pi-daddy 0.38.0 → 0.39.0

package/CHANGELOG.md

@@ -12,6 +12,40 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.39.0 — the registry's id set is the operator's too
+
+0.38.0 bound what a workspace id MEANS. It said nothing about which ids exist, and the registry is an ordinary
+file whose path a governed child inherits.
+
+**Measured, and worse than the gap register claimed.** That entry said a child could add an id but that `init`
+scaffolding ids commented out kept it unusable. With a `workspace:*` root, no operator action is needed at all:
+a child holding `tool:write` appends an entry, the pin stops it resolving in that session and stops nothing
+afterwards, and the NEXT root session mints a pin from the tampered registry while the wildcard admits any id.
+End to end — the catalog listed it, the pin covered it, and it routed into the child's own directory.
+
+**The accepted id set now lives beside the grant store**, in pi's agent directory. An id nobody accepted is not
+pinned, and therefore not routable.
+
+**What that does not buy, because the first draft of these notes claimed it did.** "Outside the workspace, where
+a governed child cannot reach it" is false. A security review reproduced it end to end with pi's own `write`
+tool from a real depth-1 child holding `tool:write` and no workspace capability: `write` takes an absolute path
+and performs no confinement, the agent directory is inherited, and every path under it is deterministic. The
+same technique widened the operator's STORED GRANT from `tool:read` to `tool:bash`, so the precedent this cited
+does not hold either. What this release actually buys is the narrower closure it was built for — an attacker
+who rewrites only the registry — and a raised cost for the wider one. The risk register now carries the class:
+`tool:write` is much closer to `tool:bash` than this package has been treating it. `/grants
+workspaces` accepts the registry's current ids. A malformed acceptance record accepts NOTHING rather than
+falling back to the registry, so corrupting one byte is not a bypass.
+
+**Trust on first use, and said out loud.** A machine that has accepted nothing accepts what the registry holds
+the first time and writes it down, because refusing everything on upgrade would enforce a decision the operator
+already made by writing that file. What matters is that additions afterwards are visible, and session start
+announces the first acceptance rather than installing itself quietly.
+
+**What this does not cover.** Acceptance is per registry, so an id accepted once is accepted for every project
+sharing that registry. And it takes effect for the NEXT session: re-settling a live session's pin is exactly
+the re-mint that ADR-0042 spent four review rounds closing.
+
 ## 0.38.0 — a rewritten registry can no longer change what an authorised id means (ADR-0042)
 
 **The escalation this closes, measured in `g37-registry-tamper`.** `workspace:<id>` attenuated the NAME, not the

package/dist/governance/workspace-acceptance.d.ts

@@ -0,0 +1,19 @@
+export interface AcceptedWorkspaces {
+    /** Ids the operator has accepted for this registry. */
+    accepted: string[];
+    /** True when this call created the record — trust on first use, which the caller must report. */
+    firstUse: boolean;
+    /** Registry ids that are NOT accepted, so they can be named and refused. */
+    unaccepted: string[];
+}
+/**
+ * Compare a registry's ids against what has been accepted, creating the record on first use.
+ *
+ * **A malformed record accepts nothing** rather than falling back to the registry. It is the same direction
+ * `grant-store.ts` takes for a malformed grant, and for the same reason: the file is the record of a decision,
+ * so an unreadable one means the decision is unknown, not that anything goes.
+ */
+export declare function reconcileAcceptedWorkspaces(registryPath: string, registryIds: readonly string[], env?: NodeJS.ProcessEnv): Promise<AcceptedWorkspaces>;
+/** Accept the registry's current ids, replacing what was accepted before. `/grants` drives this. */
+export declare function acceptWorkspaces(registryPath: string, registryIds: readonly string[], env?: NodeJS.ProcessEnv): Promise<string[]>;
+//# sourceMappingURL=workspace-acceptance.d.ts.map

package/dist/governance/workspace-acceptance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-acceptance.d.ts","sourceRoot":"","sources":["../../src/governance/workspace-acceptance.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iGAAiG;IACjG,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAsBD;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAkB7B;AAED,oGAAoG;AACpG,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB"}

