pi-daddy 0.43.1 → 0.44.0

package/CHANGELOG.md

@@ -3,7 +3,7 @@
 Newest first. **Breaking changes are marked and say what to do about them.**
 
 This file exists because the README had grown ninety lines of stacked version banners before a reader
-reached what the package *does* — churn documentation in front of product documentation. The banners are
+reached what the package _does_ — churn documentation in front of product documentation. The banners are
 the record of how the package got here and are worth keeping; they are not worth reading first.
 
 > **0.13.0 is the first PUBLISHED release.** Every version below it was developed in this repository and
@@ -12,6 +12,70 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.44.0 — stable release (2026-10-07)
+
+- Rebuild the native helper using a SHA-pinned Zig/static-musl toolchain, retain exact source/artifact/license
+  provenance, and have CI reproduce every output byte. The loader verifies the held executable against its generated
+  JavaScript constant; the checksum sidecar is no longer runtime authority. Ship the corresponding musl and Zig notices.
+- Reject invalid native control/status descriptors and unsupported child enumeration before admitting a worker;
+  treat control-read failures as owner loss, validate numeric bounds, send TERM once per unreaped child, and preserve
+  the original stop reason during hard escalation. Startup uses the caller's timeout/deadline, retaining late valid
+  ownership evidence without reopening a cancelled worker's start gate.
+- Recheck retained reservations against their original durable receipts before single, parallel and chain dispatch.
+  Exact later settlement proof releases capacity once; missing or mismatched proof remains retained, and the original
+  failed/unknown result remains unchanged. Use `delegate_all` for independent parallel work.
+- Compare streamed/persisted messages structurally: object-key order is irrelevant, array order and every value remain
+  binding. Share a final-output conformance table with skill-harness, preserving text bytes without invented separators.
+- **Breaking — explicit package support:** require Linux x64 and exact Pi 1.0.4 in package platform and peer metadata.
+  Other platforms or Pi versions must retain their previously qualified runtime until separately qualified.
+- Clarify the original candidate's removed monetary/advisor/model automation and passive-cost JSON breaking changes,
+  with migration guidance and version-scoped changelog entries.
+
+## 0.44.0-rc.1 — captured delegation qualification (2026-10-07)
+
+Release candidate for review, not a stable or npm publication. Use the immutable candidate tag for source review.
+
+- **Breaking — delegation bounds:** budget now caps active descendants through disjoint subtree reservations, alongside
+  depth and per-call limits. Settled children return capacity; uncertain cleanup retains it. A single child
+  conservatively reserves the available subtree, and active ownership survives extension reloads.
+- **Bounded input and approval handling:** retain cleanup failures on the original owner, guard manual history
+  reads, and time out approvals without weakening their authority. Named approval revocation uses the pinned
+  selected definition; `revoke --all` remains available without resource acquisition.
+- **Captured execution contract:** qualify Pi 1.0.4 JSON settlement against the exact persisted current turn and
+  active branch. Preserve complete final text and expose work/final/cleanup/observation states independently.
+  Failed children return native error results with available evidence; optional recording failures preserve work.
+- **Cleanup:** use the packaged Linux x64 subreaper and execution-bound durable receipts. Unknown subtree cleanup
+  retains capacity and quarantines workspace reuse; preserve the referenced ownership directory as evidence.
+- **Breaking — platform/backend support:** the package now declares Linux x64 only. macOS, ARM64 and native Windows users must remain on their previous qualified release; this candidate has no qualified executor there.
+- **Breaking — staged backend release:** governed Herdr execution refuses, even when its server answers, until parity is
+  qualified. Explicitly set `PI_DADDY_HERDR=0` for captured execution; there is no fallback after selection.
+- **Required handoffs:** block dependent chain steps when the complete prior final exceeds the handoff limit.
+  The completed step and its full result remain available; no tail-only handoff is promoted to complete.
+- **Selected Principal resources:** bind the native phase to selected inline and delegated bytes, hash and exact
+  package manifest, use `delegate_describe` to obtain the required definition identity, and pin it until reload.
+  Missing, moved or tampered marked Principal resources refuse rather than becoming ordinary inline definitions.
+
+- **Breaking — removed automation:** remove monetary execution gates, external advisors and the automatic first-delegation model chooser. Configure provider-side spend controls if required, and select models/thinking manually. Recognized
+  legacy settings and cost arguments are inert; manual model edits, permission approvals and retained historical
+  usage remain. Pi 1.0.4 argument preparation validates active arguments after removing the retired cost override.
+- Live complete episode cost is explicitly unavailable in the session dashboard; historical usage remains in reports.
+
+
+### Passive cost coverage
+
+- **Breaking — report JSON change:** row/group/total cost and episode-cost percentiles may be null when coverage is incomplete.
+  Use observedCost for the known subtotal and costCoverage for complete/partial/unavailable status. A reported zero
+  remains zero. Cost coverage concerns recorded child executions only; root and unrecorded work are not measured.
+
+### Surviving guard repairs
+
+- Treat damaged or oversized runtime/resource settings and package metadata as failures, not missing defaults.
+  Bounded reads reject FIFOs and malformed UTF-8; unresolved cleanup stays attached to the operation and session owner.
+- Pruned handoffs carry only the active Pi branch and shared ancestry. Unavailable input is labeled incomplete.
+  Named file handoffs require Linux held-descriptor confinement proof and refuse when it is unavailable.
+- Approval timeouts accept absent (120 seconds), literal 0 (unlimited), or canonical whole seconds 1..2147483.
+  Fix malformed values before requesting a new prompt; existing authority remains usable.
+
 ## 0.43.1 — Pi-only documentation refresh (2026-09-29)
 
