pi-daddy 0.39.0 → 0.40.0

package/CHANGELOG.md

@@ -12,6 +12,38 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.40.0 — the file-writing tools are gated, and a held-back definition keeps its context modes
+
+**`tool:write`, `tool:edit` and `tool:edit-diff` join `tool:bash` and `context:fork` in `DEFAULT_GATED`**, by
+operator decision after 0.39.0's review measured why. A governed child holding `tool:write` used pi's own
+`write` to rewrite the operator's stored grant, widening it from `tool:read` to `tool:bash`, and to write the
+record that decides which workspaces are routable. `write` resolves a path against the cwd and writes it with no
+check that the result is under the cwd; its schema says "relative or absolute". So it reaches every
+operator-state file on the same account, which is where `bash` reaches, by a shorter route.
+
+`edit` and `edit-diff` are included because they share that unconfined resolution. Gating `write` alone would
+have been a control with a hole its author already knew about: `edit` needs the file to exist, which is no
+protection for a grant store that does.
+
+**What it costs, accepted deliberately.** Most useful delegations write something, so they now ask once until an
+approval is banked. R-25 is about exactly that fatigue. `PI_DADDY_GATED` remains the escape hatch, and an
+explicitly empty value gates nothing.
+
+**The unit suite barely noticed, which was the more useful finding.** Nearly every delegation test sets
+`PI_DADDY_GATED` explicitly, so adding three ids to the default failed exactly one assertion — the one that
+restates the list. Three integration tests against a real pi process caught the rest. A default nothing drives
+is a default nobody is testing, so there is now a test that plans a real delegation with the variable unset.
+
+**A definition held back for needing a withheld tool now contributes its `context:` modes to the generated
+grant.** Reported by the operator and measured: `init` built the live grant from authorised definitions alone,
+so one withheld for declaring `write` contributed nothing at all — including a `context:files` that nothing
+withholds. With `principal-pi-skills` that stayed invisible, because its two read-only definitions supply
+`context:summary` and summary subsumes files. Measured on that package: remove those two and the generated
+grant has no `context:` entry at all, while three definitions still declare one. The operator would uncomment
+`tool:write`, the definition would become spawnable, and its handoff would be refused by a capability that
+appeared neither in the grant nor in the withheld block beside it. Granting it runs nothing and changes nothing,
+which is `grant-env.ts`'s own rule; `context:fork` stays out because it is gated.
+
 ## 0.39.0 — the registry's id set is the operator's too
 
 0.38.0 bound what a workspace id MEANS. It said nothing about which ids exist, and the registry is an ordinary

package/dist/governance/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/governance/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAeH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAahE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEzE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,0GAA0G;IAC1G,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iFAAiF;IACjF,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,4FAA4F;IAC5F,oBAAoB,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,0GAA0G;IAC1G,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,uGAAuG;IACvG,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAE,MAAM,EAAgB,GAAG,MAAM,CASrG;AAUD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,YAAY,EAAE,EACxB,GAAG,EAAE,MAAM;AACX;;;;;;;;GAQG;AACH,sBAAsB,GAAE,SAAS,MAAM,EAAO,GAC7C,QAAQ,CAiJV;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC3C;AAiDD;;;;;;;;;;;;GAYG;AACH;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBxF;AAED,uGAAuG;AACvG,eAAO,MAAM,yBAAyB,UAGrC,CAAC;AAEF,wBAAsB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAiCvG"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/governance/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAeH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAahE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEzE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,0GAA0G;IAC1G,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iFAAiF;IACjF,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,4FAA4F;IAC5F,oBAAoB,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,0GAA0G;IAC1G,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,uGAAuG;IACvG,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAE,MAAM,EAAgB,GAAG,MAAM,CASrG;AAUD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,YAAY,EAAE,EACxB,GAAG,EAAE,MAAM;AACX;;;;;;;;GAQG;AACH,sBAAsB,GAAE,SAAS,MAAM,EAAO,GAC7C,QAAQ,CAwKV;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC3C;AAiDD;;;;;;;;;;;;GAYG;AACH;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBxF;AAED,uGAAuG;AACvG,eAAO,MAAM,yBAAyB,UAGrC,CAAC;AAEF,wBAAsB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAiCvG"}