package/dist/governance/workspace-acceptance.js

@@ -0,0 +1,101 @@
+/**
+ * Which workspace ids the operator has accepted — the id SET, which the destination pin does not cover.
+ *
+ * **The escalation this closes, measured 2026-09-22.** ADR-0042 bound what an id MEANS; it says nothing about
+ * which ids exist. The registry is an ordinary file and a governed child holding `tool:write` inherits its
+ * path, so a child can append an entry of its own. The pin stops that id resolving in the session that added
+ * it — there is no pin entry for it — and stops nothing afterwards: the NEXT root session mints a pin from the
+ * tampered registry, the catalog lists the new id, and `workspace:*` admits any id at all. Measured end to end:
+ * `catalog ['workspace:evil','workspace:good']`, `pinned ['good','evil']`, routed into the child's own
+ * directory, with no operator action anywhere.
+ *
+ * So the id set needs the same treatment the grant got: recorded outside the workspace, beside the grant store
+ * and the approvals, in pi's agent directory.
+ *
+ * **What that does NOT buy, measured rather than assumed.** The first draft of this comment said "where a
+ * governed child cannot reach it". That is false, and a security review reproduced it end to end using pi's
+ * OWN `write` tool from a real depth-1 child holding `tool:write` and no workspace capability at all: the
+ * child inherited `PI_CODING_AGENT_DIR` (in neither `GRANT_ENV_KEYS` nor `GOVERNANCE_ENV_KEYS`), computed
+ * this file's path from the public, deterministic naming scheme, wrote a well-formed record accepting its own
+ * id, and the next root session pinned it and routed there with nothing reported.
+ *
+ * **Location is not a boundary for `tool:write`.** pi's `write` resolves a path against the cwd and writes it,
+ * with no check that the result is under the cwd — its own schema says "relative or absolute". The same review
+ * used it to widen the operator's STORED GRANT from `tool:read` to `tool:bash`, so `grant-store.ts`'s
+ * reasoning, which this module cited as precedent, does not hold either. That is pre-existing and is recorded
+ * in the risk register as a class rather than as two instances.
+ *
+ * **What this mechanism does buy, stated exactly.** It closes the escalation against an attacker who rewrites
+ * the REGISTRY only — which is the measured attack it was built for — and it raises the cost of the wider one
+ * from one write to a known path to two writes to two known paths. It is not a containment boundary and must
+ * not be read as one. A malformed record written here is a denial of service on all routing, which fails
+ * closed and is the right direction, but is worth knowing about.
+ *
+ * **Trust on first use, said out loud.** A machine that has never accepted anything accepts what the registry
+ * holds the first time and writes it down. The alternative — refuse everything until the operator accepts —
+ * would break every existing setup on upgrade to enforce a decision the operator has effectively already made
+ * by writing the file. What matters is that ADDITIONS afterwards are visible, and they are. The first
+ * acceptance is announced rather than silent, because a security control that installs itself quietly is one
+ * nobody knows they have.
+ *
+ * Keyed by registry path, not by project: accepting an id is a statement about the operator's registry.
+ */
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { acceptedWorkspacesPath } from "../kernel/project-paths.js";
+function parse(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    if (parsed.version !== 1 || typeof parsed.registry !== "string")
+        return null;
+    if (!Array.isArray(parsed.accepted) || !parsed.accepted.every((id) => typeof id === "string" && id.length > 0))
+        return null;
+    return { version: 1, registry: parsed.registry, accepted: parsed.accepted };
+}
+/**
+ * Compare a registry's ids against what has been accepted, creating the record on first use.
+ *
+ * **A malformed record accepts nothing** rather than falling back to the registry. It is the same direction
+ * `grant-store.ts` takes for a malformed grant, and for the same reason: the file is the record of a decision,
+ * so an unreadable one means the decision is unknown, not that anything goes.
+ */
+export async function reconcileAcceptedWorkspaces(registryPath, registryIds, env = process.env) {
+    const path = acceptedWorkspacesPath(registryPath, env);
+    const text = await readFile(path, "utf8").catch(() => undefined);
+    if (text === undefined) {
+        const accepted = [...registryIds].sort();
+        await write(path, { version: 1, registry: registryPath, accepted });
+        return { accepted, firstUse: true, unaccepted: [] };
+    }
+    const stored = parse(text);
+    // Malformed: accept nothing, and the caller says so. Not "accept everything", which would make corrupting
+    // one byte of this file the way to bypass it.
+    const accepted = stored ? stored.accepted : [];
+    const allowed = new Set(accepted);
+    return {
+        accepted,
+        firstUse: false,
+        unaccepted: [...registryIds].filter((id) => !allowed.has(id)).sort(),
+    };
+}
+/** Accept the registry's current ids, replacing what was accepted before. `/grants` drives this. */
+export async function acceptWorkspaces(registryPath, registryIds, env = process.env) {
+    const accepted = [...new Set(registryIds)].sort();
+    await write(acceptedWorkspacesPath(registryPath, env), { version: 1, registry: registryPath, accepted });
+    return accepted;
+}
+/** Atomic, for the reason every other store here is: a half-written record reads as a narrower decision. */
+async function write(path, body) {
+    await mkdir(dirname(path), { recursive: true });
+    const temp = join(dirname(path), `.${Math.random().toString(36).slice(2)}.tmp`);
+    await writeFile(temp, `${JSON.stringify(body, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    await rename(temp, path);
+}
+//# sourceMappingURL=workspace-acceptance.js.map

