pi-daddy 0.44.4 → 0.45.0

package/dist/products/public-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-evidence.js","sourceRoot":"","sources":["../../src/products/public-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AA8C5C,MAAM,UAAU,yBAAyB,CAAC,SAA6B;IACrE,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,KAAK;QACnD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvF,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACnF,0GAA0G;AAC1G,MAAM,UAAU,qBAAqB,CAAC,KAA0B,EAAE,KAA0B;IAC1F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,UAAU,CAAC,SAAS,CAAC;QACtB,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS;QAChC,YAAY,CAAC,SAAS,CAAC,KAAK,SAAS;QAErC,MAAM,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,QAAQ,CACrB,SAAS,EACT,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACzF,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YACrF,MAAM,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,UAAU,EAAE,EAC5B,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,iBAAiB,MAAM,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,QAAQ,CACxB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EACzB,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAClE,CAAC;QACF,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,CAAC,EACX,KAAK,GAAG,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAqB,EAAE;gBAC/D,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC;gBAC5B,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,GAAG,yBAAyB,IAAI,KAAK,GAAG,yBAAyB;oBACxE,MAAM,KAAK,CAAC,qFAAqF,CAAC,CAAC;gBACrG,MAAM,EAAE,GAAG,QAAQ,CACjB,IAAI,CAAC,iBAAiB,SAAS,EAAE,EAAE,IAAI,CAAC,EACxC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,EACvG,KAAK,CACN,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;wBAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;oBAC3F,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;oBAC3B,SAAS,CAAC,EAAE,CAAC,CAAC;gBAChB,CAAC;wBAAS,CAAC;oBACT,SAAS,CAAC,EAAE,CAAC,CAAC;gBAChB,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1F,CAAC,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC1C,IAAI,CAAC,OAAO,CAAC,KAAK;oBAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACvG,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACxC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM;oBAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAChH,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC7E,MAAM,KAAK,CAAC,gEAAgE,CAAC,CAAC;gBAChF,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,KAAK,EAAE,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,YAAY,EAAE,KAAK,CAAC,EAAE;iBACpF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;gBAC9D,IAAI,CAAC,UAAU,CAAC,QAAQ;oBAAE,MAAM,KAAK,CAAC,4CAA4C,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtG,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;oBACzE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,cAAc,KAAK,WAAW,QAAQ,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;iBAC9F,CAAC,CAAC,CAAC;gBACJ,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC;gBACxD,OAAO;oBACL,GAAG,QAAQ;oBACX,SAAS;oBACT,IAAI,EAAE,GAAG,CAAC,cAAc,KAAK,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBACzF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,QAAQ,GAAG,GAAG,CACZ,eAAe,EACf,IAAI,CAAC;gBACH,MAAM,EAAE,sBAAsB;gBAC9B,OAAO,EAAE,CAAC;gBACV,SAAS;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,UAAU;gBACjB,QAAQ;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,MAAM;gBACN,WAAW;aACZ,CAAC,CACH,CAAC;YACF,SAAS,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAC/F,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/extensions/definition-describe.ts

@@ -1,4 +1,5 @@
 /** Read-only handshake with the exact immutable definition dispatched by this extension instance. */
+import { publicEvidenceCall } from "./public-evidence.ts";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { digestDefinition } from "../src/kernel/definitions.ts";
@@ -38,7 +39,9 @@ export function registerDefinitionDescribe(pi: ExtensionAPI, session: GrantsSess
         binding: definition.binding ?? null,
         definitionId: definition.definitionId,
       };
-      return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details };
+      const capture = publicEvidenceCall(session.publicEvidence, _id, "delegate_describe", [{ agent: params.agent }]);
+      capture.selected(0, definition);
+      return capture.finish({ content: [{ type: "text" as const, text: JSON.stringify(details) }], details });
     },
   });
 }

