pi-daddy 0.41.1 → 0.43.1

package/CHANGELOG.md

@@ -12,6 +12,46 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.43.1 — Pi-only documentation refresh (2026-09-29)
+
+- Refresh `README.md`, `AGENTS.md`, the package README, and the ledger-record contract README against the shipped
+  initialization, privacy, model, outcome, workspace, executor, CLI, and compatibility behavior.
+- Remove obsolete Claude-specific formatting policy and describe Pi as this repository's only supported agent
+  workflow; retain ignore guards against accidentally committing assistant-specific scratch state.
+- Extend documentation drift checks to verify the published contract's file references and root workspace commands.
+  No runtime behavior or default changed.
+
+## 0.43.0 — episode outcome labeling (2026-09-29)
+
+- PR #85 adds `pi-daddy outcomes`, which reads Git history for `Pi-Episode` trailers and appends `episode_outcome`
+  ledger records covering survival on the default branch, reverts by name or inverse diff, CI state via `gh`,
+  amendments, and operator corrections.
+- `pi-daddy report` now fills its outcome column from those records.
+- The dashboard ledger reader now validates every known record kind before skipping kinds it does not render, and
+  skips unknown future kinds instead of throwing. No default changed.
+
+## 0.42.0 — model-attributed usage records (2026-09-29)
+
+- The first delegation now prompts once to keep or change child model and thinking defaults for the session;
+  `sessionModelPrompt: never` skips the prompt.
+- The dashboard now shows the `/grants models` table and read-only episode cost/ceiling; model and thinking edits use
+  the owning session's in-memory override path and produce the same `session_config` ledger event.
+- Definitions and global defaults in `.pi/pi-daddy/settings.json` may select child model and thinking, with explicit,
+  session, definition, global, and pi fallback provenance recorded and shown by `/grants` and `pi-daddy report`.
+- Episodes now warn at half of their provider-reported USD cost ceiling and gate at the ceiling (default `$5`,
+  configurable as `episodeCostCeiling`); direct children pause for one operator decision, while Herdr stops.
+- `pi-daddy report` now joins the project grant and activity ledgers into episode-level Markdown or JSON, with
+  date/definition/model filters, grouped usage, range totals, and `Pi-Episode` commit attribution.
+- Capability and lifecycle records now stamp the complete definition `SKILL.md` hash and, when exposed by an
+  installed package, its version, so measurements identify the definition version they ran under.
+- Governed children now receive `PI_DADDY_EPISODE`, `PI_DADDY_DEFINITION`, and `PI_DADDY_EXECUTION`; lifecycle
+  records name the exported variables so work produced outside pi-daddy can be joined back to its execution.
+- Child lifecycle records now include the resolved provider/model, effective thinking level and its source, nullable
+  provider-reported token dimensions, and the current turn's compaction count when the session file is readable.
+- Advice records now include the resolved advisor provider/model and nullable token dimensions reported by the
+  Decisions endpoint. The endpoint does not expose an effective thinking level, so that field is recorded as null.
+- The ledger-record v1 governance schema accepts the new lifecycle fields additively; retained records remain valid.
+
 ## 0.41.1 — context handoff bounds in delegate schemas
 
 - The `delegate`, `delegate_all`, and `delegate_chain` schemas now tell models that context handoffs accept at most

package/README.md

@@ -3,16 +3,18 @@
 Capability governance and coordination for [pi](https://github.com/badlogic/pi-mono)'s multi-level agent system. An
 orchestrator grants each sub-agent a deliberate subset of what it holds and withholds the rest; a sub-agent may delegate
 further, but only ever a subset of what it holds. Enforcement is pi's own `--tools` allowlist on a separate child
-process, with an append-only, hash-chained ledger of every grant and refusal.
+process, with an optional append-only, hash-chained governance ledger.
