?: string;
+  /**
+   * The model the CHILD will run on, `provider/id`, not the session's.
+   *
+   * Review measured the first version reading the parent session's model while the child was spawned on
+   * `spec.model`: the levels offered then came from a model the child would never use, and pi clamps rather than
+   * refuses, so the effect was a silently shifted effort rather than a loud failure.
+   */
+  model?: string;
+  registry: { find(provider: string, modelId: string): unknown };
+  task: string;
+  agent?: string;
+  signal?: AbortSignal;
+}): Promise<string | undefined> {
+  const advisor = input.session.advisorSession.advisor;
+  const slash = input.model === undefined ? -1 : input.model.indexOf("/");
+  if (input.requested !== undefined || slash <= 0) return input.requested;
+  const resolved = input.registry.find(input.model!.slice(0, slash), input.model!.slice(slash + 1)) as
+    ResolvedModel | undefined;
+  if (!resolved) return undefined;
+  const levels = supportedModelEfforts(resolved);
+  // One option is not a choice, and a model with no reasoning has exactly one. Asking would spend a call and a
+  // ledger line to be told the only thing that could be said.
+  if (levels.length < 2) return undefined;
+
+  const advice = await advisor.ask(
+    EFFORT_PURPOSE,
+    {
+      // The task text is what the decision is actually about, and it is the one thing this package has never
+      // stored (ADR-0021). It is sent to the advisor because an advisor cannot judge a task it cannot see, and it
+      // is NOT recorded: `createAdvisor` writes the question keys and the answer, never the state. An operator who
+      // is not willing to send task text to a third party leaves the advisor off, which is the default.
+      state: { task: input.task, ...(input.agent ? { definition: input.agent } : {}) },
+      questions: {
+        effort: {
+          kind: "choice",
+          instructions:
+            "How much reasoning effort does this task need? Choose the cheapest level that would still do it well.",
+          options: Object.fromEntries(levels.map((level) => [level, effortDescription(level)])),
+        },
+      },
+    },
+    input.signal,
+  );
+  const chosen = advice?.answers.effort;
+  // Belt and braces: `parseAnswer` already refuses a choice outside the options it was given, so this can only
+  // fire if a future decider is written that does not. An effort the model does not support would be refused by
+  // pi in the child, after the spawn, which is a worse place to find out.
+  if (!chosen || chosen.kind !== "choice" || !(levels as readonly string[]).includes(chosen.value)) return undefined;
+  return chosen.value;
+}
+
+function effortDescription(level: string): string {
+  switch (level) {
+    case "off":
+      return "No reasoning. Mechanical work: a rename, a formatting pass, reading one file back.";
+    case "minimal":
+      return "Almost none. A single obvious step with no choice in it.";
+    case "low":
+      return "A little. One decision, or a change confined to one file.";
+    case "medium":
+      return "Ordinary. Several steps, or a change that has to fit existing code.";
+    case "high":
+      return "Substantial. Design choices, or work across several files that must stay consistent.";
+    case "xhigh":
+      return "Very high. A subtle problem where the obvious approach is likely to be wrong.";
+    default:
+      return "The most this model can do. Reserve it for work that has defeated a lesser effort.";
+  }
+}

package/extensions/execute-child.ts

@@ -148,6 +148,14 @@ export async function executePlannedChild(input: {
     return await executeWithActivitySession();
   } finally {
     if (!keepPaneRequested) await activitySession.dispose();
+    // ADR-0078: a fork wrote a COPY of the parent's whole session to disk. PR 3e deletes its own temp session on
+    // every path and this must too, or every forked child leaves a full transcript behind for good.
+    if (!keepPaneRequested)
+      try {
+        plan.disposeHandoff?.();
+      } catch {
+        /* teardown must not replace the child's outcome */
+      }
   }
 