package/dist/governance/workspace-acceptance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-acceptance.js","sourceRoot":"","sources":["../../src/governance/workspace-acceptance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAiBpE,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5G,OAAO,IAAI,CAAC;IACd,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,WAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,0GAA0G;IAC1G,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAoB,EACpB,WAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,KAAK,CAAC,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,IAAsB;IACvD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/kernel/project-paths.d.ts

@@ -26,6 +26,8 @@ export declare const USER_DIRS: Readonly<{
     grants: "grants";
     approvals: "approvals";
     workspaceLeases: "workspace-leases";
+    /** ADR-0042 follow-up: which registry ids this operator has accepted. Keyed by REGISTRY, not by project. */
+    workspaces: "workspaces";
 }>;
 /**
  * `<slug>-<16 hex>.json`: the basename keeps the directory legible, the hash makes it unambiguous, since two
@@ -34,6 +36,14 @@ export declare const USER_DIRS: Readonly<{
 export declare function projectFileName(cwd: string): string;
 export declare const grantStorePath: (cwd: string, env?: NodeJS.ProcessEnv) => string;
 export declare const approvalsPath: (cwd: string, env?: NodeJS.ProcessEnv) => string;
+/**
+ * Where the accepted id set for one registry lives.
+ *
+ * Keyed by the registry path rather than by `cwd`, because accepting an id is a statement about the
+ * OPERATOR'S registry and not about a project: two checkouts sharing a registry share the decision, and
+ * re-accepting per project would be a prompt with no new information in it.
+ */
+export declare const acceptedWorkspacesPath: (registryPath: string, env?: NodeJS.ProcessEnv) => string;
 export declare const workspaceLeasesDir: (env?: NodeJS.ProcessEnv) => string;
 /** Where the same stores lived before ADR-0076 PR 3c. Reported when found, never read (ADR-0020 precedent). */
 export declare const legacyUserGrantStorePath: (cwd: string, env?: NodeJS.ProcessEnv) => string;

package/dist/kernel/project-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-paths.d.ts","sourceRoot":"","sources":["../../src/kernel/project-paths.ts"],"names":[],"mappings":"AAoBA,oEAAoE;AACpE,eAAO,MAAM,cAAc,QAAQ,CAAC;AACpC,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,eAAO,MAAM,aAAa;;;;;EAKxB,CAAC;AAEH,eAAO,MAAM,mBAAmB,GAAI,KAAK,MAAM,WAAuD,CAAC;AACvG,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAAwD,CAAC;AACzG,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,WAAqD,CAAC;AACnG,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAA+D,CAAC;AAEhH,iHAAiH;AACjH,eAAO,MAAM,yBAAyB,kJAIrC,CAAC;AAEF,wHAAwH;AACxH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,6DAA6D;AAC7D,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGrE;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEzE;AAED,eAAO,MAAM,SAAS;;;;EAIpB,CAAC;AAEH;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAED,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACF,CAAC;AAClE,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACE,CAAC;AACrE,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,CAAC,UAAU,WAAuD,CAAC;AAElH,+GAA+G;AAC/G,eAAO,MAAM,wBAAwB,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACxB,CAAC;AACtD,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACb,CAAC;AAChE,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,WAA4C,CAAC;AAChG,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,WAA0C,CAAC"}
+{"version":3,"file":"project-paths.d.ts","sourceRoot":"","sources":["../../src/kernel/project-paths.ts"],"names":[],"mappings":"AAoBA,oEAAoE;AACpE,eAAO,MAAM,cAAc,QAAQ,CAAC;AACpC,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,eAAO,MAAM,aAAa;;;;;EAKxB,CAAC;AAEH,eAAO,MAAM,mBAAmB,GAAI,KAAK,MAAM,WAAuD,CAAC;AACvG,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAAwD,CAAC;AACzG,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,WAAqD,CAAC;AACnG,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAA+D,CAAC;AAEhH,iHAAiH;AACjH,eAAO,MAAM,yBAAyB,kJAIrC,CAAC;AAEF,wHAAwH;AACxH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,6DAA6D;AAC7D,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGrE;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEzE;AAED,eAAO,MAAM,SAAS;;;;IAIpB,4GAA4G;;EAE5G,CAAC;AAEH;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAED,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACF,CAAC;AAClE,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACE,CAAC;AACrE;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,cAAc,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACN,CAAC;AAE/E,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,CAAC,UAAU,WAAuD,CAAC;AAElH,+GAA+G;AAC/G,eAAO,MAAM,wBAAwB,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACxB,CAAC;AACtD,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACb,CAAC;AAChE,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,WAA4C,CAAC;AAChG,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,WAA0C,CAAC"}