 
 ```bash
 pi install npm:pi-daddy
 pi
 ```
 
-`/grants` shows the session's ceiling and spawnable definitions; `/grants init` writes `.pi/pi-daddy/settings.json`,
-the one reviewable file you commit. A definition is an [Agent Skills](https://agentskills.io/specification) `SKILL.md`
-whose `allowed-tools` is the ceiling and whose body is the child's system prompt.
+`/grants` shows the session's ceiling and spawnable definitions. `/grants init` writes the review copy at
+`.pi/pi-daddy/settings.json`, stores the enforced grant outside the workspace, enables the project ledger, and applies
+the decisions to the running session; commit the review copy when the project's ignore rules permit it. A definition
+is an [Agent Skills](https://agentskills.io/specification) `SKILL.md` whose `allowed-tools` is the ceiling and whose
+body is the child's system prompt.
 
 ```
 delegate({ agent: "review-security", task: "Review the diff." })
@@ -26,7 +28,12 @@ effective = ( requested ∩ parentGrant ∩ ceiling ) \ (gated \ approved)
 
 Escalation is impossible by construction on the tool surface. It does not contain an agent holding an execution
 primitive: a child granted `bash` can start an ungoverned descendant, so `bash` is gated by default and every gate
-answer is recorded.
+answer is recorded when a governance ledger is configured.
+
+The package requires Node.js 22.19.0 or newer. `pi-daddy report` joins episode usage and attribution;
+`pi-daddy outcomes` adds Git, CI, amendment, and operator-correction signals for commits carrying a `Pi-Episode`
+trailer. A connected dashboard can change model/thinking defaults for its owning session without changing persistent
+settings or enforcement.
 
 The full product description is the repository [README](https://github.com/mojomanyana/pi-daddy#readme); the
 [CHANGELOG](./CHANGELOG.md) says what each release changed and what to do about breaking changes. The one shipped

package/contracts/ledger-record/v1/README.md

@@ -1,44 +1,59 @@
-# pi-daddy ledger contract — version 3
+# pi-daddy ledger-record contract — version 1
 
-Canonical machine contract for one `ledgerVersion: 3` JSONL line:
+Canonical machine contract for the append-only governance ledger:
 
-- `ledger-event.schema.json` — closed JSON Schema draft 2020-12 event union.
-- `fixtures/*.json` — deterministic examples generated through the production builders by
+- `record.schema.json` — the JSON Schema draft 2020-12 record envelope
+  `{v, seq, prev, at, kind, id, body, digest}` written as one JSON object per line.
+- `governance-event.schema.json` — the closed `ledgerVersion: 3` union carried in a governance record's `body`.
+- `fixtures/ledger-record.jsonl` — deterministic envelope examples.
+- `fixtures/*.json` — deterministic governance-body examples generated through the production builders by
   `scripts/generate-ledger-record-contract.ts`.
 
-## Dispatch and compatibility
+The current governance events are `capability_decision`, `workspace_lease`, `child_lifecycle`, `cost_gate`,
+`session_config`, and `episode_outcome`.
 
-1. No `ledgerVersion` and no `event` is a legacy 0.17 grant record.
-2. `ledgerVersion: 2` is validated against the frozen v2 contract.
-3. `ledgerVersion: 3` requires one known event and validation against this schema.
-4. Any unsupported explicit version, missing discriminator, unknown event, or malformed required identity is corrupt. It is never reinterpreted as legacy.
+## Reading and compatibility
 
-The schema is closed. Adding/removing a field, event or enum member, changing requiredness, or changing meaning requires a new ledger version and versioned path. V3 is still unreleased, so its review repairs are folded into this one initial contract rather than creating a public v4.
+The envelope reader verifies sequence, previous-record hash, digest, and known envelope kind. A torn or tampered tail
+is reported as damage; writers refuse to append until the operator explicitly repairs it. Pre-envelope ledgers are
+imported into envelopes and are never repaired in place.