package/dist/governance/init.js

@@ -179,6 +179,31 @@ registeredWorkspaceIds = []) {
     // never granted: the same objection ADR-0028 rule 3 makes to authorising an undeclared skill.
     const crossReferences = [];
     const live = new Set([ALWAYS_LIVE]);
+    // **A skill held back for needing a withheld tool still contributes its `context:` modes.**
+    //
+    // Reported by the operator and measured: `live` was built from `authorised` alone, so a definition withheld
+    // for declaring `write` contributed nothing at all — including a `context:files` that is not withheld by
+    // anything. With `principal-pi-skills` that stayed invisible because the two read-only definitions supply
+    // `context:summary`, which subsumes `files`. Remove those two, or install a package whose only
+    // context-declaring definitions need a tool, and the generated grant has no `context:` entry at all. The
+    // operator then uncomments `tool:write`, the definition becomes spawnable, and its handoff is refused by a
+    // capability that never appeared in the file they were editing — or in the withheld block beside it.
+    //
+    // Granting it is safe in a way granting the tool is not, and this is grant-env's own rule rather than a new
+    // one: a capability that can change the machine or execute does not become live because a package asked for
+    // it, and everything else does. Holding `context:files` runs nothing and changes nothing; it permits handing
+    // context to a child that has declared it. `context:fork` is in `DEFAULT_GATED`, so `isLiveByDefault`
+    // already keeps it out, which is why this can be a namespace pass rather than a list.
+    //
+    // Only `needs-withheld`: an `undeclared` definition has no ceiling to read, and a `pattern` one had its
+    // declaration refused wholesale rather than narrowed.
+    for (const skill of skills) {
+        if (skill.withheld !== "needs-withheld")
+            continue;
+        for (const capability of skill.ceiling)
+            if (capability.startsWith("context:") && isLiveByDefault(capability))
+                live.add(capability);
+    }
     for (const skill of authorised) {
         live.add(agentCapability(skill.name));
         for (const capability of skill.ceiling) {