package/dist/kernel/project-paths.js

@@ -60,6 +60,8 @@ export const USER_DIRS = Object.freeze({
     grants: "grants",
     approvals: "approvals",
     workspaceLeases: "workspace-leases",
+    /** ADR-0042 follow-up: which registry ids this operator has accepted. Keyed by REGISTRY, not by project. */
+    workspaces: "workspaces",
 });
 /**
  * `<slug>-<16 hex>.json`: the basename keeps the directory legible, the hash makes it unambiguous, since two
@@ -72,6 +74,14 @@ export function projectFileName(cwd) {
 }
 export const grantStorePath = (cwd, env) => join(userStateDir(env), USER_DIRS.grants, projectFileName(cwd));
 export const approvalsPath = (cwd, env) => join(userStateDir(env), USER_DIRS.approvals, projectFileName(cwd));
+/**
+ * Where the accepted id set for one registry lives.
+ *
+ * Keyed by the registry path rather than by `cwd`, because accepting an id is a statement about the
+ * OPERATOR'S registry and not about a project: two checkouts sharing a registry share the decision, and
+ * re-accepting per project would be a prompt with no new information in it.
+ */
+export const acceptedWorkspacesPath = (registryPath, env) => join(userStateDir(env), USER_DIRS.workspaces, projectFileName(registryPath));
 export const workspaceLeasesDir = (env) => join(userStateDir(env), USER_DIRS.workspaceLeases);
 /** Where the same stores lived before ADR-0076 PR 3c. Reported when found, never read (ADR-0020 precedent). */
 export const legacyUserGrantStorePath = (cwd, env) => join(agentDir(env), "grants", projectFileName(cwd));

package/dist/kernel/project-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-paths.js","sourceRoot":"","sources":["../../src/kernel/project-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,cAAc;IACtB,gBAAgB,EAAE,gBAAgB;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;AACvG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;AACzG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;AAEhH,iHAAiH;AACjH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;CAIxC,CAAC;AAEF,wHAAwH;AACxH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,kBAAkB;CACpC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CACrE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CACpE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;AAElH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,kBAAkB,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC"}
+{"version":3,"file":"project-paths.js","sourceRoot":"","sources":["../../src/kernel/project-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,cAAc;IACtB,gBAAgB,EAAE,gBAAgB;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;AACvG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;AACzG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;AAEhH,iHAAiH;AACjH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;CAIxC,CAAC;AAEF,wHAAwH;AACxH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,kBAAkB;IACnC,4GAA4G;IAC5G,UAAU,EAAE,YAAY;CACzB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CACrE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CACpE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAoB,EAAE,GAAuB,EAAE,EAAE,CACtF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;AAElH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,kBAAkB,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC"}

package/extensions/grants-command.ts

@@ -36,6 +36,10 @@ export interface GrantsCommandContext {
   advisor: { decider: string; refusal?: string };
   /** ADR-0042: which ids this session pinned, so a routing refusal is discoverable before it happens. */
   workspacePin?: ReadonlyMap<string, string>;
+  /** Registry ids this machine has never accepted: present, not routable, and worth naming (rule 8). */
+  unacceptedWorkspaces?: readonly string[];
+  /** Accept the registry's current ids. Injected, so this diagnostic does not become a governance path. */
+  acceptWorkspaces?: () => Promise<string[]>;
   observed: boolean;
   depth: number;
   maxDepth: number;
@@ -79,7 +83,7 @@ export interface GrantsCommandContext {
 const PREVIEW_LIMIT = 12;
 