+
+Within a governance body:
+
+1. No `ledgerVersion` and no `event` is a legacy grant record.
+2. Imported `ledgerVersion: 2` events are retained as historical records using their frozen identity rules.
+3. Every known `ledgerVersion: 3` event is validated against `governance-event.schema.json`, including known kinds a
+   particular reader does not render.
+4. The dashboard projection skips a non-empty unknown v3 event discriminator so a newer writer does not crash an
+   older dashboard. Missing discriminators, unsupported explicit versions, and malformed known events are corrupt.
+   `/grants ledger` is currently closed-world and reports valid event kinds it does not render, including future
+   discriminators, as corruption; that is a known compatibility gap rather than part of the contract.
+
+The governance schema is closed. Adding or removing a field, event, or enum member, changing requiredness, or changing
+meaning requires an explicit compatibility decision and regenerated fixtures. Run `npm run contracts:generate` from
+the repository root and commit the generated contract with the runtime change.
 
 ## Execution identity
 
-Every v3 **execution** event carries:
+Every v3 execution event carries:
 
 - `executionId`: globally unique identity of one execution occurrence.
 - `parentExecutionId`: the unique governed execution that delegated it, or explicit `null` at a root.
 - `childId`: the readable logical tree position, retained for operators and deterministic comparisons.
 
-`workflow_fact` is not an execution event; it carries its own `factId` and explicit provenance instead.
+Consumers join capability, lifecycle, and lease events by `executionId`, never by `childId`. Repeated or concurrent
+calls may reuse a logical position such as `d0.1`; they may never reuse an execution id.
 
-Consumers join lifecycle and lease events by `executionId`, never by `childId`. Repeated or concurrent calls may reuse a logical position such as `d0.1`; they may never reuse an execution id.
+A lifecycle `running` event may include `herdrPaneId` and `herdrAgentName` for navigation. These are runtime
+observations, not enforcement boundaries. `deadlineAt` is immutable within one occurrence and bounds how long a
+non-terminal start can be rendered as live; after it, the truthful state is incomplete.
 
-A lifecycle `running` event may include `herdrPaneId` and `herdrAgentName` for navigation. These are runtime observations, not enforcement boundaries. `deadlineAt` is immutable within one occurrence and bounds how long a non-terminal start can be rendered as live; after it, the truthful state is incomplete.
-
-All timestamp fields share one schema/runtime profile: JSON Schema `date-time` with seconds restricted to `00`–`59`. Leap-second strings are excluded because JavaScript deadline and duration arithmetic cannot represent them.
+All timestamp fields share one schema/runtime profile: JSON Schema `date-time` with seconds restricted to `00`–`59`.
+Leap-second strings are excluded because JavaScript deadline and duration arithmetic cannot represent them.
 
 ## Privacy and provenance
 
-The privacy boundary is unchanged: no task text, prompts, tool arguments, child output, or tool results. Fields displayed as identities and every capability use explicit ASCII identifier grammars in both schema and runtime; public builders assert that their serialized event passes the same exact reader. Correlation display fields use the identifier grammar rather than free-form prose, and a top-level null `assurance_scope` is omitted/rejected consistently. Trusted task/definition digests remain outside `correlation`. Correlation is caller-declared join metadata and never becomes proof that a workflow transition was validated or that an inline skill executed.
-
-## Note 2026-09-21 — this directory was `contracts/ledger/v3`
-
-Since ADR-0076 PR 3d every ledger line is a **record envelope** (`record.schema.json`: format, sequence, previous-line
-hash, writer timestamp, kind, id, body, digest). What this README calls a v3 event is now the **body** of a record of
-kind `capability`, `lifecycle`, `lease`, `check` or `fact`; the event fields are unchanged and
-`governance-event.schema.json` is the same schema under its new name. Ledger v2 is archived under
-`docs/archive/contracts/ledger/v2` and no longer read; a pre-format ledger is imported once at session start.