package/dist/governance/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/governance/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,eAAe,EACf,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EACL,cAAc,EACd,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,IAAY;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;AACrF,CAAC;AAwCD,MAAM,WAAW,GAAG;IAClB,uGAAuG;IACvG,oGAAoG;IACpG,uGAAuG;IACvG,iDAAiD;IACjD,uBAAuB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG;IAC3D,qEAAqE;CACtE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAE,EAAE,CAAC;IAC1C,wGAAwG;IACxG,qBAAqB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kEAAkE;IAC1G,oGAAoG;IACpG,mEAAmE;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAiB,EAAE,OAAiB,WAAW;IAC3F,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,wGAAwG;IACxG,uEAAuE;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,OAAO,OAAO,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,YAA0B;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;IACnD,OAAO,YAAY,CAAC,MAAM,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAwB,EACxB,GAAW;AACX;;;;;;;;GAQG;AACH,yBAA4C,EAAE;IAE9C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC;gBAC7E,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAEf,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,QAAQ,GAA0B,IAAI,CAAC;YAC3C,IAAI,IAAI,GAAG,WAAW,CAAC;YACvB,IAAI,OAAO,CAAC,UAAU;gBAAE,QAAQ,GAAG,YAAY,CAAC;iBAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,QAAQ,GAAG,SAAS,CAAC;gBACrB,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACrC,KAAK,CAAC,IAAI,CACR,YAAY,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD;oBAC3F,+FAA+F,CAClG,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE;gBAClC,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC;gBAC/F,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,EAAE,IAAI,CAAC;gBAC7D,OAAO,EAAE,OAAO,CAAC,YAAY;gBAC7B,QAAQ;gBACR,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wGAAwG;IACxG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAC3D,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,eAAe,CAAC,UAAU,CAAC;gBAAE,SAAS;YAC1C,+FAA+F;YAC/F,kGAAkG;YAClG,sGAAsG;YACtG,oGAAoG;YACpG,oGAAoG;YACpG,sGAAsG;YACtG,kGAAkG;YAClG,sEAAsE;YACtE,EAAE;YACF,mGAAmG;YACnG,iGAAiG;YACjG,kGAAkG;YAClG,+CAA+C;YAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,SAAS;YAClD,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED,2GAA2G;IAC3G,oGAAoG;IACpG,qGAAqG;IACrG,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,QAAQ,GAAG,gBAAgB,CAAC;IACxF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,qGAAqG;IACrG,uGAAuG;IACvG,uGAAuG;IACvG,8FAA8F;IAC9F,MAAM,eAAe,GAA+C,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvF,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACxC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAC3B,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,uEAAuE;QAC9F,YAAY,CAAC,CAAC,IAAI,sCAAsC,CAC3D,CACF,CAAC;IAEF,uGAAuG;IACvG,sFAAsF;IACtF,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAE7B,MAAM,QAAQ,GAAwD;QACpE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4DAA4D,GAAG,CAAC,CAAC,IAAI,GAAG,SAAS;QACpG,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC;KACtG,CAAC;IAEF,MAAM,cAAc,GAAoB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAC,CAAC;IAEJ,uGAAuG;IACvG,sGAAsG;IACtG,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,kBAAkB,GAAG;QACzB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,kBAAkB,CAAC,CAAC;KACxF,CAAC,IAAI,EAAE,CAAC;IAET,OAAO;QACL,MAAM;QACN,UAAU;QACV,KAAK;QACL,oBAAoB;QACpB,kBAAkB;QAClB,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;QAC9B,YAAY,EAAE,mBAAmB,CAAC,GAAG,CAAC;QACtC,aAAa,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACxC,eAAe,EAAE,qBAAqB,CAAC;YACrC,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,oBAAoB;YAC9B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7F,eAAe;YACf,QAAQ;YACR,kBAAkB;SACnB,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,OAAoB;IACpF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,iBAAiB,CACrB,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EACvC,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CACzE,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACvE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,OAAoB;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,kGAAkG;QAClG,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,YAAoB;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAC1B,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,EACzF;YACE,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,IAAI;SACd,CACF,CAAC;QACF,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,IAAI,CAAC,CAAC,wCAAwC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,IAAI,cAAc,GAAG;IACrB,IAAI,cAAc,IAAI,qBAAqB,IAAI,aAAa,CAAC,QAAQ,EAAE;CACxE,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,UAA+B,EAAE;IAC/E,MAAM,OAAO,GAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnE,uGAAuG;IACvG,4EAA4E;IAC5E,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE;gBAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClG,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;oBAClB,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,wEAAwE;iBAChF,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,UAAU;YAAE,SAAS;QAC/B,IAAI,KAAK;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;;YAC9D,MAAM,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC5E,MAAM,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/governance/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,eAAe,EACf,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EACL,cAAc,EACd,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,IAAY;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;AACrF,CAAC;AAwCD,MAAM,WAAW,GAAG;IAClB,uGAAuG;IACvG,oGAAoG;IACpG,uGAAuG;IACvG,iDAAiD;IACjD,uBAAuB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG;IAC3D,qEAAqE;CACtE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAE,EAAE,CAAC;IAC1C,wGAAwG;IACxG,qBAAqB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kEAAkE;IAC1G,oGAAoG;IACpG,mEAAmE;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAiB,EAAE,OAAiB,WAAW;IAC3F,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,wGAAwG;IACxG,uEAAuE;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,OAAO,OAAO,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,YAA0B;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;IACnD,OAAO,YAAY,CAAC,MAAM,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAwB,EACxB,GAAW;AACX;;;;;;;;GAQG;AACH,yBAA4C,EAAE;IAE9C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC;gBAC7E,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAEf,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,QAAQ,GAA0B,IAAI,CAAC;YAC3C,IAAI,IAAI,GAAG,WAAW,CAAC;YACvB,IAAI,OAAO,CAAC,UAAU;gBAAE,QAAQ,GAAG,YAAY,CAAC;iBAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,QAAQ,GAAG,SAAS,CAAC;gBACrB,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACrC,KAAK,CAAC,IAAI,CACR,YAAY,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD;oBAC3F,+FAA+F,CAClG,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE;gBAClC,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC;gBAC/F,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,EAAE,IAAI,CAAC;gBAC7D,OAAO,EAAE,OAAO,CAAC,YAAY;gBAC7B,QAAQ;gBACR,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wGAAwG;IACxG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAC3D,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,eAAe,CAAC,UAAU,CAAC;gBAAE,SAAS;YAC1C,+FAA+F;YAC/F,kGAAkG;YAClG,sGAAsG;YACtG,oGAAoG;YACpG,oGAAoG;YACpG,sGAAsG;YACtG,kGAAkG;YAClG,sEAAsE;YACtE,EAAE;YACF,mGAAmG;YACnG,iGAAiG;YACjG,kGAAkG;YAClG,+CAA+C;YAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,SAAS;YAClD,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED,2GAA2G;IAC3G,oGAAoG;IACpG,qGAAqG;IACrG,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,QAAQ,GAAG,gBAAgB,CAAC;IACxF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,qGAAqG;IACrG,uGAAuG;IACvG,uGAAuG;IACvG,8FAA8F;IAC9F,MAAM,eAAe,GAA+C,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,4FAA4F;IAC5F,EAAE;IACF,4GAA4G;IAC5G,yGAAyG;IACzG,0GAA0G;IAC1G,+FAA+F;IAC/F,yGAAyG;IACzG,2GAA2G;IAC3G,qGAAqG;IACrG,EAAE;IACF,4GAA4G;IAC5G,4GAA4G;IAC5G,6GAA6G;IAC7G,sGAAsG;IACtG,sFAAsF;IACtF,EAAE;IACF,wGAAwG;IACxG,sDAAsD;IACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB;YAAE,SAAS;QAClD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO;YACpC,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/F,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvF,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACxC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAC3B,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,uEAAuE;QAC9F,YAAY,CAAC,CAAC,IAAI,sCAAsC,CAC3D,CACF,CAAC;IAEF,uGAAuG;IACvG,sFAAsF;IACtF,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAE7B,MAAM,QAAQ,GAAwD;QACpE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4DAA4D,GAAG,CAAC,CAAC,IAAI,GAAG,SAAS;QACpG,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC;KACtG,CAAC;IAEF,MAAM,cAAc,GAAoB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAC,CAAC;IAEJ,uGAAuG;IACvG,sGAAsG;IACtG,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,kBAAkB,GAAG;QACzB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,kBAAkB,CAAC,CAAC;KACxF,CAAC,IAAI,EAAE,CAAC;IAET,OAAO;QACL,MAAM;QACN,UAAU;QACV,KAAK;QACL,oBAAoB;QACpB,kBAAkB;QAClB,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;QAC9B,YAAY,EAAE,mBAAmB,CAAC,GAAG,CAAC;QACtC,aAAa,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACxC,eAAe,EAAE,qBAAqB,CAAC;YACrC,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,oBAAoB;YAC9B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7F,eAAe;YACf,QAAQ;YACR,kBAAkB;SACnB,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,OAAoB;IACpF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,iBAAiB,CACrB,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EACvC,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CACzE,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACvE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,OAAoB;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,kGAAkG;QAClG,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,YAAoB;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAC1B,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,EACzF;YACE,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,IAAI;SACd,CACF,CAAC;QACF,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,IAAI,CAAC,CAAC,wCAAwC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,IAAI,cAAc,GAAG;IACrB,IAAI,cAAc,IAAI,qBAAqB,IAAI,aAAa,CAAC,QAAQ,EAAE;CACxE,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,UAA+B,EAAE;IAC/E,MAAM,OAAO,GAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnE,uGAAuG;IACvG,4EAA4E;IAC5E,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE;gBAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClG,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;oBAClB,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,wEAAwE;iBAChF,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,UAAU;YAAE,SAAS;QAC/B,IAAI,KAAK;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;;YAC9D,MAAM,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC5E,MAAM,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/kernel/grant-env.d.ts

