pi-daddy 0.37.0 → 0.38.0

package/dist/kernel/workspace-pin.js

@@ -0,0 +1,139 @@
+/**
+ * The inherited destination pin (ADR-0042): what a workspace id MEANT when the authority was granted.
+ *
+ * **The escalation this closes, measured in `g37-registry-tamper`.** `workspace:<id>` attenuates the NAME, not
+ * the mutable id-to-path meaning. A child holding `workspace:staging` and `tool:write` — no `bash` — can rewrite
+ * the operator's registry so `staging` points at the `prod` worktree, route a grandchild there, and take an
+ * exclusive write lease on it. Every capability check passes, because the id it was granted is the id it used.
+ * File ownership cannot help: a governed child runs as the parent's uid, so the registry is as writable to it as
+ * to the operator.
+ *
+ * **The mechanism is authority, not metadata.** A root resolves each registered id to its canonical destination
+ * and records a digest of it. Descendants inherit only the entries their effective grant authorises, cannot mint
+ * an entry, and routing requires an exact match against the inherited digest. A rewritten registry therefore
+ * changes where an id points and NOT what an inherited id is allowed to mean, which is the whole property.
+ *
+ * **Why a digest rather than the path.** The path is already visible to the child through the registry it can
+ * read; pinning the digest keeps the wire small for a realistic registry and makes an equality check the only
+ * operation, so there is no path-comparison subtlety to get wrong. `validateRegisteredWorkspace` still does the
+ * canonicalisation; this only asks whether the answer changed.
+ *
+ * **Every failure refuses.** Missing, empty, malformed and mismatched all refuse, because the alternative is a
+ * mechanism a child can disable by corrupting one byte. ADR-0042 records that an earlier attempt was reverted
+ * after four failures, and that it failed "specifically because it was treated as a small patch".
+ */
+import { createHash } from "node:crypto";
+import { isSafeWorkspaceId, workspaceCapability } from "./capabilities.js";
+export { ENV_WORKSPACE_PIN } from "./env-names.js";
+/**
+ * Half a SHA-256, hex. The comparison is equality against a value the operator's own root computed, not a
+ * signature, so this is sized to make accidental collision impossible rather than to resist an adversary who
+ * can already choose both sides.
+ */
+const DIGEST_HEX = 32;
+/** A canonical destination, reduced to something an environment variable can carry. */
+export function destinationDigest(canonicalRoot) {
+    return createHash("sha256").update(canonicalRoot, "utf8").digest("hex").slice(0, DIGEST_HEX);
+}
+/** `id:digest` pairs. Ids cannot contain `:` or `,` — `isSafeWorkspaceId` is the reason this is unambiguous. */
+export function formatWorkspacePin(pins) {
+    return [...pins.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([id, digest]) => `${id}:${digest}`)
+        .join(",");
+}
+/**
+ * Read a pin, refusing anything that is not exactly the shape this module writes.
+ *
+ * An absent variable is NOT the same as an empty one and both are distinguished by the caller: absent means no
+ * root ever established a pin, empty means a parent established one and this child inherited no entries. Both
+ * refuse at routing time; they need different messages to be diagnosable.
+ */
+export function parseWorkspacePin(raw) {
+    if (raw === undefined)
+        return { refusal: "no destination pin was inherited" };
+    const trimmed = raw.trim();
+    if (trimmed === "")
+        return { pins: new Map() };
+    const pins = new Map();
+    for (const entry of trimmed.split(",")) {
+        const at = entry.lastIndexOf(":");
+        if (at <= 0)
+            return { refusal: `destination pin entry ${JSON.stringify(entry)} is not id:digest` };
+        const id = entry.slice(0, at);
+        const digest = entry.slice(at + 1);
+        if (!isSafeWorkspaceId(id))
+            return { refusal: `destination pin names a malformed workspace id ${JSON.stringify(id)}` };
+        if (!/^[0-9a-f]{32}$/.test(digest))
+            return { refusal: `destination pin for ${id} is not a ${DIGEST_HEX}-character digest` };
+        // A duplicated id with two digests is ambiguous, and picking either would let a tamperer supply both.
+        if (pins.has(id) && pins.get(id) !== digest)
+            return { refusal: `destination pin names ${id} twice with different destinations` };
+        pins.set(id, digest);
+    }
+    return { pins };
+}
+/**
+ * The pin a child inherits: the parent's entries, narrowed to the workspaces the child's grant actually names.
+ *
+ * Narrowing here rather than passing the parent's whole map is the difference between a pin and a hint. A child
+ * that cannot see an entry cannot route to it even if it rewrites the registry to make the id resolve, because
+ * routing needs a pin entry and it has none to offer.
+ */
+export function attenuateWorkspacePin(pins, inheritable) {
+    const held = new Set(inheritable);
+    return new Map([...pins.entries()].filter(([id]) => held.has(workspaceCapability(id))));
+}
+/**
+ * Does the registry still resolve this id to what the grant meant?
+ *
+ * Returns a refusal reason, or `undefined` when the destination matches. A string rather than a thrown error
+ * because the one caller already owns the refusal code and the `details` this belongs in.
+ */
+export function checkPinnedDestination(input) {
+    if ("refusal" in input.pin)
+        return input.pin.refusal;
+    const expected = input.pin.pins.get(input.workspaceId);
+    if (expected === undefined)
+        return (`no destination pin was inherited for workspace ${input.workspaceId}` +
+            (input.pin.pins.size > 0 ? ` — pinned: ${[...input.pin.pins.keys()].sort().join(", ")}` : ""));
+    const actual = destinationDigest(input.canonicalRoot);
+    if (actual !== expected)
+        return (`workspace ${input.workspaceId} now resolves to ${input.canonicalRoot}, which is not the destination this ` +
+            `session was granted. The registry has been rewritten since the grant was established, so the id no longer ` +
+            `means what it meant when it was authorised (ADR-0042)`);
+    return undefined;
+}
+/**
+ * Establish a root's pin by resolving every registered id to its canonical destination.
+ *
+ * **Only a session that inherited NO pin may call this**, and that rule is the mechanism. If a descendant could
+ * mint its own pin it would simply rewrite the registry and then re-establish, and the whole thing would be a
+ * comment. The caller enforces it because only the caller knows whether a pin was inherited; this function is
+ * the resolution, not the policy.
+ *
+ * An id whose destination cannot be canonicalised is LEFT OUT rather than pinned to a guess. Routing then
+ * refuses it for having no pin, which is the same direction as every other failure here.
+ */
+export async function establishWorkspacePin(registry, canonicalise, onSkipped) {
+    const pins = new Map();
+    for (const [id, entry] of Object.entries(registry.workspaces)) {
+        if (!isSafeWorkspaceId(id)) {
+            onSkipped?.(id, "its id is malformed");
+            continue;
+        }
+        try {
+            pins.set(id, destinationDigest(await canonicalise(entry.path)));
+        }
+        catch (error) {
+            // Rule 8, and `registeredWorkspaceIds` one file over carries the long version of why: this was a bare
+            // `catch {}`, so an unmounted worktree or a directory not yet created dropped a workspace silently and
+            // the operator met it later as "no destination pin was inherited", a message that names neither the
+            // directory nor the reason. Unresolvable still means no pin — routing must not invent one — but the
+            // caller is told which id and why.
+            onSkipped?.(id, `its destination could not be canonicalised (${String(error)})`);
+        }
+    }
+    return pins;
+}
+//# sourceMappingURL=workspace-pin.js.map