 /** The verbs `/grants` answers to. Anything else is refused rather than silently treated as no verb. */
-const KNOWN_SUBCOMMANDS: readonly string[] = ["init", "dashboard", "ledger", "approvals", "revoke"];
+const KNOWN_SUBCOMMANDS: readonly string[] = ["init", "dashboard", "ledger", "approvals", "revoke", "workspaces"];
 
 export const grantsCommand = {
   description:
@@ -95,6 +99,7 @@ export const grantsCommand = {
       executor,
       advisor,
       workspacePin,
+      unacceptedWorkspaces,
       observed,
       depth,
       maxDepth,
@@ -122,6 +127,23 @@ export const grantsCommand = {
     )
       return;
 
+    if (sub === "workspaces") {
+      // The one verb that WRITES, and it takes its ability to do so from the caller — the same shape
+      // `/grants init` uses, so this screen cannot become a governance path by accident.
+      const accept = ctx.grants.acceptWorkspaces as (() => Promise<string[]>) | undefined;
+      if (!accept) {
+        ctx.ui.notify("grants: no workspace registry is configured, so there is nothing to accept.", "warning");
+        return;
+      }
+      const accepted = await accept();
+      ctx.ui.notify(
+        `grants: accepted ${accepted.length} workspace id(s) — ${accepted.join(", ") || "(none)"}. ` +
+          `Ids added to the registry after this are refused until accepted again.`,
+        "info",
+      );
+      return;
+    }
+
     if (sub === "ledger") {
       // The detector, made reachable. `verifyLedger` exists because nothing in this package had ever read
       // a ledger back, so a torn line was indistinguishable from a spawn that never happened — and a
@@ -383,10 +405,24 @@ export const grantsCommand = {
         `${catalog.byKind("workspace").length} workspace`,
       ...(catalog.byKind("workspace").length > 0
         ? [
-            `  routable   ${catalog.byKind("workspace").join(", ")} — held ones only are usable (ADR-0035)`,
+            // **Marked here rather than left to a join.** The catalog loads the UNNARROWED registry, so it
+            // lists an id nobody accepted; session start names it separately, and review pointed out that a
+            // reader has to put the two together. An id that cannot be routed to should not read as routable.
+            `  routable   ${catalog
+              .byKind("workspace")
+              .map((id) =>
+                (unacceptedWorkspaces ?? []).includes(id.slice("workspace:".length)) ? `${id} (NOT ACCEPTED)` : id,
+              )
+              .join(", ")} — held ones only are usable (ADR-0035)`,
             // ADR-0042 made a destination pin a PRECONDITION for routing, and it had no operator surface at
             // all: not here, not at session start, not in the README. An operator refused for want of a pin
             // could not discover that the mechanism existed, let alone which ids it covered.
+            ...(unacceptedWorkspaces && unacceptedWorkspaces.length > 0
+              ? [
+                  `  unaccepted ${unacceptedWorkspaces.join(", ")} — in the registry, never accepted here, ` +
+                    `so not routable. /grants workspaces to review and accept.`,
+                ]
+              : []),
             `  pinned     ${
               workspacePin === undefined
                 ? "(none — no workspace is routable this session)"