@@ -25,9 +25,12 @@ import { type Capability } from "./resolve.ts";
  *
  *  - `DEFAULT_GATED` — whatever a governed session already asks a human about. Today `tool:bash`, and taking
  *    it from there rather than restating it means the two cannot drift apart.
- *  - `tool:write`, `tool:edit`, `tool:edit-diff` — mutate the working tree, and **are not gated by default**,
- *    so a source-and-go operator would hand them to a child with no dialog at all. That gap is exactly what
- *    made "the union is mitigated by gating" untrue (R-76).
+ *  - `tool:write`, `tool:edit`, `tool:edit-diff` — mutate the working tree. They used to be named here because
+ *    they were NOT gated, so a source-and-go operator handed them to a child with no dialog at all, which is
+ *    what made "the union is mitigated by gating" untrue (R-76). They joined `DEFAULT_GATED` on 2026-09-23,
+ *    so that gap is closed and this entry is now redundant with the line above rather than load-bearing. It
+ *    is kept because the set must not silently follow a future change to the gate list: what `init` withholds
+ *    and what a session asks a human about are two decisions that happen to agree today.
  *  - `UNIVERSAL_CAPABILITIES` — confer the whole catalog by measurement (probe `pi-fabric-eval`).
  *    `assertNarrowing` refuses a grant containing one anyway; leaving it out of the file keeps the operator
  *    from ever holding it by accident.