package/dist/kernel/workspace-pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-pin.js","sourceRoot":"","sources":["../../src/kernel/workspace-pin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,aAAqB;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAC/F,CAAC;AAID,gHAAgH;AAChH,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACpD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;SACvB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAID;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IAC9E,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnG,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,kDAAkD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7F,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,aAAa,UAAU,mBAAmB,EAAE,CAAC;QAC1F,sGAAsG;QACtG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM;YACzC,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,oCAAoC,EAAE,CAAC;QACtF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmB,EAAE,WAAkC;IAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAa,WAAW,CAAC,CAAC;IAC9C,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS;QACxB,OAAO,CACL,kDAAkD,KAAK,CAAC,WAAW,EAAE;YACrE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9F,CAAC;IACJ,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,QAAQ;QACrB,OAAO,CACL,aAAa,KAAK,CAAC,WAAW,oBAAoB,KAAK,CAAC,aAAa,sCAAsC;YAC3G,4GAA4G;YAC5G,uDAAuD,CACxD,CAAC;IACJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAA0D,EAC1D,YAA+C,EAC/C,SAAgD;IAEhD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,SAAS,EAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,iBAAiB,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sGAAsG;YACtG,uGAAuG;YACvG,oGAAoG;YACpG,oGAAoG;YACpG,mCAAmC;YACnC,SAAS,EAAE,CAAC,EAAE,EAAE,+CAA+C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/kernel/workspace.d.ts

@@ -1,3 +1,4 @@
+import { type ParsedPin } from "./workspace-pin.ts";
 export { ENV_WORKSPACE_REGISTRY } from "./env-names.ts";
 export type WorkspaceAccess = "read" | "write";
 export interface WorkspaceRegistryFile {
@@ -44,11 +45,29 @@ export declare function loadWorkspaceRegistry(path: string): Promise<WorkspaceRe
  * the old behaviour, which is why this is an optional parameter and not a changed return type.
  */
 export declare function registeredWorkspaceIds(registryPath?: string | undefined, onRefusal?: (reason: string) => void): Promise<string[]>;
-export declare function resolveWorkspace(registry: WorkspaceRegistryFile, workspaceId: string): Promise<ValidatedWorkspace>;
+/**
+ * Resolve an authorised id to a worktree, refusing if the id no longer means what the grant meant.
+ *
+ * **`pin` is REQUIRED, and it used to default to reading the environment.** That default was the last
+ * environment fallback in the routing path, and it was the wrong reassurance: after `publishChildEnv` the
+ * variable holds a session's CHILD's pin, so a two-argument call checked a session against its child's
+ * authority. It is dead in-tree — the one production caller always passes one — but this is a public export,
+ * so an embedder could reach it. Requiring the argument closes it permanently and makes "a session's own pin
+ * lives in memory" unbreakable rather than merely currently-true.
+ */
+export declare function resolveWorkspace(registry: WorkspaceRegistryFile, workspaceId: string, pin: ParsedPin): Promise<ValidatedWorkspace>;
 /**
  * Canonicalize and validate the initial workspace against Git's registered worktree list.
  * This prevents accidental misrouting. It does not constrain any path a child accesses after spawn.
  */
+/**
+ * Canonicalise and verify a registered root as a git worktree.
+ *
+ * **This performs NO destination-pin check (ADR-0042), deliberately and dangerously.** It answers "is this
+ * path the worktree it claims to be", not "may this session route here" — `resolveWorkspace` is the one that
+ * asks the second question, and it is the only path production takes. It is a public export, so it is said
+ * here rather than left to be discovered: an embedder calling this directly routes unpinned.
+ */
 export declare function validateRegisteredWorkspace(input: {
     workspaceId: string;
     registeredRoot: string;