   async function executeWithActivitySession(): Promise<DelegationOutcome> {

package/extensions/grants-command.ts

@@ -32,6 +32,8 @@ export interface GrantsCommandContext {
    * sentence from the one the session banner printed. Two spellings of one fact is R-28.
    */
   executor: ExecutorChoice;
+  /** ADR-0077: which advisor is in force, or why none is. Reported because an advisor sends task text out. */
+  advisor: { decider: string; refusal?: string };
   observed: boolean;
   depth: number;
   maxDepth: number;
@@ -89,6 +91,7 @@ export const grantsCommand = {
       governed,
       ownGrant,
       executor,
+      advisor,
       observed,
       depth,
       maxDepth,
@@ -354,6 +357,13 @@ export const grantsCommand = {
       // two facts about what a spawn will be sit together.
       `  executor   ${executor.disclosure}`,
       `  depth      ${depth} of max ${maxDepth}${maxDepth <= 0 ? " (spawning disabled)" : ""}`,
+      // Rule 8's loud half, which review found missing: an operator who upgraded from 0.34.0, or who mistyped the
+      // variable, saw an advisor silently absent and nothing saying why. This is also where an operator sees that
+      // task text leaves the machine, which no other surface says.
+      advisor.decider === "none"
+        ? `  advisor    off${advisor.refusal ? ` — ${advisor.refusal}` : ""}`
+        : `  advisor    ${advisor.decider} — a delegation with no thinking level sends it the task text; ` +
+          `a pruned context handoff also sends session turns`,
       `  ledger     ${ledgerPath || "(not recording — set PI_DADDY_LEDGER)"}`,
       `  approvals  ${sessionApprovals.size} this session, ${valid.size} persisted` +
         `${inheritedApprovals.size > 0 ? `, ${inheritedApprovals.size} inherited` : ""}` +

package/extensions/grants.ts

@@ -79,6 +79,11 @@ export default function (pi: ExtensionAPI) {
     const reload = bindReloadLifecycle(owner, session.reloadLifecycle);
     session.reconcileEnvironment(reload.environment, reload.lifecycle);
     session.ownerBound = true;
+    // ADR-0078: the parent's own session, for a granted `pruned` or `fork` handoff. Read-only, and only ever
+    // read after the mode has survived the gate.
+    const manager = owner as Partial<import("./context-staging.ts").ParentSession>;
+    if (typeof manager.getSessionFile === "function" && typeof manager.getEntries === "function")
+      session.parentSession = manager as import("./context-staging.ts").ParentSession;
     delegation.refreshSpawnable = registerDelegationTools(pi, session).refreshSpawnable;
     reconcileActiveDelegationTools(pi, session);
     session.cwd = ctx.cwd;
@@ -369,6 +374,10 @@ export default function (pi: ExtensionAPI) {
           depth: session.depth,
           maxDepth: session.maxDepth,
           ledgerPath: session.ledgerPath,
+          advisor: {
+            decider: session.advisorSession.deciderName,
+            ...(session.advisorSession.settings.refusal ? { refusal: session.advisorSession.settings.refusal } : {}),
+          },
           catalog: session.catalog,
           definitions: session.definitions,
           sessionApprovals: session.sessionApprovals,