+Governance bodies contain no raw task text, prompts, tool arguments, child output, or tool results. Task and
+definition digests identify content without reproducing it; a digest is an identifier, not anonymisation. Correlation
+metadata is caller-declared join data and never authority. The separate local activity timeline may retain private
+prompt and final content according to `PI_DADDY_ACTIVITY_CONTENT`; it is not part of this governance contract.

package/contracts/ledger-record/v1/fixtures/capability-decision.json

@@ -94,5 +94,7 @@
     "name": "build",
     "source": "/operator/skills/build/SKILL.md",
     "sha256": "8888888888888888888888888888888888888888888888888888888888888888"
-  }
+  },
+  "definitionHash": "7777777777777777777777777777777777777777777777777777777777777777",
+  "definitionPackageVersion": "2.3.1"
 }

package/contracts/ledger-record/v1/fixtures/child-lifecycle.json

@@ -14,6 +14,23 @@
   "signal": null,
   "aborted": true,
   "reason": "child did not start",
+  "resolvedModel": {
+    "provider": "openai-codex",
+    "modelId": "gpt-5.3-codex"
+  },
+  "modelSource": "definition",
+  "thinkingLevel": {
+    "level": "high",
+    "source": "advisor"
+  },
+  "thinkingSource": "advisor",
+  "tokenDetail": {
+    "inputTokens": 120,
+    "outputTokens": 30,
+    "cacheReadTokens": 20,
+    "cacheWriteTokens": 10,
+    "reasoningTokens": 5
+  },
   "usage": {
     "input": 120,
     "output": 30,
@@ -29,6 +46,14 @@
       "total": 0.2
     }
   },
+  "compactionCount": 1,
+  "exportedEnvironment": [
+    "PI_DADDY_EPISODE",
+    "PI_DADDY_DEFINITION",
+    "PI_DADDY_EXECUTION"
+  ],
+  "definitionHash": "7777777777777777777777777777777777777777777777777777777777777777",
+  "definitionPackageVersion": "2.3.1",
   "correlation": {
     "schema_version": "1.0",
     "run_id": "run-contract-001",

package/contracts/ledger-record/v1/fixtures/episode-cost-gate.json

@@ -0,0 +1,14 @@
+{
+  "ledgerVersion": 3,
+  "event": "cost_gate",
+  "ts": "2026-08-20T12:00:02.500Z",
+  "episodeId": "episode:00000000-0000-4000-8000-000000000099",
+  "executionId": "exec:00000000-0000-4000-8000-000000000001",
+  "parentExecutionId": null,
+  "childId": "d0.1",
+  "gate": "episode_cost",
+  "cost": 5.2,
+  "ceiling": 5,
+  "outcome": "continued",
+  "newCeiling": 10
+}

package/contracts/ledger-record/v1/fixtures/episode-outcome.json

@@ -0,0 +1,12 @@
+{
+  "ledgerVersion": 3,
+  "event": "episode_outcome",
+  "ts": "2026-08-20T12:00:02.750Z",
+  "episodeId": "episode:00000000-0000-4000-8000-000000000099",
+  "commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "survived": true,
+  "ci": "green",
+  "amended": false,
+  "corrected": false,
+  "label": "positive"
+}

package/contracts/ledger-record/v1/fixtures/ledger-record.jsonl

@@ -1,3 +1,6 @@
-{"v":1,"seq":1,"prev":null,"at":"2026-09-21T00:00:00.000Z","kind":"capability","id":"fixture-capability-decision","body":{"ledgerVersion":3,"event":"capability_decision","executionId":"exec:00000000-0000-4000-8000-000000000001","parentExecutionId":null,"ts":"2026-08-20T12:00:01.000Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","parentId":"d0","childId":"d0.1","depth":1,"agentType":"build","executor":"process","taskFrom":"d0.0","taskFromExecutionId":"exec:00000000-0000-4000-8000-000000000000","taskDigest":"9999999999999999999999999999999999999999999999999999999999999999","correlation":{"schema_version":"1.0","run_id":