package/dist/kernel/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/kernel/workspace.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAsBD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyFxF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,qBAAsC,EAClD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,qBAAqB,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0D9B"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/kernel/workspace.ts"],"names":[],"mappings":"AAWA,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAsBD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyFxF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,qBAAsC,EAClD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,qBAAqB,EAC/B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;GAGG;AACH;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0D9B"}

package/dist/kernel/workspace.js

@@ -9,6 +9,7 @@ import { promisify } from "node:util";
 import { GovernanceRefusal, refusal } from "./refusals.js";
 import { isSafeWorkspaceId, workspaceCapability } from "./capabilities.js";
 import { ENV_WORKSPACE_REGISTRY } from "./env-names.js";
+import { checkPinnedDestination } from "./workspace-pin.js";
 export { ENV_WORKSPACE_REGISTRY } from "./env-names.js";
 const execFileAsync = promisify(execFile);
 /**
@@ -127,7 +128,17 @@ export async function registeredWorkspaceIds(registryPath = process.env[ENV_WORK
         return [];
     }
 }
-export async function resolveWorkspace(registry, workspaceId) {
+/**
+ * Resolve an authorised id to a worktree, refusing if the id no longer means what the grant meant.
+ *
+ * **`pin` is REQUIRED, and it used to default to reading the environment.** That default was the last
+ * environment fallback in the routing path, and it was the wrong reassurance: after `publishChildEnv` the
+ * variable holds a session's CHILD's pin, so a two-argument call checked a session against its child's
+ * authority. It is dead in-tree — the one production caller always passes one — but this is a public export,
+ * so an embedder could reach it. Requiring the argument closes it permanently and makes "a session's own pin
+ * lives in memory" unbreakable rather than merely currently-true.
+ */
+export async function resolveWorkspace(registry, workspaceId, pin) {
     const registered = Object.hasOwn(registry.workspaces, workspaceId) ? registry.workspaces[workspaceId] : undefined;
     const known = Object.keys(registry.workspaces).sort();
     if (!registered) {
@@ -135,12 +146,31 @@ export async function resolveWorkspace(registry, workspaceId) {
             (registry.source ? ` ${registry.source}` : "") +
             (known.length > 0 ? ` — it lists: ${known.join(", ")}` : " — it lists nothing"), { workspace_id: workspaceId, ...(registry.source ? { registry_path: registry.source } : {}) }));
     }
-    return validateRegisteredWorkspace({ workspaceId, registeredRoot: registered.path });
+    const validated = await validateRegisteredWorkspace({ workspaceId, registeredRoot: registered.path });
+    // **ADR-0042, and it is checked HERE on purpose.** The capability check upstream asks whether this session may
+    // route to this NAME. This asks whether the name still points where it pointed when the name was granted —
+    // the question `g37-registry-tamper` showed nobody was asking. It runs after canonicalisation because the
+    // digest is of the canonical root; comparing the registry's raw string would be defeated by a symlink.
+    const mismatch = checkPinnedDestination({ workspaceId, canonicalRoot: validated.root, pin });
+    if (mismatch)
+        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_AUTHORIZED", `workspace ${workspaceId} is not routable: ${mismatch}`, {
+            workspace_id: workspaceId,
+            resolved_root: validated.root,
+        }));
+    return validated;
 }
 /**
  * Canonicalize and validate the initial workspace against Git's registered worktree list.
  * This prevents accidental misrouting. It does not constrain any path a child accesses after spawn.
  */
+/**
+ * Canonicalise and verify a registered root as a git worktree.
+ *
+ * **This performs NO destination-pin check (ADR-0042), deliberately and dangerously.** It answers "is this
+ * path the worktree it claims to be", not "may this session route here" — `resolveWorkspace` is the one that
+ * asks the second question, and it is the only path production takes. It is a public export, so it is said
+ * here rather than left to be discovered: an embedder calling this directly routes unpinned.
+ */
 export async function validateRegisteredWorkspace(input) {
     let registered;
     let supplied;