package/dist/kernel/grant-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-env.d.ts","sourceRoot":"","sources":["../../src/kernel/grant-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAGvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,UAAU,EAEpD,CAAC;AAEF,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAQ/D;AAaD,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAU/D;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,iCAAiC;IACjC,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,6GAA6G;IAC7G,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,sGAAsG;IACtG,kBAAkB,CAAC,EAAE,UAAU,EAAE,CAAC;IAClC,kGAAkG;IAClG,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,eAAe,CAAC;IAC3B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7F,kGAAkG;IAClG,QAAQ,EAAE;QAAE,UAAU,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC7D,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,0FAA0F;IAC1F,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,gGAAgG;IAChG,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,cAAc,EAAE,UAAU,EAAE,CAAC;CAC9B;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAyB1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAElE;AAED,qFAAqF;AACrF,eAAO,MAAM,WAAW,EAAE,UAAgC,CAAC"}
+{"version":3,"file":"grant-env.d.ts","sourceRoot":"","sources":["../../src/kernel/grant-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAGvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,UAAU,EAEpD,CAAC;AAEF,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAQ/D;AAaD,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAU/D;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,iCAAiC;IACjC,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,6GAA6G;IAC7G,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,sGAAsG;IACtG,kBAAkB,CAAC,EAAE,UAAU,EAAE,CAAC;IAClC,kGAAkG;IAClG,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,eAAe,CAAC;IAC3B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7F,kGAAkG;IAClG,QAAQ,EAAE;QAAE,UAAU,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC7D,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,0FAA0F;IAC1F,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,gGAAgG;IAChG,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,cAAc,EAAE,UAAU,EAAE,CAAC;CAC9B;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAyB1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAElE;AAED,qFAAqF;AACrF,eAAO,MAAM,WAAW,EAAE,UAAgC,CAAC"}

package/dist/kernel/grant-env.js

@@ -28,9 +28,12 @@ import { PROJECT_FILES } from "./project-paths.js";
  *
  *  - `DEFAULT_GATED` — whatever a governed session already asks a human about. Today `tool:bash`, and taking
  *    it from there rather than restating it means the two cannot drift apart.
- *  - `tool:write`, `tool:edit`, `tool:edit-diff` — mutate the working tree, and **are not gated by default**,
- *    so a source-and-go operator would hand them to a child with no dialog at all. That gap is exactly what
- *    made "the union is mitigated by gating" untrue (R-76).
+ *  - `tool:write`, `tool:edit`, `tool:edit-diff` — mutate the working tree. They used to be named here because
+ *    they were NOT gated, so a source-and-go operator handed them to a child with no dialog at all, which is
+ *    what made "the union is mitigated by gating" untrue (R-76). They joined `DEFAULT_GATED` on 2026-09-23,
+ *    so that gap is closed and this entry is now redundant with the line above rather than load-bearing. It
+ *    is kept because the set must not silently follow a future change to the gate list: what `init` withholds
+ *    and what a session asks a human about are two decisions that happen to agree today.
  *  - `UNIVERSAL_CAPABILITIES` — confer the whole catalog by measurement (probe `pi-fabric-eval`).
  *    `assertNarrowing` refuses a grant containing one anyway; leaving it out of the file keeps the operator
  *    from ever holding it by accident.

package/dist/kernel/grant-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-env.js","sourceRoot":"","sources":["../../src/kernel/grant-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAmB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,CAAC,CAAC;CACvG,CAAC;AAEF,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,UAAsB;IACpD,0GAA0G;IAC1G,2GAA2G;IAC3G,kGAAkG;IAClG,yGAAyG;IACzG,yBAAyB;IACzB,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,MAAM,OAAO,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,KAAmB;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CACxB,8FAA8F;YAC5F,kBAAkB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,yEAAyE;YAChH,mGAAmG;YACnG,mDAAmD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AA+DD,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,eAAe;QAC1B,MAAM,EACJ,oGAAoG;YACpG,2GAA2G;YAC3G,oGAAoG;QACtG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACtB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACxB,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW;YACzB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QACnF,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACnD,kBAAkB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACzD,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,cAAc,EAAE,CAAC,WAAW,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACrE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,WAAW,GAAe,mBAAmB,CAAC"}
+{"version":3,"file":"grant-env.js","sourceRoot":"","sources":["../../src/kernel/grant-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAmB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,CAAC,CAAC;CACvG,CAAC;AAEF,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,UAAsB;IACpD,0GAA0G;IAC1G,2GAA2G;IAC3G,kGAAkG;IAClG,yGAAyG;IACzG,yBAAyB;IACzB,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,MAAM,OAAO,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,KAAmB;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CACxB,8FAA8F;YAC5F,kBAAkB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,yEAAyE;YAChH,mGAAmG;YACnG,mDAAmD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AA+DD,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,eAAe;QAC1B,MAAM,EACJ,oGAAoG;YACpG,2GAA2G;YAC3G,oGAAoG;QACtG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACtB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACxB,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW;YACzB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QACnF,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACnD,kBAAkB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACzD,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,cAAc,EAAE,CAAC,WAAW,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACrE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,WAAW,GAAe,mBAAmB,CAAC"}