package/extensions/grants.ts

@@ -36,6 +36,8 @@ import { grantsCommand } from "./grants-command.ts";
 import { runInit } from "./init-command.ts";
 import { planWithApprovals } from "./run-delegation.ts";
 import { createGrantsSession, loadProjectDefinitions, type GrantsSession } from "./session.ts";
+import { acceptWorkspaces } from "../src/governance/workspace-acceptance.ts";
+import { loadWorkspaceRegistry } from "../src/kernel/workspace.ts";
 import { bindReloadLifecycle } from "./reload-environment.ts";
 import { reconcileActiveDelegationTools } from "./delegation-activation.ts";
 import { resolveExecutor } from "./executor-session.ts";
@@ -379,6 +381,21 @@ export default function (pi: ExtensionAPI) {
             ...(session.advisorSession.settings.refusal ? { refusal: session.advisorSession.settings.refusal } : {}),
           },
           ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
+          ...(session.workspaceAcceptance ? { unacceptedWorkspaces: session.workspaceAcceptance.unaccepted } : {}),
+          // Injected rather than imported, so `/grants` takes its one writing ability visibly from here.
+          ...(process.env[ENV_WORKSPACE_REGISTRY]
+            ? {
+                acceptWorkspaces: async () => {
+                  const registryPath = process.env[ENV_WORKSPACE_REGISTRY]!;
+                  const registry = await loadWorkspaceRegistry(registryPath);
+                  const accepted = await acceptWorkspaces(registryPath, Object.keys(registry.workspaces));
+                  // The acceptance takes effect for the NEXT session, not this one: this session's pin is
+                  // settled and re-settling it here would be the re-mint that ADR-0042's own review spent
+                  // four rounds closing. Said plainly by the caller rather than implied.
+                  return accepted;
+                },
+              }
+            : {}),
           catalog: session.catalog,
           definitions: session.definitions,
           sessionApprovals: session.sessionApprovals,

package/extensions/session-report.ts

@@ -69,6 +69,15 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
     ctx.ui.notify(`grants: a definition was not loaded — ${reason}`, "warning");
   // A registered workspace that could not be pinned is not routable this session, and the routing refusal an
   // operator would otherwise meet names neither the directory nor the reason.
+  // Trust on first use, announced rather than silent: a control that installs itself quietly is one nobody
+  // knows they have, and the whole value of this record is that ADDITIONS are visible afterwards.
+  if (session.workspaceAcceptance?.firstUse && session.workspaceAcceptance.accepted.length > 0)
+    ctx.ui.notify(
+      `grants: accepted ${session.workspaceAcceptance.accepted.length} workspace id(s) from this registry for ` +
+        `the first time (${session.workspaceAcceptance.accepted.join(", ")}). Ids added to the registry from ` +
+        `now on are refused until you accept them with /grants workspaces.`,
+      "info",
+    );
   for (const skipped of session.workspaceSkips)
     ctx.ui.notify(
       `grants: workspace ${skipped} — it is registered but not routable this session (ADR-0042 destination pin)`,

package/extensions/session.ts

@@ -65,6 +65,7 @@ import {
   ENV_WORKSPACE_PIN,
 } from "../src/kernel/workspace-pin.ts";
 import { loadWorkspaceRegistry } from "../src/kernel/workspace.ts";
+import { reconcileAcceptedWorkspaces } from "../src/governance/workspace-acceptance.ts";
 
 /**
  * Run governed children in herdr panes instead of captured child processes.
@@ -219,6 +220,8 @@ export interface GrantsSession extends NativeSessionHost {
   pinSettled: boolean;
   /** Registered workspaces this session could not pin, and why — reported at session start (rule 8). */
   workspaceSkips: string[];
+  /** Which registry ids this machine has accepted, and which it has not. Reported, and drives `/grants`. */
+  workspaceAcceptance?: { accepted: string[]; firstUse: boolean; unaccepted: string[] };
   catalog: Catalog;
   /**
    * The in-flight catalog build, so `delegate` can wait for it instead of racing it.
@@ -351,7 +354,19 @@ async function settleWorkspacePin(session: GrantsSession): Promise<WorkspacePins
   if (!registryPath) return new Map();
   try {
     const registry = await loadWorkspaceRegistry(registryPath);
-    return await establishWorkspacePin(registry, realpath, (id, reason) =>
+    // **The id SET, which the destination pin does not cover.** ADR-0042 bound what an id means; a child
+    // holding `tool:write` inherits the registry path and can append an id of its own, and the NEXT root
+    // session mints a pin for it. Measured: a child-created id reached the catalog, the pin and a real route
+    // with no operator action. So an id nobody accepted is not pinned, and therefore not routable.
+    const acceptance = await reconcileAcceptedWorkspaces(registryPath, Object.keys(registry.workspaces));
+    session.workspaceAcceptance = acceptance;
+    for (const id of acceptance.unaccepted)
+      session.workspaceSkips.push(`${id} — it is in the registry but this machine has never accepted it`);
+    const accepted = new Set(acceptance.accepted);
+    const narrowed = {
+      workspaces: Object.fromEntries(Object.entries(registry.workspaces).filter(([id]) => accepted.has(id))),
+    };
+    return await establishWorkspacePin(narrowed, realpath, (id, reason) =>
       session.workspaceSkips.push(`${id} — ${reason}`),
     );
   } catch {
@@ -435,6 +450,7 @@ export function createGrantsSession(
     workspacePin: undefined,
     pinSettled: false,
     workspaceSkips: [],
+    workspaceAcceptance: undefined,
     // ADR-0012: `bash` is gated by DEFAULT — but only in a governed session. An ungoverned one
     // (no PI_DADDY_GRANT) still blocks nothing, so "governance is opt-in" holds exactly where it always
     // did. Inside a session the operator already chose to govern, handing a child `bash` hands it an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/governance/workspace-acceptance.ts