 - Refresh `README.md`, `AGENTS.md`, the package README, and the ledger-record contract README against the shipped
@@ -786,7 +850,6 @@ and test synchronization only; dependencies and runtime are unchanged.
   Rename prose/whitespace keys before calling `runNamedCheck`; invalid IDs now refuse before the executable
   or lease starts rather than failing only when a v3 receipt is appended.
 
-
 ## 0.19.0 — workspace routing is a capability (2026-08-23)
 
 **The four hang fixes below were staged for a 0.18.2 and are released here instead — a decision reversed
@@ -794,13 +857,13 @@ deliberately, so the reversal is recorded rather than the reason vanishing.** Th
 argued for cutting them as a patch so a fix for released code would not be gated on a breaking change. The
 counter-argument won: **R-131 — workspace routing does not attenuate — is a live escalation in published
 0.18.0 and 0.18.1**, a child routed to `staging` can route its grandchild to `prod` with a real lease and a
-ledger line that reads as authorised, and the fix for it *is* the breaking change. A 0.18.2 would have fixed
+ledger line that reads as authorised, and the fix for it _is_ the breaking change. A 0.18.2 would have fixed
 one defect and left that one open, on a line that then needed supporting alongside this one. Shipping once
 fixes all three.
 
 - **FIX — a retained lease no longer reports a retention that did not happen (R-152).** `markRetained`
   returned `void` and `releaseDelegationWorkspace` hardcoded the ledger word, so a `workspace_lease` event
-  said `retained` — *"the pane may still be live"* — for a helper that had already died (the fact is `lost`),
+  said `retained` — _"the pane may still be live"_ — for a helper that had already died (the fact is `lost`),
   for a lease already cleanly released, and for a retention whose record could not be written. It now answers
   in the release vocabulary and the caller ledgers what it says. **Breaking for direct library callers only:**
   `WorkspaceLease.markRetained` returns `Promise<LeaseReleaseOutcome>` instead of `Promise<void>`, and
@@ -827,7 +890,6 @@ fixes all three.
   explicitly rejected outcome. Measured with a `herdr` that sleeps: before, `LOCK=HELD` with no marker
   indefinitely; after, released with the marker written. Tunable via `herdrCloseTimeoutMs` (default 15s).
 
-
 - Ship a canonical JSON Schema draft 2020-12 contract for `ledgerVersion: 2` plus deterministic fixtures for
   all four event types, generated through the production builders. Stable package export paths let external
   harnesses pin the real contract instead of maintaining a parallel format.
@@ -886,7 +948,7 @@ and a mutation battery, and are listed because ADR-0035 claimed three of them as
 amendment). **The entries under "Present in earlier releases" below DID ship**, and an earlier draft of this section put
 them under this heading, telling operators the `tool:*` attenuation escape could not affect them. (That draft
 then said "two" while three bullets sat under the heading, one of which — the v2 enum — is the single item
-here that provably did *not* ship. It has moved back.)
+here that provably did _not_ ship. It has moved back.)
 
 - **Routing terminated below the root instead of attenuating.** `unknownCapabilities` did not know the
   namespace, and a catalog is always present in a real session, so every requested `workspace:<id>` was
@@ -1008,7 +1070,7 @@ is never a force-push, and `test/branch-guard.test.ts`, which pins it against se
 
 **Why a version at all**, since nothing here changed: rule 10 says version bumps take the same path as
 everything else, and this one did — branch, PR, review, squash-merge. The rule's first draft was reviewed by
-six independent agents across two rounds that found sixteen defects, including that *"never commit to `main`"*
+six independent agents across two rounds that found sixteen defects, including that _"never commit to `main`"_
 forbids the merge the rule requires, and that the guard written to fix that had reproduced the same defect in
 shell. `docs/03-risks.md` R-85 and the 2026-08-18 session-log entry hold the details.
 