package/extensions/pruning-advice.ts

@@ -0,0 +1,88 @@
+/**
+ * The second decision point: which of the parent's turns a `pruned` handoff actually carries (ADR-0077).
+ *
+ * The deterministic rule keeps the last few turns plus older ones naming the given files. That rule is honest and
+ * its recall is unmeasured — it is a proxy for "what matters here", not an answer. An advisor can judge the turns
+ * against the task the child is about to be given, which the rule cannot see.
+ *
+ * **It can only take turns away.** The candidates are exactly what `selectPrunedTurns` produced; the advisor is
+ * asked one boolean per candidate and the ids it kept are handed back. Staging then intersects those ids with the
+ * candidates again, so even a selector that invented an id, returned one from another session, or returned every
+ * id in existence cannot put a turn in front of a child that the rule did not already offer. Narrowing is the only
+ * verb available, which is what makes this advice rather than authority.
+ *
+ * With no advisor, no answer, a timeout or an unrecognised response, nothing is returned and the rule's own
+ * selection stands — the same "identical to today" property the effort decision point has.
+ */
+import { selectPrunedTurns, type ContextRequest } from "../src/kernel/context-handoff.ts";
+import type { Advisor } from "../src/advisors/advisor.ts";
+import type { Question } from "../src/advisors/decider.ts";
+
+export const PRUNING_PURPOSE = "handoff-pruning";
+
+/**
+ * How many candidates may be judged. One question per turn, and a decision a human is waiting on should not carry
+ * an unbounded number of them; beyond this the rule's own selection stands, which is the safe direction.
+ */
+export const MAX_JUDGED_TURNS = 12;
+
+/** Just enough of the parent's session for the rule; the same shape `context-staging` reduces entries to. */
+export interface ParentTurnSource {
+  getEntries(): Array<{ id: string; type: string }>;
+}
+
+export async function advisePruning(input: {
+  session: { advisorSession: { advisor: Advisor }; parentSession?: ParentTurnSource };
+  granted: ContextRequest;
+  task: string;
+  signal?: AbortSignal;
+}): Promise<string[] | undefined> {
+  if (input.granted.mode !== "pruned" || !input.session.parentSession) return undefined;
+  const all = turnsOf(input.session.parentSession);
+  const candidates = selectPrunedTurns(all, {
+    ...(input.granted.turns !== undefined ? { turns: input.granted.turns } : {}),
+    ...(input.granted.files !== undefined ? { files: input.granted.files } : {}),
+  }).kept;
+  // Nothing to narrow, or more than a bounded number to judge: the rule stands and no call is made.
+  if (candidates.length < 2 || candidates.length > MAX_JUDGED_TURNS) return undefined;
+
+  const questions: Record<string, Question> = {};
+  for (const [index, turn] of candidates.entries())
+    questions[`turn${index}`] = {
+      kind: "noul",
+      // Both bounded: the task is embedded once per candidate, so an unbounded task became a request twelve times
+      // its size, on a two-second budget and the operator's key.
+      instructions: `Would a sub-agent doing this task be helped by seeing this part of the parent's session?\n\nTASK: ${input.task.slice(0, 2000)}\n\nPART:\n${turn.text.slice(0, 2000)}`,
+      whenTrue: "It bears on the task: a decision, a constraint, a fact the task depends on.",
+      whenFalse: "It does not: unrelated work, chatter, or something the task already states.",
+    };
+
+  const advice = await input.session.advisorSession.advisor.ask(
+    PRUNING_PURPOSE,
+    // The state is empty: everything the advisor needs is already in the questions, and a question carries the
+    // task and one turn rather than the whole session. Nothing here is recorded — `createAdvisor` writes keys.
+    { state: {}, questions },
+    input.signal,
+  );
+  if (!advice) return undefined;
+  // Every candidate or none. A response missing eleven of twelve answers would otherwise read as "drop eleven",
+  // which is a narrowing nobody asked for rather than the "unrecognised response means no advice" contract.
+  if (candidates.some((_, index) => advice.answers[`turn${index}`]?.kind !== "noul")) return undefined;
+  const kept = candidates
+    .filter((_, index) => (advice.answers[`turn${index}`] as { value: boolean }).value)
+    .map((turn) => turn.id);
+  // An advisor that drops everything is answering a different question from the one that was asked; the rule's
+  // selection stands rather than handing a child a handoff with nothing in it.
+  return kept.length === 0 ? undefined : kept;
+}
+
+function turnsOf(session: ParentTurnSource): Array<{ id: string; text: string }> {
+  try {
+    return session
+      .getEntries()
+      .filter((entry) => entry.type === "message")
+      .map((entry) => ({ id: entry.id, text: JSON.stringify((entry as { message?: unknown }).message ?? entry) }));
+  } catch {
+    return [];
+  }
+}