"run-contract-001","task_id":"task-contract-001","workspace_id":"workspace-contract","context_id":"context-contract","phase":"verify","assurance":"critical","assurance_effective":"critical","policy_label":"policy-contract","assurance_source":"policy","assurance_scope":{"type":"selectors","selectors":["src/**"]},"activated_at":"2026-08-20T12:00:00.000Z","plan_digest":"1111111111111111111111111111111111111111111111111111111111111111","definition_digest":"2222222222222222222222222222222222222222222222222222222222222222","task_digest":"3333333333333333333333333333333333333333333333333333333333333333","base_sha":"4444444444444444444444444444444444444444","head_sha":"5555555555555555555555555555555555555555","tree_sha":"6666666666666666666666666666666666666666","event_seq":21,"last_change_seq":18,"last_authority_seq":20,"check_receipt_id":"7777777777777777777777777777777777777777777777777777777777777777"},"refusal":{"code":"WORKSPACE_WRITE_CONFLICT","message":"workspace-contract already has a governed writer","details":{"workspace_id":"workspace-contract","retryable":true,"holder_depth":1}},"requested":["tool:bash","tool:read"],"parentGrant":["agent:build","tool:bash","tool:read"],"effective":["tool:bash","tool:read"],"denied":[],"clipped":[],"gatedBlocked":[],"blocked":true,"reason":"workspace-contract already has a governed writer","approved":["tool:bash","tool:read"],"approvalSources":{"tool:bash":"persisted","tool:read":"prompt"},"approvalScopes":{"tool:bash":"always","tool:read":"once"},"approvalExpiresAt":{"tool:bash":"2026-09-19T12:00:00.000Z"},"approvalUses":{"tool:read":{"max":1,"remaining":0}},"definitionDigest":{"name":"build","source":"/operator/skills/build/SKILL.md","sha256":"8888888888888888888888888888888888888888888888888888888888888888"}},"digest":"969b6d0deed5685eb1c7c8841ac11340345ef5cac842b08b9b9529c42f7ea9fe"}
-{"v":1,"seq":2,"prev":"85a7be60d4eacf737d7b6df196f3940c0e273dacecd69a653f521c9da4de2d7a","at":"2026-09-21T00:00:00.000Z","kind":"lease","id":"fixture-workspace-lease","body":{"ledgerVersion":3,"event":"workspace_lease","ts":"2026-08-20T12:00:02.000Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","executionId":"exec:00000000-0000-4000-8000-000000000001","parentExecutionId":null,"childId":"d0.1","workspaceId":"workspace-contract","root":"/worktrees/contract","access":"write","outcome":"acquired","recovered":"unknown","correlation":{"schema_version":"1.0","run_id":"run-contract-001","task_id":"task-contract-001","workspace_id":"workspace-contract","context_id":"context-contract","phase":"verify","assurance":"critical","assurance_effective":"critical","policy_label":"policy-contract","assurance_source":"policy","assurance_scope":{"type":"selectors","selectors":["src/**"]},"activated_at":"2026-08-20T12:00:00.000Z","plan_digest":"1111111111111111111111111111111111111111111111111111111111111111","definition_digest":"2222222222222222222222222222222222222222222222222222222222222222","task_digest":"3333333333333333333333333333333333333333333333333333333333333333","base_sha":"4444444444444444444444444444444444444444","head_sha":"5555555555555555555555555555555555555555","tree_sha":"6666666666666666666666666666666666666666","event_seq":21,"last_change_seq":18,"last_authority_seq":20,"check_receipt_id":"7777777777777777777777777777777777777777777777777777777777777777"}},"digest":"d1c9f4a6c66858513564d00a77cff75d684f71624da63637ba2b53ba414fc476"}