@@ -1021,11 +1083,11 @@ order is now what the sentence says it is.
 one that removes the last reason to keep an ungoverned spawner installed alongside this one.
 
 - **The handoff is fenced, labelled and nonce-delimited.** A chain makes step N's task the output of a governed
-  child, which is the highest-authority text a child receives after its own `SKILL.md`. The label is *framing* — a
+  child, which is the highest-authority text a child receives after its own `SKILL.md`. The label is _framing_ — a
   determined injection can argue with it — but the **nonce is mechanism**: minted after the producing child
   finished, so it cannot forge a closing delimiter. ADR-0033 records the stronger option (quarantine to a file the
   next step must `read`) as the prepared answer if framing proves insufficient.
-- **Gated upfront: one dialog per capability *and* definition, all before the first step runs.** Approvals arrive
+- **Gated upfront: one dialog per capability _and_ definition, all before the first step runs.** Approvals arrive
   together instead of interrupting a running pipeline. Not one dialog for everything — an approval is keyed
   `capability@subject`, so a single dialog spanning several definitions would ask about one and spend the answer on
   the rest. ADR-0033 originally specified that, three reviewers found it was a privilege path, and the ADR carries
@@ -1040,7 +1102,7 @@ one that removes the last reason to keep an ungoverned spawner installed alongsi
 `PI_GRANTS_FANOUT=12` (the default is 8). At most 8 steps.
 
 **Also:** `test-integration/herdr.it.ts` now checks herdr's own contracts against a real server in an isolated
-workspace — the gap that hid three shipping defects in 0.16.0, where the unit fake was a *claim* about herdr that
+workspace — the gap that hid three shipping defects in 0.16.0, where the unit fake was a _claim_ about herdr that
 nothing verified.
 
 ## 0.16.0 — children you can watch, in panes chosen for you
@@ -1048,17 +1110,17 @@ nothing verified.
 **If herdr is running, your sub-agents now run in herdr panes without you configuring anything — and the
 parent shows what each one is doing while it works.** Two ADRs, shipped together.
 
-### `PI_GRANTS_HERDR` is three-state, and unset now means *probe* (ADR-0031)
+### `PI_GRANTS_HERDR` is three-state, and unset now means _probe_ (ADR-0031)
 
-| Value | Behaviour |
-| :--- | :--- |
+| Value | Behaviour                                                                                                                               |
+| :---- | :-------------------------------------------------------------------------------------------------------------------------------------- |
 | unset | Probe once at session start (`herdr tab list`, 2s bound). A server that **answers** ⇒ herdr panes; anything else ⇒ captured subprocess. |
-| `1` | Demand herdr. **Every delegation refuses** if it is unreachable — no fallback. |
-| `0` | Demand the captured subprocess. No probe. |
+| `1`   | Demand herdr. **Every delegation refuses** if it is unreachable — no fallback.                                                          |
+| `0`   | Demand the captured subprocess. No probe.                                                                                               |
 
 **Not a `PATH` check.** A binary with no server behind it would make every delegation fail at `tab create`, on
-a path nobody chose — so only a *reachable* server counts. This reverses part of ADR-0016 point 6, which
-refused auto-detection on the grounds that a run must not "silently relocate"; the answer to *silently* is that
+a path nobody chose — so only a _reachable_ server counts. This reverses part of ADR-0016 point 6, which
+refused auto-detection on the grounds that a run must not "silently relocate"; the answer to _silently_ is that
 the executor is now named at session start, in `/grants`, and per child in the ledger.
 
 **What to do about it:** nothing, unless you relied on an unset variable meaning subprocesses. If you did, set
@@ -1090,7 +1152,7 @@ returned.
 
 A pane used to be destroyed the instant its child settled, so a twenty-second child's pane was gone before
 anyone could switch to it. Panes now belong to the **agent run** and are swept at `agent_settled`, capped at 8
-at once, with process `exit` as the backstop. `PI_GRANTS_HERDR_KEEP_PANE=1` still means *not even then*.
+at once, with process `exit` as the backstop. `PI_GRANTS_HERDR_KEEP_PANE=1` still means _not even then_.
 