package/dist/kernel/propagation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"propagation.d.ts","sourceRoot":"","sources":["../../src/kernel/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAA6C,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnG,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAiB3E,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH;;;;GAIG;AACH,sGAAsG;AAEtG;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,uQAqBjB,CAAC;AAEX,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,UAAU,EAI9B,CAAC;AAkBjC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,oBAAoB,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,UAAU,EAAE,CAc/G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAO7E;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAStG;AAED,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC;;;;;;;;;GASG;AAKH,eAAO,MAAM,aAAa,EAAE,UAAU,EAAkC,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,EAAE,CAGlE;AAED,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB;;;;;;OAMG;IACH;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAE3E;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAI9G;AAED,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAoBlE"}
+{"version":3,"file":"propagation.d.ts","sourceRoot":"","sources":["../../src/kernel/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAA6C,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnG,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAiB3E,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH;;;;GAIG;AACH,sGAAsG;AAEtG;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,uQAqBjB,CAAC;AAEX,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,UAAU,EAI9B,CAAC;AAkBjC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,oBAAoB,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,UAAU,EAAE,CAc/G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAO7E;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAStG;AAED,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC;;;;;;;;;GASG;AAqBH,eAAO,MAAM,aAAa,EAAE,UAAU,EAA+E,CAAC;AAEtH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,EAAE,CAGlE;AAED,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB;;;;;;OAMG;IACH;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAE3E;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAI9G;AAED,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAoBlE"}

package/dist/kernel/propagation.js

@@ -182,7 +182,23 @@ export const DEFAULT_MAX_DEPTH = 2;
 // for the neighbouring reason: it is the one handoff mode that can carry content an untrusted repository put in
 // front of the PARENT into a fresh child, and prompt injection is in scope. Neither gate makes the thing
 // impossible; both make it loud.
-export const DEFAULT_GATED = ["tool:bash", "context:fork"];
+//
+// **The file-writing tools joined them on 2026-09-23, by operator decision, after this was measured.** A
+// security review used pi's OWN `write` from a real depth-1 child holding `tool:write` and no workspace
+// capability: it inherited `PI_CODING_AGENT_DIR`, computed the deterministic path of the accepted-workspace
+// record, wrote a well-formed one accepting its own id, and the next root session routed into the child's
+// directory. The same technique widened the operator's STORED GRANT from `tool:read` to `tool:bash`. pi's
+// `write` resolves a path against the cwd and writes it with no check that the result is under the cwd; its
+// schema says "relative or absolute". So `tool:write` reaches where `tool:bash` reaches, by a shorter route.
+//
+// **`edit` and `edit-diff` are here for the same measured reason, and gating `write` alone would have been a
+// control with a hole its author already knew about.** They use the same unconfined `resolveToCwd`. `edit`
+// needs the file to exist, which is no protection at all for the grant store — the escalation that mattered
+// was widening one that was already there.
+//
+// The cost is real and was accepted deliberately: `build`, `plan` and `git-ops` all declare a writing tool, so
+// this prompts on most useful delegations until an approval is banked. R-25 is about exactly that fatigue.
+export const DEFAULT_GATED = ["tool:bash", "context:fork", "tool:write", "tool:edit", "tool:edit-diff"];
 /**
  * Read the gate list, distinguishing **absent** from **explicitly empty**.
  *