package/extensions/run-delegation.ts

@@ -12,6 +12,8 @@
  */
 
 import { nativeDelegationContext } from "./delegation-native.ts";
+import { adviseEffort } from "./effort-advice.ts";
+import { advisePruning } from "./pruning-advice.ts";
 import { DELEGATE_SUBJECT, shouldSeekApproval } from "../src/kernel/approval.ts";
 import { planDelegation } from "../src/kernel/delegate.ts";
 import {
@@ -45,6 +47,8 @@ interface ChildSpec {
   tools?: string[];
   model?: string;
   thinking?: string;
+  /** ADR-0078: what of the parent's session crosses. Validated in the kernel, never here. */
+  context?: unknown;
   correlation?: CorrelationMetadata;
   workspace?: DelegationWorkspaceSpec;
 }
@@ -247,7 +251,10 @@ export async function runOneDelegation(
     agent: spec.agent,
     tools: spec.tools,
     model: spec.model ?? defaultModel,
+    // Filled below, once the refusals that doom a delegation are known: asking first shipped the task text for a
+    // child that never starts, which is the ordering this module already fixed for the approval dialog.
     thinking: spec.thinking,
+    context: spec.context,
     correlation: spec.workspace
       ? { ...(spec.correlation ?? {}), workspace_id: spec.workspace.workspace_id }
       : spec.correlation,
@@ -286,6 +293,28 @@ export async function runOneDelegation(
     Boolean(executorRefusal || modelRefusal),
   );
   executorRefusal ||= nativeRefusal;
+
+  // ADR-0077's first decision point, after the refusal checks for the reason above. Fills a blank from the levels
+  // the CHILD's model reports; never overrules a caller, and yields today's behaviour whenever there is no answer.
+  if (!executorRefusal && !modelRefusal)
+    request.thinking = await adviseEffort({
+      session,
+      requested: spec.thinking,
+      model: spec.model ?? defaultModel,
+      registry: ctx.modelRegistry,
+      task: spec.task,
+      agent: spec.agent,
+      signal,
+    });
+
+  const planContext = await handoffPlanContext({
+    session,
+    base: extra,
+    task: spec.task,
+    blocked: Boolean(executorRefusal || modelRefusal),
+    preview: () => planWithApprovals(session, request, extra, null, signal, preApproved).then((r) => r.plan),
+    ...(signal ? { signal } : {}),
+  });
   let preparedWorkspace: PreparedWorkspace | undefined;
   let approvalOutcome: ApprovalOutcome | undefined;
   let plan: ReturnType<typeof planDelegation>;
@@ -294,7 +323,7 @@ export async function runOneDelegation(
     // Check non-liftable refusals before taking a lease, and take the lease before asking a human. This
     // preserves both anti-race rules: a doomed spawn cannot bank approval, and a conflicting writer starts
     // no child process.
-    const preview = await planWithApprovals(session, request, extra, null, signal, preApproved);
+    const preview = await planWithApprovals(session, request, planContext, null, signal, preApproved);
     plan = preview.plan;
     if (plan.ok || shouldSeekApproval(plan.result)) {
       try {
@@ -308,7 +337,7 @@ export async function runOneDelegation(
           ledgerPath: session.ledgerPath,
         });
         request.correlation = preparedWorkspace.correlation;
-        const gated = await planWithApprovals(session, request, extra, ctx, signal, preApproved);
+        const gated = await planWithApprovals(session, request, planContext, ctx, signal, preApproved);
         plan = gated.plan;
         approvalOutcome = gated.approval;
       } catch (error) {
@@ -323,7 +352,7 @@ export async function runOneDelegation(
     const gated = await planWithApprovals(
       session,
       request,
-      extra,
+      planContext,
       executorRefusal || modelRefusal ? null : ctx,
       signal,
       preApproved,
@@ -406,3 +435,35 @@ export async function runOneDelegation(
     onProgress,
   });
 }
+
+/**
+ * The planner context for one delegation, including a `pruned` handoff narrowed by an advisor (ADR-0077).
+ *
+ * **Exported and taking its own `preview`, so the ordering is forced by a test rather than by a reviewer.** Three
+ * properties live here and each was, at some point in this change's history, true only because somebody had
+ * checked it by hand: an advisor is not asked for a delegation that is already refused; it is not asked until a
+ * plan says the `pruned` handoff actually survived the ceiling, the grant and the gate; and the ids it returns
+ * reach the planner. Reviewers measured all three by mutating the source and finding the suite still green. A
+ * function with a seam is the only version of this that a test can hold.
+ */
+export async function handoffPlanContext(input: {
+  session: Parameters<typeof advisePruning>[0]["session"];
+  base: Record<string, unknown>;
+  task: string;
+  /** A refusal is already certain, so nothing may be asked. */
+  blocked: boolean;
+  /** Plans with no human in the loop; its result decides whether an advisor is consulted at all. */
+  preview: () => Promise<{ handoff?: { mode: string } }>;
+  signal?: AbortSignal;
+}): Promise<Record<string, unknown>> {
+  if (input.blocked) return { ...input.base };
+  const plan = await input.preview();
+  if (plan.handoff?.mode !== "pruned") return { ...input.base };
+  const ids = await advisePruning({
+    session: input.session,
+    granted: plan.handoff as Parameters<typeof advisePruning>[0]["granted"],
+    task: input.task,
+    ...(input.signal ? { signal: input.signal } : {}),
+  });
+  return ids ? { ...input.base, handoffTurnIds: ids } : { ...input.base };
+}