 A child's pane also defaults to the **parent's own herdr workspace** now, so switching to one is a tab away
 rather than a workspace away.
@@ -1106,7 +1168,7 @@ shipping blockers, and they change what the herdr path guarantees:
   working with its grant after its result was reported.
 - **herdr binds an agent name to its tab.** With panes outliving their calls, the **second `delegate` of every
   turn** failed with `agent_name_taken`. Names are now unique per spawn.
-- **The 8-pane cap killed live siblings**, because pi runs tool calls in parallel by default. Only *settled* panes
+- **The 8-pane cap killed live siblings**, because pi runs tool calls in parallel by default. Only _settled_ panes
   are reclaimable now; if they are all live the cap yields rather than enforcing.
 - **The pane reader amplified output 89,000×** once a pane scrolled or passed the output cap: `agent read` returns
   a snapshot of a bounded terminal and was being diffed as an append-only stream.
@@ -1127,7 +1189,7 @@ and coverage was added where it was simply absent — including that nothing ver
 ### Also
 
 - **`/grants ledger` tallies executors**, so "which children ran in panes?" no longer needs `jq`.
-- **The tripwire names `delegate_all`.** It said only *"Use `delegate` instead"*, and a request for parallel
+- **The tripwire names `delegate_all`.** It said only _"Use `delegate` instead"_, and a request for parallel
   work was answered with a single sequential call as a result.
 - **The ledger records `executor` per child** — required, not optional. The executor is decided by a probe now,
   so nothing outside the record preserves which one ran, and the two paths do not produce the same argv.
@@ -1158,7 +1220,7 @@ pi
   **always wins**: it is how a child is governed and how CI is configured. `.pi/grants.env` is still written
   and still worth committing — it is the reviewable record, no longer what the enforcer reads. (ADR-0030)
 - **The dialog does not ask questions whose answers cannot matter.** `tool:bash` subsumes `write` and
-  `edit`, so once bash is granted those are conferred; asking anyway let an operator answer *no* to
+  `edit`, so once bash is granted those are conferred; asking anyway let an operator answer _no_ to
   `tool:write` and then watch `build` be allowed it. It now reports them as already conferred instead.
 - **An unknown `/grants` subcommand is refused rather than ignored.** `/grants init` used to print the
   ordinary status screen with the word silently dropped, so a command that did not exist looked like it had
@@ -1182,7 +1244,7 @@ resolution, enforcement, approvals or the ledger changed — this is the part be
 - **The generated grant is READ-ONLY by default** (ADR-0029). `init` grants what the copied skills declare
   minus anything that can change your machine — `bash`, `write`, `edit` and the universal capabilities are
   written **commented**, naming the definitions that need them. `init` + `source` gives a working read-only
-  setup; widening costs one deliberate uncomment. The reason: `PI_GRANTS_GRANT` is what *bounds* a declared
+  setup; widening costs one deliberate uncomment. The reason: `PI_GRANTS_GRANT` is what _bounds_ a declared
   ceiling, so generating it from those ceilings would give the bound and the bounded one author, and it
   would not be you.
 
@@ -1193,14 +1255,14 @@ resolution, enforcement, approvals or the ledger changed — this is the part be
   `PI_GRANTS_GRANT` string by hand — seven times for `principal-pi-skills`.
 
   **It chooses no ceiling, and that boundary is the whole design.** A skill that declares `allowed-tools` is
-  copied byte for byte; one that declares none is copied with a *commented* placeholder and stays
+  copied byte for byte; one that declares none is copied with a _commented_ placeholder and stays
   unspawnable until a human fills it in. The placeholder is deliberately not a working example, so
   uncommenting it unedited fails loudly instead of granting something nobody decided. An existing file is
   **kept**, never overwritten — that edit is the capability decision, and a second `init` run is exactly
   when it would be destroyed. `--force` exists and says what it costs.
 
 - **Session start says how many definitions are spawnable, and names the withheld ones.** The line reported
-  the grant and never the definitions, so *"governance is working"* and *"did the install fail?"* looked
+  the grant and never the definitions, so _"governance is working"_ and _"did the install fail?"_ looked
   identical:
 