package/dist/kernel/workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/kernel/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AA2B1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,2GAA2G;IAC3G,2GAA2G;IAC3G,2GAA2G;IAC3G,qGAAqG;IACrG,2DAA2D;IAC3D,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE;QACvC,QAAQ,EAAE,kBAAkB;QAC5B,SAAS,EAAE,wBAAwB;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,OAAO,GACX,IAAI,CAAC,GAAG,KAAK,oBAAoB;YAC/B,CAAC,CAAC,sBAAsB,IAAI,yEAAyE;gBACnG,MAAM,sBAAsB,mEAAmE;gBAC/F,yCAAyC;YAC3C,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW;gBACxB,CAAC,CAAC,sBAAsB,IAAI,OAAO,IAAI,CAAC,IAAI,oBAAoB,kBAAkB,WAAW;oBAC3F,+DAA+D;gBACjE,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB;oBACjC,CAAC,CAAC,sBAAsB,IAAI,iBAAiB,kBAAkB,+BAA+B;wBAC5F,sEAAsE;oBACxE,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW;wBACxB,CAAC,CAAC,sBAAsB,IAAI,kCAAkC,wBAAwB,OAAO;4BAC3F,uEAAuE;wBACzE,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,YAAY;4BACzB,CAAC,CAAC,sBAAsB,IAAI,yBAAyB,IAAI,CAAC,MAAM,GAAG;4BACnE,CAAC,CAAC,sBAAsB,IAAI,uBAAuB,IAAI,CAAC,MAAM,GAAG,CAAC;QAC9E,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,0BAA0B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;IACtB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,0BAA0B,EAAE,sBAAsB,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YACrG,aAAa,EAAE,IAAI;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAwC,CAAC;IACtD,IACE,IAAI,EAAE,OAAO,KAAK,CAAC;QACnB,CAAC,IAAI,CAAC,UAAU;QAChB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAC9B,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,sBAAsB,IAAI,mDAAmD,EAC7E,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,4BAA4B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,6BAA6B,EAC3E,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAC1C,CACF,CAAC;QACJ,CAAC;QACD,uGAAuG;QACvG,wFAAwF;QACxF,qGAAqG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,+FAA+F;QAC/F,qFAAqF;QACrF,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,oBAAoB,EACpB,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,oDAAoD;gBAC7F,cAAc,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9E,6FAA6F;gBAC7F,gGAAgG;gBAChG,0FAA0F;gBAC1F,gBAAgB,IAAI,GAAG,EACzB,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAC1C,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAClD,SAAoC;IAEpC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAA+B,EAC/B,WAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,aAAa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,gDAAgD;YACtF,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,EACjF,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC9F,CACF,CAAC;IACJ,CAAC;IACD,OAAO,2BAA2B,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,IAAI,UAAkB,CAAC;IACvB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClD,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,qCAAqC,MAAM,CAAC,KAAK,CAAC,GAAG,EACnF,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CACpC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,gBAAgB,QAAQ,iCAAiC,UAAU,EAAE,EACnG,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAC1F,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CACV,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CACrG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,YAAY,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,gBAAgB,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,CAChB,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,kBAAkB,CAAC,EAAE;YACxG,QAAQ,EAAE,MAAM;SACjB,CAAC,CACH,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,CACX,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CACxG,CAAC,MAAM,CAAC;QACT,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3C,IAAI;aACD,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5G,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,wDAAwD,MAAM,CAAC,KAAK,CAAC,GAAG,EACtG,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CACjE,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/kernel/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAkB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AA2B1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,2GAA2G;IAC3G,2GAA2G;IAC3G,2GAA2G;IAC3G,qGAAqG;IACrG,2DAA2D;IAC3D,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE;QACvC,QAAQ,EAAE,kBAAkB;QAC5B,SAAS,EAAE,wBAAwB;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,OAAO,GACX,IAAI,CAAC,GAAG,KAAK,oBAAoB;YAC/B,CAAC,CAAC,sBAAsB,IAAI,yEAAyE;gBACnG,MAAM,sBAAsB,mEAAmE;gBAC/F,yCAAyC;YAC3C,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW;gBACxB,CAAC,CAAC,sBAAsB,IAAI,OAAO,IAAI,CAAC,IAAI,oBAAoB,kBAAkB,WAAW;oBAC3F,+DAA+D;gBACjE,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB;oBACjC,CAAC,CAAC,sBAAsB,IAAI,iBAAiB,kBAAkB,+BAA+B;wBAC5F,sEAAsE;oBACxE,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW;wBACxB,CAAC,CAAC,sBAAsB,IAAI,kCAAkC,wBAAwB,OAAO;4BAC3F,uEAAuE;wBACzE,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,YAAY;4BACzB,CAAC,CAAC,sBAAsB,IAAI,yBAAyB,IAAI,CAAC,MAAM,GAAG;4BACnE,CAAC,CAAC,sBAAsB,IAAI,uBAAuB,IAAI,CAAC,MAAM,GAAG,CAAC;QAC9E,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,0BAA0B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;IACtB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,0BAA0B,EAAE,sBAAsB,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YACrG,aAAa,EAAE,IAAI;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAwC,CAAC;IACtD,IACE,IAAI,EAAE,OAAO,KAAK,CAAC;QACnB,CAAC,IAAI,CAAC,UAAU;QAChB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAC9B,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,sBAAsB,IAAI,mDAAmD,EAC7E,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,4BAA4B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,6BAA6B,EAC3E,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAC1C,CACF,CAAC;QACJ,CAAC;QACD,uGAAuG;QACvG,wFAAwF;QACxF,qGAAqG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,+FAA+F;QAC/F,qFAAqF;QACrF,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,oBAAoB,EACpB,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,oDAAoD;gBAC7F,cAAc,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9E,6FAA6F;gBAC7F,gGAAgG;gBAChG,0FAA0F;gBAC1F,gBAAgB,IAAI,GAAG,EACzB,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAC1C,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAClD,SAAoC;IAEpC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAA+B,EAC/B,WAAmB,EACnB,GAAc;IAEd,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,aAAa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,gDAAgD;YACtF,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,EACjF,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC9F,CACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACtG,+GAA+G;IAC/G,2GAA2G;IAC3G,0GAA0G;IAC1G,uGAAuG;IACvG,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,IAAI,QAAQ;QACV,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,0BAA0B,EAAE,aAAa,WAAW,qBAAqB,QAAQ,EAAE,EAAE;YAC3F,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,SAAS,CAAC,IAAI;SAC9B,CAAC,CACH,CAAC;IACJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,IAAI,UAAkB,CAAC;IACvB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClD,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,qCAAqC,MAAM,CAAC,KAAK,CAAC,GAAG,EACnF,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CACpC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,gBAAgB,QAAQ,iCAAiC,UAAU,EAAE,EACnG,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAC1F,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CACV,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CACrG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,YAAY,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,gBAAgB,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,CAChB,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,kBAAkB,CAAC,EAAE;YACxG,QAAQ,EAAE,MAAM;SACjB,CAAC,CACH,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,CACX,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CACxG,CAAC,MAAM,CAAC;QACT,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3C,IAAI;aACD,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5G,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,wDAAwD,MAAM,CAAC,KAAK,CAAC,GAAG,EACtG,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CACjE,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/extensions/grants-command.ts