package/extensions/delegate-chain.ts

@@ -1,3 +1,4 @@
+import { publicEvidenceCall } from "./public-evidence.ts";
 import { executionEvidenceContent } from "./execution-evidence.ts";
 import { assertDefinitionIdentity } from "./definition-describe.ts";
 /**
@@ -142,6 +143,7 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
       // Plan every step first. A step that can never run refuses the chain HERE, before anyone is asked — see
       // `planChain`.
       const executionIds = steps.map(() => newExecutionId());
+      const capture = publicEvidenceCall(session.publicEvidence, _toolCallId, "delegate_chain", steps, executionIds);
       await reconcileDelegationCapacity(session);
       const firstReservation = reserveDelegationCapacity(session, executionIds[0]);
       try {
@@ -326,6 +328,7 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
             {
               ...(index === 0 ? { capacityReservation: firstReservation } : {}),
               resolvedRuntime: runtimeChoices.get(step),
+              onDefinition: (definition) => capture.selected(index, definition),
               preApproved: availableForStep,
               toolCallId: _toolCallId,
               // Only approvals actually offered to this step are attributed or consumed here.
@@ -407,22 +410,25 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
           if (outcomes[0].refusal) throw new GovernanceRefusal({ ...outcomes[0].refusal, message });
           throw new Error(message);
         }
-        return {
-          isError: aborted || outcomes.some((o) => o.control === "failed"),
-          content: [
-            { type: "text", text: `${report}${tail}` },
-            executionEvidenceContent("delegate_chain", outcomes, steps.length),
-          ],
-          details: {
-            outcomes,
-            steps: steps.length,
-            completed: outcomes.filter((o) => o.ok).length,
-            aborted,
-            budgetPerStep: firstReservation.childAllowance,
-            ...(blockedReason ? { blockedReason } : {}),
-            refusals: outcomes.map((outcome) => outcome.refusal ?? null),
+        return capture.finish(
+          {
+            isError: aborted || outcomes.some((o) => o.control === "failed"),
+            content: [
+              { type: "text", text: `${report}${tail}` },
+              executionEvidenceContent("delegate_chain", outcomes, steps.length),
+            ],
+            details: {
+              outcomes,
+              steps: steps.length,
+              completed: outcomes.filter((o) => o.ok).length,
+              aborted,
+              budgetPerStep: firstReservation.childAllowance,
+              ...(blockedReason ? { blockedReason } : {}),
+              refusals: outcomes.map((outcome) => outcome.refusal ?? null),
+            },
           },
-        };
+          outcomes,
+        );
       } finally {
         firstReservation.finalize({ state: "not-started", reason: "chain ended before its first execution" });
       }

package/extensions/delegation.ts

@@ -1,3 +1,4 @@
+import { publicEvidenceCall } from "./public-evidence.ts";
 import { executionEvidenceContent } from "./execution-evidence.ts";
 import { reconcileDelegationCapacity, reserveDelegationCapacity } from "./session-capacity.ts";
 import { registerDefinitionDescribe } from "./definition-describe.ts";
@@ -253,6 +254,14 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       // ADR-0032: one child, same block. `_onUpdate` was discarded here, so a delegation showed the bare word
       // `delegate` for up to DEFAULT_TIMEOUT_MS — sixty minutes by default.
       const progress = progressReporter(session, [params.agent ?? "delegate"], onUpdate as never);
+      const occurrence = newDelegationOccurrence(session, 0);
+      const capture = publicEvidenceCall(
+        session.publicEvidence,
+        _toolCallId,
+        "delegate",
+        [params],
+        [occurrence.executionId],
+      );
       const outcome = await runOneDelegation(
         session,
         {
@@ -266,12 +275,16 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
           correlation: params.correlation,
           workspace: params.workspace,
         },
-        newDelegationOccurrence(session, 0),
+        occurrence,
         // Reserve one actual child plus the currently available disjoint subtree allowance.
         undefined,
         ctx,
         signal,
-        { onProgress: progress.sink(0), toolCallId: _toolCallId },
+        {
+          onProgress: progress.sink(0),
+          toolCallId: _toolCallId,
+          onDefinition: (definition) => capture.selected(0, definition),
+        },
       );
       progress.settle([outcome]);
 