   ```
@@ -1224,11 +1286,11 @@ resolution, enforcement, approvals or the ledger changed — this is the part be
   from a package are refused, and the assembled grant is charset-checked before the file is written at all.
 
 - **Fixed before release: `init` overwrote an operator's file and wrote through symlinks** (R-79). The
-  presence probe was `readFile`, which treats *unreadable* as *absent* — so a permissions-restricted
+  presence probe was `readFile`, which treats _unreadable_ as _absent_ — so a permissions-restricted
   `SKILL.md` was replaced and its ceiling **widened**, with no `--force`. And `writeFile` follows symlinks, so
   a dangling link at a target path created the file outside the project while reporting an in-project path.
   Both are one `open(path, "wx")`. `--force` no longer regenerates `.pi/grants.env`, and `pi-daddy init
-  --Force` is no longer accepted as a silent no-op.
+--Force` is no longer accepted as a silent no-op.
 
 - **Fixed before release: the startup line blamed your files for a session-level refusal** (R-81). A session
   at its depth limit, or with a malformed `PI_GRANTS_MAX_DEPTH`, was told its `SKILL.md` files were written
@@ -1258,17 +1320,17 @@ as a user of this package:
   the path, not the lock this process created, so a broken stale lock cascaded: the old holder freed the new
   owner's lock on the way out, and the next arrival — which raced nothing — walked in beside it. Reproduced
   across real OS processes. Every lock now carries a token and proves ownership before deleting.
-- **The ledger over-claimed human approval under concurrency.** One *Allow for this session* answered under
+- **The ledger over-claimed human approval under concurrency.** One _Allow for this session_ answered under
   a fan-out of eight wrote eight lines each recording `approvalSource: "prompt"`. Riders now record
   `session`, which is what actually happened.
 
 One breaking change, and it is a type.
 
 - **BREAKING: `revokeApproval` returns `"revoked" | "absent" | "failed" | "busy"`**, not a boolean. It had
-  two outcomes for four facts, and `/grants revoke` printed *"no persisted approval named X"* whenever the
+  two outcomes for four facts, and `/grants revoke` printed _"no persisted approval named X"_ whenever the
   write failed — telling an operator that the approval they are revoking does not exist **while it is still
   in effect**. The most alarming outcome wore the most reassuring message. `busy` is separate because a lock
-  timeout happens *before* the load, so nothing was looked at and nothing may be claimed about the entry.
+  timeout happens _before_ the load, so nothing was looked at and nothing may be claimed about the entry.
   Callers switching on the boolean must switch on the string; `"revoked"` is the only success.
 - **Approval writes hold a lock (R-49).** Every write is load → modify → write and none of them was
   serialised, so session 1 could load, session 2 could revoke, and session 1's next save would restore the
@@ -1278,10 +1340,10 @@ One breaking change, and it is a type.
 - **`/grants ledger` counts where each approval came from.** ADR-0020 keeps the persistence layer on an
   asserted fatigue argument and named the evidence that would settle it — `persisted` against `prompt` over
   real use. The data was already recorded and nothing read it. **Two numbers, both labelled**: raw records
-  are an *upper bound* on prompts avoided, because within one session only the first would have been a
+  are an _upper bound_ on prompts avoided, because within one session only the first would have been a
   prompt and the rest come from the in-memory session cache; distinct `capability@subject` pairs are the
   closer estimate. Reporting records alone overstated the layer twentyfold in the obvious case (R-63).
-  Records written before per-capability sources existed are reported as *not counted* rather than folded in,
+  Records written before per-capability sources existed are reported as _not counted_ rather than folded in,
   because that older scalar over-claimed `prompt`.
 - **A revoke is documented as taking effect at the next gate check**, not "immediately". A spawn whose gate
   check already passed is not retracted by a revoke arriving microseconds later — inherent to revoking

package/README.md

@@ -1,5 +1,7 @@
 # pi-daddy
 
+Stable release: **0.44.0** (tag `v0.44.0`), published to npm.
+
 Capability governance and coordination for [pi](https://github.com/badlogic/pi-mono)'s multi-level agent system. An
 orchestrator grants each sub-agent a deliberate subset of what it holds and withholds the rest; a sub-agent may delegate
 further, but only ever a subset of what it holds. Enforcement is pi's own `--tools` allowlist on a separate child
@@ -30,6 +32,19 @@ Escalation is impossible by construction on the tool surface. It does not contai
 primitive: a child granted `bash` can start an ungoverned descendant, so `bash` is gated by default and every gate