package/dist/kernel/propagation.js.map

@@ -1 +1 @@
-{"version":3,"file":"propagation.js","sourceRoot":"","sources":["../../src/kernel/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,EACZ,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH;;;;GAIG;AACH,sGAAsG;AAEtG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,+GAA+G;IAC/G,4GAA4G;IAC5G,EAAE;IACF,iHAAiH;IACjH,6GAA6G;IAC7G,uGAAuG;IACvG,eAAe;IACf,WAAW;IACX,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,oGAAoG;IACpG,2DAA2D;IAC3D,iBAAiB;CACT,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAgB,EAAE,CACjE,CAAC,GAAG,IAAI,EAAE,CAAC;KACR,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEjC,6GAA6G;AAC7G,SAAS,eAAe,CAAC,UAAsB,EAAE,QAAgB;IAC/D,IAAI,UAAU,KAAK,QAAQ,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;AACzG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,UAAsB,EAAW,EAAE,CAC3D,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,oBAAkC,EAAE,aAA8B;IAC/F,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAC7D,uFAAuF;IACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC3F,IAAI,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,gGAAgG;QAChG,8BAA8B;QAC9B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9G,GAAG,OAAO;KACX,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAuB;IAChD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,gGAAgG;IAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAA4B,EAAE,WAA+B;IACvF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;AACnF,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC;;;;;;;;;GASG;AACH,iHAAiH;AACjH,gHAAgH;AAChH,yGAAyG;AACzG,iCAAiC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAiB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AA6CD;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,GAAG,GAA2B;QAClC,CAAC,SAAS,CAAC,EAAE,CAAC,iCAAiC,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpF,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACpC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,sGAAsG;IACtG,mGAAmG;IACnG,sGAAsG;IACtG,wGAAwG;IACxG,kFAAkF;IAClF,GAAG,CAAC,YAAY,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,0FAA0F;IAC1F,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACvE,4GAA4G;IAC5G,6GAA6G;IAC7G,4GAA4G;IAC5G,gGAAgG;IAChG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA+B,EAC/B,WAAkC;IAElC,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,SAA4B,EAAE,OAA+B;IACzF,MAAM,MAAM,GAAsB,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,SAAS;aACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;YAC3C,2EAA2E;YAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,QAA+C,CAAC;YACjE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC;YACpC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,mGAAmG;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"propagation.js","sourceRoot":"","sources":["../../src/kernel/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,EACZ,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH;;;;GAIG;AACH,sGAAsG;AAEtG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,+GAA+G;IAC/G,4GAA4G;IAC5G,EAAE;IACF,iHAAiH;IACjH,6GAA6G;IAC7G,uGAAuG;IACvG,eAAe;IACf,WAAW;IACX,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,oGAAoG;IACpG,2DAA2D;IAC3D,iBAAiB;CACT,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAgB,EAAE,CACjE,CAAC,GAAG,IAAI,EAAE,CAAC;KACR,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEjC,6GAA6G;AAC7G,SAAS,eAAe,CAAC,UAAsB,EAAE,QAAgB;IAC/D,IAAI,UAAU,KAAK,QAAQ,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;AACzG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,UAAsB,EAAW,EAAE,CAC3D,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,oBAAkC,EAAE,aAA8B;IAC/F,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAC7D,uFAAuF;IACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC3F,IAAI,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,gGAAgG;QAChG,8BAA8B;QAC9B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9G,GAAG,OAAO;KACX,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAuB;IAChD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,gGAAgG;IAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAA4B,EAAE,WAA+B;IACvF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;AACnF,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC;;;;;;;;;GASG;AACH,iHAAiH;AACjH,gHAAgH;AAChH,yGAAyG;AACzG,iCAAiC;AACjC,EAAE;AACF,yGAAyG;AACzG,wGAAwG;AACxG,4GAA4G;AAC5G,0GAA0G;AAC1G,0GAA0G;AAC1G,4GAA4G;AAC5G,6GAA6G;AAC7G,EAAE;AACF,6GAA6G;AAC7G,2GAA2G;AAC3G,4GAA4G;AAC5G,2CAA2C;AAC3C,EAAE;AACF,+GAA+G;AAC/G,2GAA2G;AAC3G,MAAM,CAAC,MAAM,aAAa,GAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAEtH;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AA6CD;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,GAAG,GAA2B;QAClC,CAAC,SAAS,CAAC,EAAE,CAAC,iCAAiC,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpF,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACpC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,sGAAsG;IACtG,mGAAmG;IACnG,sGAAsG;IACtG,wGAAwG;IACxG,kFAAkF;IAClF,GAAG,CAAC,YAAY,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,0FAA0F;IAC1F,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACvE,4GAA4G;IAC5G,6GAA6G;IAC7G,4GAA4G;IAC5G,gGAAgG;IAChG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA+B,EAC/B,WAAkC;IAElC,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,SAA4B,EAAE,OAA+B;IACzF,MAAM,MAAM,GAAsB,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,SAAS;aACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;YAC3C,2EAA2E;YAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,QAA+C,CAAC;YACjE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC;YACpC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,mGAAmG;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/governance/init.ts