@@ -0,0 +1,124 @@
+/**
+ * Which workspace ids the operator has accepted — the id SET, which the destination pin does not cover.
+ *
+ * **The escalation this closes, measured 2026-09-22.** ADR-0042 bound what an id MEANS; it says nothing about
+ * which ids exist. The registry is an ordinary file and a governed child holding `tool:write` inherits its
+ * path, so a child can append an entry of its own. The pin stops that id resolving in the session that added
+ * it — there is no pin entry for it — and stops nothing afterwards: the NEXT root session mints a pin from the
+ * tampered registry, the catalog lists the new id, and `workspace:*` admits any id at all. Measured end to end:
+ * `catalog ['workspace:evil','workspace:good']`, `pinned ['good','evil']`, routed into the child's own
+ * directory, with no operator action anywhere.
+ *
+ * So the id set needs the same treatment the grant got: recorded outside the workspace, beside the grant store
+ * and the approvals, in pi's agent directory.
+ *
+ * **What that does NOT buy, measured rather than assumed.** The first draft of this comment said "where a
+ * governed child cannot reach it". That is false, and a security review reproduced it end to end using pi's
+ * OWN `write` tool from a real depth-1 child holding `tool:write` and no workspace capability at all: the
+ * child inherited `PI_CODING_AGENT_DIR` (in neither `GRANT_ENV_KEYS` nor `GOVERNANCE_ENV_KEYS`), computed
+ * this file's path from the public, deterministic naming scheme, wrote a well-formed record accepting its own
+ * id, and the next root session pinned it and routed there with nothing reported.
+ *
+ * **Location is not a boundary for `tool:write`.** pi's `write` resolves a path against the cwd and writes it,
+ * with no check that the result is under the cwd — its own schema says "relative or absolute". The same review
+ * used it to widen the operator's STORED GRANT from `tool:read` to `tool:bash`, so `grant-store.ts`'s
+ * reasoning, which this module cited as precedent, does not hold either. That is pre-existing and is recorded
+ * in the risk register as a class rather than as two instances.
+ *
+ * **What this mechanism does buy, stated exactly.** It closes the escalation against an attacker who rewrites
+ * the REGISTRY only — which is the measured attack it was built for — and it raises the cost of the wider one
+ * from one write to a known path to two writes to two known paths. It is not a containment boundary and must
+ * not be read as one. A malformed record written here is a denial of service on all routing, which fails
+ * closed and is the right direction, but is worth knowing about.
+ *
+ * **Trust on first use, said out loud.** A machine that has never accepted anything accepts what the registry
+ * holds the first time and writes it down. The alternative — refuse everything until the operator accepts —
+ * would break every existing setup on upgrade to enforce a decision the operator has effectively already made
+ * by writing the file. What matters is that ADDITIONS afterwards are visible, and they are. The first
+ * acceptance is announced rather than silent, because a security control that installs itself quietly is one
+ * nobody knows they have.
+ *
+ * Keyed by registry path, not by project: accepting an id is a statement about the operator's registry.
+ */
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { acceptedWorkspacesPath } from "../kernel/project-paths.ts";
+
+export interface AcceptedWorkspaces {
+  /** Ids the operator has accepted for this registry. */
+  accepted: string[];
+  /** True when this call created the record — trust on first use, which the caller must report. */
+  firstUse: boolean;
+  /** Registry ids that are NOT accepted, so they can be named and refused. */
+  unaccepted: string[];
+}
+
+interface StoredAcceptance {
+  version: 1;
+  registry: string;
+  accepted: string[];
+}
+
+function parse(text: string): StoredAcceptance | null {
+  let parsed: Partial<StoredAcceptance>;
+  try {
+    parsed = JSON.parse(text) as Partial<StoredAcceptance>;
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (parsed.version !== 1 || typeof parsed.registry !== "string") return null;
+  if (!Array.isArray(parsed.accepted) || !parsed.accepted.every((id) => typeof id === "string" && id.length > 0))
+    return null;
+  return { version: 1, registry: parsed.registry, accepted: parsed.accepted };
+}
+
+/**
+ * Compare a registry's ids against what has been accepted, creating the record on first use.
+ *
+ * **A malformed record accepts nothing** rather than falling back to the registry. It is the same direction
+ * `grant-store.ts` takes for a malformed grant, and for the same reason: the file is the record of a decision,
+ * so an unreadable one means the decision is unknown, not that anything goes.
+ */
+export async function reconcileAcceptedWorkspaces(
+  registryPath: string,
+  registryIds: readonly string[],
+  env: NodeJS.ProcessEnv = process.env,
+): Promise<AcceptedWorkspaces> {
+  const path = acceptedWorkspacesPath(registryPath, env);
+  const text = await readFile(path, "utf8").catch(() => undefined);
+  if (text === undefined) {
+    const accepted = [...registryIds].sort();
+    await write(path, { version: 1, registry: registryPath, accepted });
+    return { accepted, firstUse: true, unaccepted: [] };
+  }
+  const stored = parse(text);
+  // Malformed: accept nothing, and the caller says so. Not "accept everything", which would make corrupting
+  // one byte of this file the way to bypass it.
+  const accepted = stored ? stored.accepted : [];
+  const allowed = new Set(accepted);
+  return {
+    accepted,
+    firstUse: false,
+    unaccepted: [...registryIds].filter((id) => !allowed.has(id)).sort(),
+  };
+}
+
+/** Accept the registry's current ids, replacing what was accepted before. `/grants` drives this. */
+export async function acceptWorkspaces(
+  registryPath: string,
+  registryIds: readonly string[],
+  env: NodeJS.ProcessEnv = process.env,
+): Promise<string[]> {
+  const accepted = [...new Set(registryIds)].sort();
+  await write(acceptedWorkspacesPath(registryPath, env), { version: 1, registry: registryPath, accepted });
+  return accepted;
+}
+
+/** Atomic, for the reason every other store here is: a half-written record reads as a narrower decision. */
+async function write(path: string, body: StoredAcceptance): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  const temp = join(dirname(path), `.${Math.random().toString(36).slice(2)}.tmp`);
+  await writeFile(temp, `${JSON.stringify(body, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+  await rename(temp, path);
+}