 answer is recorded when a governance ledger is configured.
 
+This candidate targets Pi 1.0.4 and captured Linux x64 execution. Qualification is limited to Ubuntu WSL2,
+kernel `6.18.33.2-microsoft-standard-WSL2`, x86_64 and Node `v26.7.0`; other runtime/kernel combinations, native
+Windows and WSL-to-Windows worker interop remain unqualified. Governed Herdr execution refuses until separately qualified. Select captured execution with `PI_DADDY_HERDR=0`. A final must match Pi's settled
+JSON output and persisted current branch. Unknown subtree cleanup retains capacity and workspace exclusion.
+`PI_DADDY_FANOUT` limits active descendants using conservative subtree reservations, with capacity returned only
+after verified settlement. Complete results remain separate from optional recording failures.
+
+The package dependency and peer requirement both pin exact Pi **1.0.4**; later Pi versions require new qualification. Use Principal **4.8.0** with this runtime's `delegate_describe` contract. Native phases use `plan`, `build`, `review`, `debug`, and `investigate` with their returned `definitionId`; independent parallel work uses one `delegate_all` batch.
+
+Final capture preserves whitespace and concatenates text blocks without inserting separators. Tool-call terminals, empty visible finals and non-`stop` reasons are unavailable. Persisted message comparisons ignore object key order while preserving array order and every field value. The shared `final-conformance.json` table checks these semantics in both runtime and harness. Capture remains bounded: 4 MiB visible final, 32 MiB protocol line, 64 MiB persisted session, and a 3-second bounded session read. Exceeding a limit reports an unavailable final and blocks dependent handoffs; it does not imply the worker failed to settle.
+
+Retained capacity is rechecked against the original bound ownership and settlement receipt before a new single, parallel or chain dispatch. Exact later proof refunds the reservation once; missing, malformed or mismatched proof and unbound ownership remain retained. Recovery does not rewrite the original failed/unknown outcome or mint new capacity on reload. A single delegation reserves its available subtree; use `delegate_all` to allocate independent parallel children.
+
 The package requires Node.js 22.19.0 or newer. `pi-daddy report` joins episode usage and attribution;
 `pi-daddy outcomes` adds Git, CI, amendment, and operator-correction signals for commits carrying a `Pi-Episode`
 trailer. A connected dashboard can change model/thinking defaults for its owning session without changing persistent

package/THIRD_PARTY_LICENSES/musl-COPYRIGHT.txt

@@ -0,0 +1,193 @@
+musl as a whole is licensed under the following standard MIT license:
+
+----------------------------------------------------------------------
+Copyright © 2005-2020 Rich Felker, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----------------------------------------------------------------------
+
+Authors/contributors include:
+
+A. Wilcox
+Ada Worcester
+Alex Dowad
+Alex Suykov
+Alexander Monakov
+Andre McCurdy
+Andrew Kelley
+Anthony G. Basile
+Aric Belsito
+Arvid Picciani
+Bartosz Brachaczek
+Benjamin Peterson
+Bobby Bingham
+Boris Brezillon
+Brent Cook
+Chris Spiegel
+Clément Vasseur
+Daniel Micay
+Daniel Sabogal
+Daurnimator
+David Carlier
+David Edelsohn
+Denys Vlasenko
+Dmitry Ivanov
+Dmitry V. Levin
+Drew DeVault
+Emil Renner Berthing
+Fangrui Song
+Felix Fietkau
+Felix Janda
+Gianluca Anzolin
+Hauke Mehrtens
+He X
+Hiltjo Posthuma
+Isaac Dunham
+Jaydeep Patil
+Jens Gustedt
+Jeremy Huntwork
+Jo-Philipp Wich
+Joakim Sindholt
+John Spencer
+Julien Ramseier
+Justin Cormack
+Kaarle Ritvanen
+Khem Raj
+Kylie McClain
+Leah Neukirchen
+Luca Barbato
+Luka Perkov
+M Farkas-Dyck (Strake)
+Mahesh Bodapati
+Markus Wichmann
+Masanori Ogino
+Michael Clark
+Michael Forney
+Mikhail Kremnyov
+Natanael Copa
+Nicholas J. Kain
+orc
+Pascal Cuoq
+Patrick Oppenlander
+Petr Hosek
+Petr Skocik
+Pierre Carrier
+Reini Urban
+Rich Felker
+Richard Pennington
+Ryan Fairfax
+Samuel Holland
+Segev Finer
+Shiz
+sin
+Solar Designer
+Stefan Kristiansson
+Stefan O'Rear
+Szabolcs Nagy
+Timo Teräs
+Trutz Behn
+Valentin Ochs
+Will Dietz
+William Haddon
+William Pitcock
+
+Portions of this software are derived from third-party works licensed
+under terms compatible with the above MIT license:
+
+The TRE regular expression implementation (src/regex/reg* and
+src/regex/tre*) is Copyright © 2001-2008 Ville Laurikari and licensed
+under a 2-clause BSD license (license text in the source files). The
+included version has been heavily modified by Rich Felker in 2012, in
+the interests of size, simplicity, and namespace cleanliness.
+
+Much of the math library code (src/math/* and src/complex/*) is
+Copyright © 1993,2004 Sun Microsystems or
+Copyright © 2003-2011 David Schultz or
+Copyright © 2003-2009 Steven G. Kargl or
+Copyright © 2003-2009 Bruce D. Evans or
+Copyright © 2008 Stephen L. Moshier or
+Copyright © 2017-2018 Arm Limited