-{"v":1,"seq":3,"prev":"998a929cc0d910e5b6246802deccf990d7fd7db50a4094428b46e64997554ebf","at":"2026-09-21T00:00:00.000Z","kind":"lifecycle","id":"fixture-child-lifecycle","body":{"ledgerVersion":3,"event":"child_lifecycle","ts":"2026-08-20T12:00:03.000Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","executionId":"exec:00000000-0000-4000-8000-000000000001","parentExecutionId":null,"childId":"d0.1","state":"failed","executor":"process","deadlineAt":"2026-08-20T12:10:00.000Z","idleTimeoutMs":900000,"exitCode":null,"signal":null,"aborted":true,"reason":"child did not start","usage":{"input":120,"output":30,"cacheRead":20,"cacheWrite":10,"reasoning":5,"totalTokens":185,"cost":{"input":0.12,"output":0.06,"cacheRead":0.01,"cacheWrite":0.01,"total":0.2}},"correlation":{"schema_version":"1.0","run_id":"run-contract-001","task_id":"task-contract-001","workspace_id":"workspace-contract","context_id":"context-contract","phase":"verify","assurance":"critical","assurance_effective":"critical","policy_label":"policy-contract","assurance_source":"policy","assurance_scope":{"type":"selectors","selectors":["src/**"]},"activated_at":"2026-08-20T12:00:00.000Z","plan_digest":"1111111111111111111111111111111111111111111111111111111111111111","definition_digest":"2222222222222222222222222222222222222222222222222222222222222222","task_digest":"3333333333333333333333333333333333333333333333333333333333333333","base_sha":"4444444444444444444444444444444444444444","head_sha":"5555555555555555555555555555555555555555","tree_sha":"6666666666666666666666666666666666666666","event_seq":21,"last_change_seq":18,"last_authority_seq":20,"check_receipt_id":"7777777777777777777777777777777777777777777777777777777777777777"}},"digest":"05817b67c4549fefaa753a03a80b67e55ebbc276e5cc9985216d8aa42552c579"}
+{"v":1,"seq":1,"prev":null,"at":"2026-09-21T00:00:00.000Z","kind":"capability","id":"fixture-capability-decision","body":{"ledgerVersion":3,"event":"capability_decision","executionId":"exec:00000000-0000-4000-8000-000000000001","parentExecutionId":null,"ts":"2026-08-20T12:00:01.000Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","parentId":"d0","childId":"d0.1","depth":1,"agentType":"build","executor":"process","taskFrom":"d0.0","taskFromExecutionId":"exec:00000000-0000-4000-8000-000000000000","taskDigest":"9999999999999999999999999999999999999999999999999999999999999999","correlation":{"schema_version":"1.0","run_id":"run-contract-001","task_id":"task-contract-001","workspace_id":"workspace-contract","context_id":"context-contract","phase":"verify","assurance":"critical","assurance_effective":"critical","policy_label":"policy-contract","assurance_source":"policy","assurance_scope":{"type":"selectors","selectors":["src/**"]},"activated_at":"2026-08-20T12:00:00.000Z","plan_digest":"1111111111111111111111111111111111111111111111111111111111111111","definition_digest":"2222222222222222222222222222222222222222222222222222222222222222","task_digest":"3333333333333333333333333333333333333333333333333333333333333333","base_sha":"4444444444444444444444444444444444444444","head_sha":"5555555555555555555555555555555555555555","tree_sha":"6666666666666666666666666666666666666666","event_seq":21,"last_change_seq":18,"last_authority_seq":20,"check_receipt_id":"7777777777777777777777777777777777777777777777777777777777777777"},"refusal":{"code":"WORKSPACE_WRITE_CONFLICT","message":"workspace-contract already has a governed