@@ -34,6 +34,8 @@ export interface GrantsCommandContext {
   executor: ExecutorChoice;
   /** ADR-0077: which advisor is in force, or why none is. Reported because an advisor sends task text out. */
   advisor: { decider: string; refusal?: string };
+  /** ADR-0042: which ids this session pinned, so a routing refusal is discoverable before it happens. */
+  workspacePin?: ReadonlyMap<string, string>;
   observed: boolean;
   depth: number;
   maxDepth: number;
@@ -92,6 +94,7 @@ export const grantsCommand = {
       ownGrant,
       executor,
       advisor,
+      workspacePin,
       observed,
       depth,
       maxDepth,
@@ -379,7 +382,19 @@ export const grantsCommand = {
         `${catalog.byKind("skill").length} skill, ${catalog.byKind("agentType").length} agent-type, ` +
         `${catalog.byKind("workspace").length} workspace`,
       ...(catalog.byKind("workspace").length > 0
-        ? [`  routable   ${catalog.byKind("workspace").join(", ")} — held ones only are usable (ADR-0035)`]
+        ? [
+            `  routable   ${catalog.byKind("workspace").join(", ")} — held ones only are usable (ADR-0035)`,
+            // ADR-0042 made a destination pin a PRECONDITION for routing, and it had no operator surface at
+            // all: not here, not at session start, not in the README. An operator refused for want of a pin
+            // could not discover that the mechanism existed, let alone which ids it covered.
+            `  pinned     ${
+              workspacePin === undefined
+                ? "(none — no workspace is routable this session)"
+                : workspacePin.size === 0
+                  ? "(none inherited — this session may route nowhere)"
+                  : `${[...workspacePin.keys()].sort().join(", ")} — routing refuses if a registry entry moves`
+            }`,
+          ]
         : []),
       // Rule 8's loud half again. The catalog fails soft on an unreadable registry, which is right, and used
       // to discard the reason with it, which was not: one malformed entry removed every workspace from this

package/extensions/grants.ts

@@ -378,6 +378,7 @@ export default function (pi: ExtensionAPI) {
             decider: session.advisorSession.deciderName,
             ...(session.advisorSession.settings.refusal ? { refusal: session.advisorSession.settings.refusal } : {}),
           },
+          ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
           catalog: session.catalog,
           definitions: session.definitions,
           sessionApprovals: session.sessionApprovals,

package/extensions/reload-environment.ts

@@ -5,6 +5,20 @@ export interface ReloadLifecycle {
   root: Record<string, string | undefined>;
   published?: Record<string, string | undefined>;
   activityRootId?: string;
+  /**
+   * The destination pin this owner settled on (ADR-0042), which must survive an extension reload.
+   *
+   * **Here rather than on the session, because a reload builds a NEW session.** `session.pinSettled` closed
+   * the `/grants init` re-mint, which reuses one session object, and left the reload open: a fresh object has
+   * no flag, a root legitimately inherited nothing and sits at depth 0, so it minted a second time — against
+   * whatever the registry said by then, which a child with `tool:write` had had the whole session to rewrite.
+   * A security review reproduced it. That is the same rule-on-the-object, second-path-builds-another-object
+   * shape this package keeps finding, three times in this feature alone.
+   *
+   * The lifecycle is keyed by owner in a `WeakMap` and is already the thing that "recovers its root rather
+   * than its child publication", so it is where settled-ness belongs.
+   */
+  workspacePin?: ReadonlyMap<string, string>;
 }
 type SessionOwner = object;
 