+and labelled as such in comments in the individual source files. All
+have been licensed under extremely permissive terms.
+
+The ARM memcpy code (src/string/arm/memcpy.S) is Copyright © 2008
+The Android Open Source Project and is licensed under a two-clause BSD
+license. It was taken from Bionic libc, used on Android.
+
+The AArch64 memcpy and memset code (src/string/aarch64/*) are
+Copyright © 1999-2019, Arm Limited.
+
+The implementation of DES for crypt (src/crypt/crypt_des.c) is
+Copyright © 1994 David Burren. It is licensed under a BSD license.
+
+The implementation of blowfish crypt (src/crypt/crypt_blowfish.c) was
+originally written by Solar Designer and placed into the public
+domain. The code also comes with a fallback permissive license for use
+in jurisdictions that may not recognize the public domain.
+
+The smoothsort implementation (src/stdlib/qsort.c) is Copyright © 2011
+Valentin Ochs and is licensed under an MIT-style license.
+
+The x86_64 port was written by Nicholas J. Kain and is licensed under
+the standard MIT terms.
+
+The mips and microblaze ports were originally written by Richard
+Pennington for use in the ellcc project. The original code was adapted
+by Rich Felker for build system and code conventions during upstream
+integration. It is licensed under the standard MIT terms.
+
+The mips64 port was contributed by Imagination Technologies and is
+licensed under the standard MIT terms.
+
+The powerpc port was also originally written by Richard Pennington,
+and later supplemented and integrated by John Spencer. It is licensed
+under the standard MIT terms.
+
+All other files which have no copyright comments are original works
+produced specifically for use as part of this library, written either
+by Rich Felker, the main author of the library, or by one or more
+contibutors listed above. Details on authorship of individual files
+can be found in the git version control history of the project. The
+omission of copyright and license comments in each file is in the
+interest of source tree size.
+
+In addition, permission is hereby granted for all public header files
+(include/* and arch/*/bits/*) and crt files intended to be linked into
+applications (crt/*, ldso/dlstart.c, and arch/*/crt_arch.h) to omit
+the copyright notice and permission notice otherwise required by the
+license, and to use these files without any requirement of
+attribution. These files include substantial contributions from:
+
+Bobby Bingham
+John Spencer
+Nicholas J. Kain
+Rich Felker
+Richard Pennington
+Stefan Kristiansson
+Szabolcs Nagy
+
+all of whom have explicitly granted such permission.
+
+This file previously contained text expressing a belief that most of
+the files covered by the above exception were sufficiently trivial not
+to be subject to copyright, resulting in confusion over whether it
+negated the permissions granted in the license. In the spirit of
+permissive licensing, and of not having licensing issues being an
+obstacle to adoption, that text has been removed.

package/THIRD_PARTY_LICENSES/zig-MIT.txt

@@ -0,0 +1,21 @@
+The MIT License (Expat)
+
+Copyright (c) Zig contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/THIRD_PARTY_NOTICES.md

@@ -5,3 +5,12 @@
 `src/executors/vendor/herdr-pi-lifecycle.ts` is the unmodified official Herdr Pi lifecycle integration, copied from Herdr `v0.8.2`, blob `67bc41889abc2791d6dcdfe8279bdc24186cc6fe` (SHA-256 `9b1c41cd72520fc2abe5f2a2aec995c12a926cce844df472c7fd5fcae4f4dbfa`).
 
 It is licensed under Apache License 2.0. A copy of that license is distributed at `THIRD_PARTY_LICENSES/herdr-Apache-2.0.txt`.
+
+## Captured Linux x64 worker
+
+`native/linux-x64/worker` statically links the musl libc shipped in the official Zig 0.14.1
+Linux x86-64 compiler distribution. Its complete copyright/license notice is reproduced in
+`THIRD_PARTY_LICENSES/musl-COPYRIGHT.txt`; Zig's runtime notice is in `THIRD_PARTY_LICENSES/zig-MIT.txt`.
+These are copied directly from the SHA-256-pinned compiler archive by `scripts/build-worker.ts`.
+The worker does not link glibc. `native/provenance.json` records source, compiler archive, artifact
+and license hashes. See `native/README.md` to reproduce and verify the committed binary.

package/dist/cli.d.ts

@@ -12,6 +12,7 @@
  * unknown-option check that exempted `argv[0]` whenever `--dir` was absent, so `pi-daddy init --Force`
  * was accepted in silence — the exact failure the check's own comment says it prevents.
  */
+import { loadWorkspaceRegistry } from "./kernel/workspace.ts";
 import { type RefusedSkill, type SkillPackage } from "./kernel/skill-packages.ts";
 import { type EpisodeGroupBy } from "./products/episode-report.ts";
 export interface ParsedArgs {
@@ -41,5 +42,5 @@ export declare function parseArgs(argv: string[]): ParsedArgs;
 /** Say what was refused and what the fix is. Each reason has a different one. */
 /** Exported so the message an operator actually reads can be tested; `init` composes it, nothing else calls it. */