package/src/kernel/project-paths.ts

@@ -70,6 +70,8 @@ export const USER_DIRS = Object.freeze({
   grants: "grants",
   approvals: "approvals",
   workspaceLeases: "workspace-leases",
+  /** ADR-0042 follow-up: which registry ids this operator has accepted. Keyed by REGISTRY, not by project. */
+  workspaces: "workspaces",
 });
 
 /**
@@ -86,6 +88,16 @@ export const grantStorePath = (cwd: string, env?: NodeJS.ProcessEnv) =>
   join(userStateDir(env), USER_DIRS.grants, projectFileName(cwd));
 export const approvalsPath = (cwd: string, env?: NodeJS.ProcessEnv) =>
   join(userStateDir(env), USER_DIRS.approvals, projectFileName(cwd));
+/**
+ * Where the accepted id set for one registry lives.
+ *
+ * Keyed by the registry path rather than by `cwd`, because accepting an id is a statement about the
+ * OPERATOR'S registry and not about a project: two checkouts sharing a registry share the decision, and
+ * re-accepting per project would be a prompt with no new information in it.
+ */
+export const acceptedWorkspacesPath = (registryPath: string, env?: NodeJS.ProcessEnv) =>
+  join(userStateDir(env), USER_DIRS.workspaces, projectFileName(registryPath));
+
 export const workspaceLeasesDir = (env?: NodeJS.ProcessEnv) => join(userStateDir(env), USER_DIRS.workspaceLeases);
 
 /** Where the same stores lived before ADR-0076 PR 3c. Reported when found, never read (ADR-0020 precedent). */