@@ -57,6 +71,17 @@ export function bindReloadLifecycle(
   if (!holder.latestChildPublication || !same(current, holder.latestChildPublication.environment)) {
     // No pi-daddy lifecycle published what is currently in process.env, so this is an explicit change to
     // this owner's root rather than another bound session's child state.
+    // **An explicit root replacement is a NEW grant, so the settled pin must go with the old one — but only
+    // when the root ACTUALLY changed.** The condition above is broader than this comment used to claim: its
+    // first disjunct fires when nothing has published yet in the process, where nothing has been replaced at
+    // all. Deleting there re-opened the mint window on the next reload, which review reproduced. Comparing
+    // against the stored root is what makes "replacement" mean replacement.
+    //
+    // The widening this closes: a replacement was honoured for the grant, the depth and the approvals and
+    // silently ignored for the pin, so a session reconciled to depth 1 — believing itself a descendant —
+    // kept a root-minted pin naming a workspace the replacement root never granted. Deleting it makes the
+    // next `establishRootPin` re-settle from the new root, which for a descendant means minting nothing.
+    if (!same(current, existing.root)) delete existing.workspacePin;
     existing.root = current;
   }
   return { lifecycle: existing, environment: withRoot(existing.root) };

package/extensions/run-delegation.ts

@@ -328,6 +328,7 @@ export async function runOneDelegation(
     if (plan.ok || shouldSeekApproval(plan.result)) {
       try {
         preparedWorkspace = await prepareDelegationWorkspace({
+          ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
           spec: { ...spec.workspace, access: governedWorkspaceAccess(spec.workspace.access, plan.requested) },
           correlation: spec.correlation,
           childId: ids.childId,

package/extensions/session-report.ts

@@ -67,6 +67,13 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
   // the moment somebody tries to delegate to it.
   for (const reason of session.definitionSkips)
     ctx.ui.notify(`grants: a definition was not loaded — ${reason}`, "warning");
+  // A registered workspace that could not be pinned is not routable this session, and the routing refusal an
+  // operator would otherwise meet names neither the directory nor the reason.
+  for (const skipped of session.workspaceSkips)
+    ctx.ui.notify(
+      `grants: workspace ${skipped} — it is registered but not routable this session (ADR-0042 destination pin)`,
+      "warning",
+    );
   if (session.catalog.registryRefusal)
     ctx.ui.notify(
       `grants: workspace registry unreadable, no workspace is routable this session — ${session.catalog.registryRefusal}`,