writer","details":{"workspace_id":"workspace-contract","retryable":true,"holder_depth":1}},"requested":["tool:bash","tool:read"],"parentGrant":["agent:build","tool:bash","tool:read"],"effective":["tool:bash","tool:read"],"denied":[],"clipped":[],"gatedBlocked":[],"blocked":true,"reason":"workspace-contract already has a governed writer","approved":["tool:bash","tool:read"],"approvalSources":{"tool:bash":"persisted","tool:read":"prompt"},"approvalScopes":{"tool:bash":"always","tool:read":"once"},"approvalExpiresAt":{"tool:bash":"2026-09-19T12:00:00.000Z"},"approvalUses":{"tool:read":{"max":1,"remaining":0}},"definitionDigest":{"name":"build","source":"/operator/skills/build/SKILL.md","sha256":"8888888888888888888888888888888888888888888888888888888888888888"},"definitionHash":"7777777777777777777777777777777777777777777777777777777777777777","definitionPackageVersion":"2.3.1"},"digest":"4a36018bd75320d5f278ac3f31ebd676a0a24e40a779821ac1fcd67b520f8d9c"}
+{"v":1,"seq":2,"prev":"02bdcfc121a09e09df55d592196009d85c4857cdafc6d10ffae52df9ef790cf9","at":"2026-09-21T00:00:00.000Z","kind":"lease","id":"fixture-workspace-lease","body":{"ledgerVersion":3,"event":"workspace_lease","ts":"2026-08-20T12:00:02.000Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","executionId":"exec:00000000-0000-4000-8000-000000000001","parentExecutionId":null,"childId":"d0.1","workspaceId":"workspace-contract","root":"/worktrees/contract","access":"write","outcome":"acquired","recovered":"unknown","correlation":{"schema_version":"1.0","run_id":"run-contract-001","task_id":"task-contract-001","workspace_id":"workspace-contract","context_id":"context-contract","phase":"verify","assurance":"critical","assurance_effective":"critical","policy_label":"policy-contract","assurance_source":"policy","assurance_scope":{"type":"selectors","selectors":["src/**"]},"activated_at":"2026-08-20T12:00:00.000Z","plan_digest":"1111111111111111111111111111111111111111111111111111111111111111","definition_digest":"2222222222222222222222222222222222222222222222222222222222222222","task_digest":"3333333333333333333333333333333333333333333333333333333333333333","base_sha":"4444444444444444444444444444444444444444","head_sha":"5555555555555555555555555555555555555555","tree_sha":"6666666666666666666666666666666666666666","event_seq":21,"last_change_seq":18,"last_authority_seq":20,"check_receipt_id":"7777777777777777777777777777777777777777777777777777777777777777"}},"digest":"846254fb313861742c04f576f6afca484f1e9954461bd55a28d2e46c10c3143a"}
+{"v":1,"seq":3,"prev":"5171a9ea3de47b21d07d72606d69f1529d9b26ded8d0a9e66f249ba0782a6bf4","at":"2026-09-21T00:00:00.000Z","kind":"fact","id":"fixture-episode-cost-gate","body":{"ledgerVersion":3,"event":"cost_gate","ts":"2026-08-20T12:00:02.500Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","executionId":"exec:00000000-0000-4000-8000-000000000001","parentExecutionId":null,"childId":"d0.1","gate":"episode_cost","cost":5.2,"ceiling":5,"outcome":"continued","newCeiling":10},"digest":"144512eeb39ca539e5f27a7113afa5139b1ce507028d81c9fbae45b092149e13"}
+{"v":1,"seq":4,"prev":"b2968d627c54e65c0e98a297c521ad6229367c75df4c68db2a18586eb4729a24","at":"2026-09-21T00:00:00.000Z","kind":"fact","id":"fixture-session-config","body":{"ledgerVersion":3,"event":"session_config","ts":"2026-08-20T12:00:02.750Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","outcome":"changed","trigger":"first-delegation","overrides":{"review":{"model":"anthropic/claude-opus-4-6","thinking":"high"}}},"digest":"a363414f30242ae9a74db705691f5f8768070169e2676d1d7a3143adc6e46800"}