@@ -248,6 +248,29 @@ export function planInit(
   // never granted: the same objection ADR-0028 rule 3 makes to authorising an undeclared skill.
   const crossReferences: { from: string; capability: Capability }[] = [];
   const live = new Set<Capability>([ALWAYS_LIVE]);
+  // **A skill held back for needing a withheld tool still contributes its `context:` modes.**
+  //
+  // Reported by the operator and measured: `live` was built from `authorised` alone, so a definition withheld
+  // for declaring `write` contributed nothing at all — including a `context:files` that is not withheld by
+  // anything. With `principal-pi-skills` that stayed invisible because the two read-only definitions supply
+  // `context:summary`, which subsumes `files`. Remove those two, or install a package whose only
+  // context-declaring definitions need a tool, and the generated grant has no `context:` entry at all. The
+  // operator then uncomments `tool:write`, the definition becomes spawnable, and its handoff is refused by a
+  // capability that never appeared in the file they were editing — or in the withheld block beside it.
+  //
+  // Granting it is safe in a way granting the tool is not, and this is grant-env's own rule rather than a new
+  // one: a capability that can change the machine or execute does not become live because a package asked for
+  // it, and everything else does. Holding `context:files` runs nothing and changes nothing; it permits handing
+  // context to a child that has declared it. `context:fork` is in `DEFAULT_GATED`, so `isLiveByDefault`
+  // already keeps it out, which is why this can be a namespace pass rather than a list.
+  //
+  // Only `needs-withheld`: an `undeclared` definition has no ceiling to read, and a `pattern` one had its
+  // declaration refused wholesale rather than narrowed.
+  for (const skill of skills) {
+    if (skill.withheld !== "needs-withheld") continue;
+    for (const capability of skill.ceiling)
+      if (capability.startsWith("context:") && isLiveByDefault(capability)) live.add(capability);
+  }
   for (const skill of authorised) {
     live.add(agentCapability(skill.name));
     for (const capability of skill.ceiling) {

package/src/kernel/grant-env.ts

@@ -30,9 +30,12 @@ import { PROJECT_FILES } from "./project-paths.ts";
  *
  *  - `DEFAULT_GATED` — whatever a governed session already asks a human about. Today `tool:bash`, and taking
  *    it from there rather than restating it means the two cannot drift apart.
- *  - `tool:write`, `tool:edit`, `tool:edit-diff` — mutate the working tree, and **are not gated by default**,
- *    so a source-and-go operator would hand them to a child with no dialog at all. That gap is exactly what
- *    made "the union is mitigated by gating" untrue (R-76).
+ *  - `tool:write`, `tool:edit`, `tool:edit-diff` — mutate the working tree. They used to be named here because
+ *    they were NOT gated, so a source-and-go operator handed them to a child with no dialog at all, which is
+ *    what made "the union is mitigated by gating" untrue (R-76). They joined `DEFAULT_GATED` on 2026-09-23,
+ *    so that gap is closed and this entry is now redundant with the line above rather than load-bearing. It
+ *    is kept because the set must not silently follow a future change to the gate list: what `init` withholds
+ *    and what a session asks a human about are two decisions that happen to agree today.
  *  - `UNIVERSAL_CAPABILITIES` — confer the whole catalog by measurement (probe `pi-fabric-eval`).
  *    `assertNarrowing` refuses a grant containing one anyway; leaving it out of the file keeps the operator
  *    from ever holding it by accident.

package/src/kernel/propagation.ts

@@ -221,7 +221,23 @@ export const DEFAULT_MAX_DEPTH = 2;
 // for the neighbouring reason: it is the one handoff mode that can carry content an untrusted repository put in
 // front of the PARENT into a fresh child, and prompt injection is in scope. Neither gate makes the thing
 // impossible; both make it loud.
-export const DEFAULT_GATED: Capability[] = ["tool:bash", "context:fork"];
+//
+// **The file-writing tools joined them on 2026-09-23, by operator decision, after this was measured.** A
+// security review used pi's OWN `write` from a real depth-1 child holding `tool:write` and no workspace
+// capability: it inherited `PI_CODING_AGENT_DIR`, computed the deterministic path of the accepted-workspace
+// record, wrote a well-formed one accepting its own id, and the next root session routed into the child's
+// directory. The same technique widened the operator's STORED GRANT from `tool:read` to `tool:bash`. pi's
+// `write` resolves a path against the cwd and writes it with no check that the result is under the cwd; its
+// schema says "relative or absolute". So `tool:write` reaches where `tool:bash` reaches, by a shorter route.
+//
+// **`edit` and `edit-diff` are here for the same measured reason, and gating `write` alone would have been a
+// control with a hole its author already knew about.** They use the same unconfined `resolveToCwd`. `edit`
+// needs the file to exist, which is no protection at all for the grant store — the escalation that mattered
+// was widening one that was already there.
+//
+// The cost is real and was accepted deliberately: `build`, `plan` and `git-ops` all declare a writing tool, so
+// this prompts on most useful delegations until an approval is banked. R-25 is about exactly that fatigue.
+export const DEFAULT_GATED: Capability[] = ["tool:bash", "context:fork", "tool:write", "tool:edit", "tool:edit-diff"];
 
 /**
  * Read the gate list, distinguishing **absent** from **explicitly empty**.