package/extensions/session.ts

@@ -56,6 +56,16 @@ import { agentDir, projectSettingsPath } from "../src/kernel/project-paths.ts";
 import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/kernel/model-preflight.ts";
 import { beginExtensionLifecycle, rememberChildPublication, type ReloadLifecycle } from "./reload-environment.ts";
 import { reconcileSessionEnvironment } from "./session-environment.ts";
+import { realpath } from "node:fs/promises";
+import {
+  establishWorkspacePin,
+  formatWorkspacePin,
+  parseWorkspacePin,
+  type WorkspacePins,
+  ENV_WORKSPACE_PIN,
+} from "../src/kernel/workspace-pin.ts";
+import { loadWorkspaceRegistry } from "../src/kernel/workspace.ts";
+
 /**
  * Run governed children in herdr panes instead of captured child processes.
  *
@@ -196,6 +206,19 @@ export interface GrantsSession extends NativeSessionHost {
    * capability.
    */
   definitionSkips: string[];
+  /**
+   * This session's OWN destination pin (ADR-0042), captured once at start.
+   *
+   * **In memory, not re-read from the environment, and that is not a style choice.** `publishChildEnv` writes
+   * the CHILD's narrowed pin into `process.env` — that is how a child inherits anything here — so a session
+   * that re-read the variable at routing time would read its child's pin and lose its own. `ownGrant` has
+   * lived in memory for exactly this reason; the pin reached the same trap, and a test caught it.
+   */
+  workspacePin?: WorkspacePins;
+  /** Whether this session has already settled its pin. Minting twice is how a reload laundered a tamper. */
+  pinSettled: boolean;
+  /** Registered workspaces this session could not pin, and why — reported at session start (rule 8). */
+  workspaceSkips: string[];
   catalog: Catalog;
   /**
    * The in-flight catalog build, so `delegate` can wait for it instead of racing it.
@@ -264,7 +287,85 @@ export interface GrantsSession extends NativeSessionHost {
  * selling point is "no restart"). Two copies of these three steps is how the two callers come to disagree
  * about what loading means, so there is one.
  */
+/**
+ * ADR-0042: a root records what each registered workspace id MEANT, once, before anything can rewrite it.
+ *
+ * **Only a session that inherited no pin establishes one.** A descendant that could mint its own would rewrite
+ * the registry, re-establish, and route anywhere — the mechanism would be a comment. So an inherited value is
+ * left exactly as it arrived, including an empty one, which says "your parent established a pin and gave you
+ * nothing from it" and refuses at routing with its own message.
+ *
+ * Failing to establish is not an error: a machine with no registry has no workspaces to route to, and the
+ * absent pin refuses anything that tries. That is the same direction as every other failure in this mechanism.
+ */
+async function establishRootPin(session: GrantsSession): Promise<void> {
+  if (session.pinSettled) return;
+  // **One assignment, at the end, on every path.** Review found the previous shape — assign at each `return`
+  // — missing two of five exits: the `catch` around an unreadable registry, which is precisely the state a
+  // child can create by truncating the file, and the no-registry return. A root that took either reached the
+  // RELOAD with the lifecycle still empty and minted over whatever the registry said by then, routing into
+  // prod. That is the checklist failing, so the checklist is gone: the body computes a value and the caller
+  // assigns both fields once.
+  // **Settled AFTER the value exists.** Setting the flag first meant a throw would leave the session marked
+  // settled with nothing settled — routing nowhere, which is safe, but with the LIFECYCLE unset, so the next
+  // reload would mint again. Review could construct no throw today; "currently unreachable" is exactly the
+  // property this feature has now been wrong about four times, and the ordering costs nothing.
+  const settled = await settleWorkspacePin(session);
+  session.pinSettled = true;
+  session.workspacePin = settled;
+  session.reloadLifecycle.workspacePin = settled;
+}
+
+/**
+ * What this session's destination pin IS (ADR-0042). Every path returns a map; none writes anything.
+ *
+ * An empty map means "settled, and you may route nowhere", which is different from never having settled and
+ * is what every failure resolves to. The distinction that matters is not empty-versus-absent but
+ * settled-versus-not, and settling happens exactly once per owner.
+ */
+async function settleWorkspacePin(session: GrantsSession): Promise<WorkspacePins> {
+  // Settled by an EARLIER SESSION OBJECT for this same owner — an extension reload. Adopting rather than
+  // re-deriving is the point: a root may mint, but only once, and only from the registry as it stood before
+  // any child had a chance to rewrite it.
+  if (session.reloadLifecycle.workspacePin) return session.reloadLifecycle.workspacePin;
+
+  const raw = session.reloadLifecycle.root[ENV_WORKSPACE_PIN];
+  const inherited = parseWorkspacePin(raw);
+  // Inherited, so it is authority and is kept exactly as it arrived — including an empty one, which says
+  // "your parent established a pin and gave you none of it".
+  if ("pins" in inherited) return inherited.pins;
+
+  // **A DESCENDANT NEVER MINTS.** Review reproduced the escalation end to end across a real process boundary:
+  // `workspacePinEnv` OMITS the variable when a parent has no pin of its own — which happens whenever that
+  // parent's registry was unreadable at its start, a state any child with `tool:write` can arrange — and the
+  // child then read the absence as "I am a root", minted from the registry it had just rewritten, and routed
+  // to the prod worktree holding only `workspace:staging`. Depth already rides in the environment and already
+  // attenuates downward, so it is enough on its own.
+  //
+  // A MALFORMED value refuses for the same reason even at the root. The module header says missing, empty,
+  // malformed and mismatched all refuse; that was true of the routing check and false here, where a refusal
+  // fell through to minting. A tamperer who can corrupt one byte must not thereby earn a promotion.
+  if (session.depth > 0 || raw !== undefined) return new Map();
+
+  const registryPath = process.env[ENV_WORKSPACE_REGISTRY];
+  if (!registryPath) return new Map();
+  try {
+    const registry = await loadWorkspaceRegistry(registryPath);
+    return await establishWorkspacePin(registry, realpath, (id, reason) =>
+      session.workspaceSkips.push(`${id} — ${reason}`),
+    );
+  } catch {
+    // An unreadable registry is already reported by the catalog and at session start. It does NOT follow that
+    // nothing is blocked — an earlier draft of this comment claimed that and review measured it false, because
+    // a grant supplied through `PI_DADDY_GRANT` never passes the catalog and `workspace:` is exempt from the
+    // unknown check anyway. A session can genuinely hold `workspace:w1` and be refused for want of a pin.
+    // Returning an empty map SETTLES it, so a later reload cannot mint over a registry that has since changed.
+    return new Map();
+  }
+}
+
 export async function loadProjectDefinitions(session: GrantsSession, cwd: string): Promise<void> {
+  await establishRootPin(session);
   const skips: string[] = [];
   session.definitions = await loadDefinitions(cwd, (_path, reason) => skips.push(reason));
   session.definitionSkips = skips;
@@ -331,6 +432,9 @@ export function createGrantsSession(
     maxDepth,
     malformedBounds: bounds.malformed,
     definitionSkips: [],
+    workspacePin: undefined,
+    pinSettled: false,
+    workspaceSkips: [],
     // ADR-0012: `bash` is gated by DEFAULT — but only in a governed session. An ungoverned one
     // (no PI_DADDY_GRANT) still blocks nothing, so "governance is opt-in" holds exactly where it always
     // did. Inside a session the operator already chose to govern, handing a child `bash` hands it an
@@ -388,6 +492,10 @@ export function createGrantsSession(
       extensionPath: session.extensionPath,
       observerExtensionPath: session.observerExtensionPath,
       childEnv: activityChildEnv(session.activity),
+      // ADR-0042: the pin this session holds, handed to the kernel so a delegated child inherits a narrowed
+      // one through the same builder `publishChildEnv` uses. Read here rather than in the kernel so there is
+      // one place that knows the environment is where a session's own pin lives.
+      ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
       // ADR-0078: composition reads, the kernel decides. Called only for a mode that survived the gate.
       // `options` is forwarded, and its absence is why the second decision point was dead in production: a
       // one-parameter arrow is assignable to a two-parameter type, so the ids reached here and were discarded while
@@ -440,6 +548,9 @@ export function createGrantsSession(
         gated: session.gated,
         ledgerPath: session.ledgerPath,
         approved: republishable(session),
+        // ADR-0042. The pin this session holds, which `childEnv` narrows to what the child's grant names. A
+        // session with no pin passes none, and its children can route nowhere — the fail-closed direction.
+        ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
         // G7 / B-I8: an ungoverned session publishes nothing, so "governance is opt-in" holds for
         // descendants too. Previously it exported its own observed tool surface as their grant.
         governed: session.governed,