 export declare function reportRefusal(pkg: SkillPackage, refusal: RefusedSkill): string;
-export declare function main(argv: string[]): Promise<number>;
+export declare function main(argv: string[], loadRegistry?: typeof loadWorkspaceRegistry): Promise<number>;
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAkBH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAWpC,OAAO,EAAuD,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AA0BxH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oFAAoF;IACpF,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAgFpD;AAoFD,iFAAiF;AACjF,mHAAmH;AACnH,wBAAgB,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CA8B9E;AA6DD,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4H1D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAgBH,OAAO,EAA0B,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGtF,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAWpC,OAAO,EAAuD,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AA0BxH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oFAAoF;IACpF,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAgFpD;AA0FD,iFAAiF;AACjF,mHAAmH;AACnH,wBAAgB,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CA8B9E;AA6DD,wBAAsB,IAAI,CACxB,IAAI,EAAE,MAAM,EAAE,EACd,YAAY,GAAE,OAAO,qBAA6C,GACjE,OAAO,CAAC,MAAM,CAAC,CA4HjB"}

package/dist/cli.js

@@ -16,9 +16,10 @@ import { realpathSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { relative, resolve as resolvePath } from "node:path";
 import { pathToFileURL } from "node:url";
+import { BoundedReadCleanupError } from "./kernel/bounded-read.js";
 import { UnsafeGrantError } from "./kernel/grant-env.js";
 import { applyInit, countDeclaring, planInit, GITIGNORE_REINCLUDE_LINES, settingsIgnoredByGit, } from "./governance/init.js";
-import { registeredWorkspaceIds } from "./kernel/workspace.js";
+import { registeredWorkspaceIds, loadWorkspaceRegistry } from "./kernel/workspace.js";
 import { explainDoubledNamespace } from "./kernel/catalog.js";
 import { discoverSkillPackages, skillPackageRoots, } from "./kernel/skill-packages.js";
 import { adoptLegacyEnvironment, legacyEnvironmentWarning } from "./kernel/env-names.js";
@@ -151,7 +152,7 @@ export function parseArgs(argv) {
     return { command: "init", dir, force, errors };
 }
 /** Report a plan and what came of applying it. Returns the process exit code. */
-async function init(cwd, force) {
+async function init(cwd, force, loadRegistry) {
     const packages = await discoverSkillPackages(cwd);
     if (packages.length === 0) {
         // Names BOTH roots it looked in, and offers pi's own install command first. The previous message named
@@ -171,11 +172,15 @@ async function init(cwd, force) {
     try {
         // A registry that cannot be read scaffolds no workspace capabilities. That was silent, so the operator
         // saw a plan with none and no way to tell it apart from having registered none (rule 8).
-        plan = planInit(packages, cwd, await registeredWorkspaceIds(undefined, (reason) => console.error(`pi-daddy init: workspace registry unreadable, scaffolding none — ${reason}`)));
+        plan = planInit(packages, cwd, await registeredWorkspaceIds(undefined, (reason) => console.error(`pi-daddy init: workspace registry unreadable, scaffolding none — ${reason}`), loadRegistry));
     }
     catch (error) {
         // R-78's backstop reaching the surface. Nothing is written: a grant that could mean something to a
         // shell is not a grant, and half-scaffolding a project would be worse than scaffolding none of it.
+        if (error instanceof BoundedReadCleanupError) {
+            console.error(`pi-daddy init: cleanup failed — ${error.message}; no scaffolding applied.`);
+            throw error;
+        }
         if (error instanceof UnsafeGrantError) {
             console.error(`pi-daddy init: ${error.message}`);
             return 1;
@@ -294,7 +299,7 @@ async function report(plan) {
         `  $EDITOR ${SETTINGS_REL}   # review it, then commit it\n` +
         `  pi                                   # /grants lists every definition and its verdict`);
 }
-export async function main(argv) {
+export async function main(argv, loadRegistry = loadWorkspaceRegistry) {
     const adoptedLegacy = adoptLegacyEnvironment(process.env);
     if (adoptedLegacy.length > 0)
         console.error(legacyEnvironmentWarning(adoptedLegacy));
@@ -407,7 +412,7 @@ export async function main(argv) {
     // `--dir` made that comparison false for every entry: every declared skill of every package was reported
     // "declared but unreadable", nothing was copied, a degenerate grants.env was written anyway, and the exit
     // code was 0 — while the message blamed the package for a defect in this line.
-    return init(resolvePath(parsed.dir ?? process.cwd()), parsed.force);
+    return init(resolvePath(parsed.dir ?? process.cwd()), parsed.force, loadRegistry);
 }
 /**
  * Only when run as a program. Importing this module (the tests do) must not execute anything.