+{"v":1,"seq":5,"prev":"0e3fd664c2dca1fc47d2009379607904458aa3a93dfe6e13a3ea485489398a4d","at":"2026-09-21T00:00:00.000Z","kind":"fact","id":"fixture-episode-outcome","body":{"ledgerVersion":3,"event":"episode_outcome","ts":"2026-08-20T12:00:02.750Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","commit":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","survived":true,"ci":"green","amended":false,"corrected":false,"label":"positive"},"digest":"7617dfb4e545c6a0d54c2daf0d7598a2e191e333d67bb79189c618ea30752772"}
+{"v":1,"seq":6,"prev":"e537315b2ab8675356be15e9b77ce51caceac65e7abc965d2ff3253e1e90bf0e","at":"2026-09-21T00:00:00.000Z","kind":"lifecycle","id":"fixture-child-lifecycle","body":{"ledgerVersion":3,"event":"child_lifecycle","ts":"2026-08-20T12:00:03.000Z","episodeId":"episode:00000000-0000-4000-8000-000000000099","executionId":"exec:00000000-0000-4000-8000-000000000001","parentExecutionId":null,"childId":"d0.1","state":"failed","executor":"process","deadlineAt":"2026-08-20T12:10:00.000Z","idleTimeoutMs":900000,"exitCode":null,"signal":null,"aborted":true,"reason":"child did not start","resolvedModel":{"provider":"openai-codex","modelId":"gpt-5.3-codex"},"modelSource":"definition","thinkingLevel":{"level":"high","source":"advisor"},"thinkingSource":"advisor","tokenDetail":{"inputTokens":120,"outputTokens":30,"cacheReadTokens":20,"cacheWriteTokens":10,"reasoningTokens":5},"usage":{"input":120,"output":30,"cacheRead":20,"cacheWrite":10,"reasoning":5,"totalTokens":185,"cost":{"input":0.12,"output":0.06,"cacheRead":0.01,"cacheWrite":0.01,"total":0.2}},"compactionCount":1,"exportedEnvironment":["PI_DADDY_EPISODE","PI_DADDY_DEFINITION","PI_DADDY_EXECUTION"],"definitionHash":"7777777777777777777777777777777777777777777777777777777777777777","definitionPackageVersion":"2.3.1","correlation":{"schema_version":"1.0","run_id":"run-contract-001","task_id":"task-contract-001","workspace_id":"workspace-contract","context_id":"context-contract","phase":"verify","assurance":"critical","assurance_effective":"critical","policy_label":"policy-contract","assurance_source":"policy","assurance_scope":{"type":"selectors","selectors":["src/**"]},"activated_at":"2026-08-20T12:00:00.000Z","plan_digest":"1111111111111111111111111111111111111111111111111111111111111111","definition_digest":"2222222222222222222222222222222222222222222222222222222222222222","task_digest":"3333333333333333333333333333333333333333333333333333333333333333","base_sha":"4444444444444444444444444444444444444444","head_sha":"5555555555555555555555555555555555555555","tree_sha":"6666666666666666666666666666666666666666","event_seq":21,"last_change_seq":18,"last_authority_seq":20,"check_receipt_id":"7777777777777777777777777777777777777777777777777777777777777777"}},"digest":"c13fc25e8a93c853be54ecebcaf4e9a2d6137bd1c37cc5655d33c71da3877cad"}

package/contracts/ledger-record/v1/fixtures/session-config.json

@@ -0,0 +1,14 @@
+{
+  "ledgerVersion": 3,
+  "event": "session_config",
+  "ts": "2026-08-20T12:00:02.750Z",
+  "episodeId": "episode:00000000-0000-4000-8000-000000000099",
+  "outcome": "changed",
+  "trigger": "first-delegation",
+  "overrides": {
+    "review": {
+      "model": "anthropic/claude-opus-4-6",
+      "thinking": "high"
+    }
+  }
+}