package/extensions/workspace-runtime.ts

@@ -1,4 +1,5 @@
 import type { CorrelationMetadata } from "../src/kernel/correlation.ts";
+import type { WorkspacePins } from "../src/kernel/workspace-pin.ts";
 import type { Capability } from "../src/kernel/resolve.ts";
 import { appendLedgerEvent, buildWorkspaceLeaseEvent } from "../src/governance/ledger.ts";
 import { GovernanceRefusal, refusal, type StructuredRefusal } from "../src/kernel/refusals.ts";
@@ -72,6 +73,8 @@ export async function prepareDelegationWorkspace(input: {
   parentExecutionId: string | null;
   signal?: AbortSignal;
   ledgerPath?: string;
+  /** The CALLING session's own destination pin (ADR-0042); the environment holds its child's, not its own. */
+  workspacePin?: WorkspacePins;
 }): Promise<PreparedWorkspace> {
   if (input.correlation?.workspace_id && input.correlation.workspace_id !== input.spec.workspace_id) {
     throw new GovernanceRefusal(
@@ -90,7 +93,19 @@ export async function prepareDelegationWorkspace(input: {
       }),
     );
   }
-  const workspace = await resolveWorkspace(await loadWorkspaceRegistry(registryPath), input.spec.workspace_id);
+  // ADR-0042. The pin comes from the caller's session, NOT from `process.env`: `publishChildEnv` writes the
+  // child's narrowed pin into the environment, so reading it back here would check this session's routing
+  // against its child's authority. `ownGrant` has always lived in memory for the same reason.
+  const workspace = await resolveWorkspace(
+    await loadWorkspaceRegistry(registryPath),
+    input.spec.workspace_id,
+    // **No environment fallback.** Review called the old `?? parseWorkspacePin(process.env[...])` a live read
+    // of a variable the session no longer owns — `publishChildEnv` writes its CHILD's pin there. No state
+    // could be constructed where it read a usable value, but "currently unreachable" is a weaker property
+    // than "cannot happen", and the whole rule here is that a session's own pin lives in memory. A caller
+    // with no pin routes nowhere, which is what a caller with no pin should do.
+    input.workspacePin ? { pins: input.workspacePin } : { pins: new Map() },
+  );
   let lease: WorkspaceLease | undefined;
   try {
     lease = await acquireWorkspaceLease({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/index.ts

@@ -178,3 +178,16 @@ export * from "./products/dashboard-handshake.ts";
 export * from "./products/dashboard-herdr.ts";
 export * from "./products/activity-timeline.ts";
 export { runDashboard, dashboardFrame, DASHBOARD_PROTOCOL_VERSION } from "./products/dashboard-cli.ts";
+
+// ADR-0042. Exported because `resolveWorkspace` gained a destination-pin precondition in 0.38.0, and without
+// these a public consumer has no supported way to satisfy it — the parameter defaults to reading an
+// environment variable whose name and format were internal.
+export {
+  destinationDigest,
+  establishWorkspacePin,
+  formatWorkspacePin,
+  parseWorkspacePin,
+  ENV_WORKSPACE_PIN,
+  type WorkspacePins,
+  type ParsedPin,
+} from "./kernel/workspace-pin.ts";