@@ -284,19 +297,22 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       }
       // Pi 1.0.4 preserves returned isError. Keep every outcome dimension and useful output together.
       const failed = !outcome.ok || outcome.control === "failed";
-      return {
-        isError: failed,
-        content: [
-          {
-            type: "text",
-            text: failed
-              ? `delegation failed: ${outcome.reason ?? "required control failed"}${outcome.text ? `\n\n${outcome.text}` : ""}`
-              : outcome.text || "(no output)",
-          },
-          executionEvidenceContent("delegate", [outcome], 1),
-        ],
-        details: outcome,
-      };
+      return capture.finish(
+        {
+          isError: failed,
+          content: [
+            {
+              type: "text",
+              text: failed
+                ? `delegation failed: ${outcome.reason ?? "required control failed"}${outcome.text ? `\n\n${outcome.text}` : ""}`
+                : outcome.text || "(no output)",
+            },
+            executionEvidenceContent("delegate", [outcome], 1),
+          ],
+          details: outcome,
+        },
+        [outcome],
+      );
     },
   });
 
@@ -356,11 +372,19 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       // (R-116).
       const infrastructureErrors: unknown[] = [],
         occurrences = children.map((_, index) => newDelegationOccurrence(session, index));
+      const capture = publicEvidenceCall(
+        session.publicEvidence,
+        _toolCallId,
+        "delegate_all",
+        children,
+        occurrences.map((row) => row.executionId),
+      );
       const pending = children.map(async (child, index): Promise<DelegationOutcome> => {
         try {
           return await runOneDelegation(session, child, occurrences[index], split.perChild, ctx, signal, {
             // Reserve each batch share synchronously here, before another dispatch can interleave.
             capacityReservation: reserveDelegationCapacity(session, occurrences[index].executionId, split.perChild),
+            onDefinition: (definition) => capture.selected(index, definition),
             onProgress: progress.sink(index),
             toolCallId: _toolCallId,
           });
@@ -385,19 +409,25 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       if (failed.length === children.length && outcomes.every((o) => !o.work && !o.final && !o.cleanup))
         throw totalFanoutFailure(failed, `fan-out failed: every child was refused or failed.\n\n${report}`);
 
-      return {
-        isError: outcomes.some((o) => !o.ok || o.control === "failed"),
-        content: [{ type: "text", text: report }, executionEvidenceContent("delegate_all", outcomes, children.length)],
-        details: {
-          outcomes,
-          children: outcomes.length,
-          failed: failed.length,
-          budgetPerChild: split.perChild,
-          granted: outcomes.map((o) => o.granted),
-          refusals: outcomes.map((o) => o.refusal ?? null),
-          retention: outcomes.map((o) => o.retention ?? null),
+      return capture.finish(
+        {
+          isError: outcomes.some((o) => !o.ok || o.control === "failed"),
+          content: [
+            { type: "text", text: report },
+            executionEvidenceContent("delegate_all", outcomes, children.length),
+          ],
+          details: {
+            outcomes,
+            children: outcomes.length,
+            failed: failed.length,
+            budgetPerChild: split.perChild,
+            granted: outcomes.map((o) => o.granted),
+            refusals: outcomes.map((o) => o.refusal ?? null),
+            retention: outcomes.map((o) => o.retention ?? null),
+          },
         },
-      };
+        outcomes,
+      );
     },
   });
 

package/extensions/execution-evidence.ts

@@ -83,7 +83,7 @@ export function executionEvidenceContent(
   outcomes: readonly DelegationOutcome[],
   requested: number,
 ) {
-  const evidence = { version: 1, tool, requested, outcomes: outcomes.map(outcomeEvidence) };
+  const evidence = executionEvidence(tool, outcomes, requested);
   return {
     type: "text" as const,
     text:
@@ -92,3 +92,12 @@ export function executionEvidenceContent(
       "\n```",
   };
 }
+
+/** Shared allowlisted projection for the model-visible text and exact local capture. */
+export function executionEvidence(
+  tool: "delegate" | "delegate_all" | "delegate_chain",
+  outcomes: readonly DelegationOutcome[],
+  requested: number,
+) {
+  return { version: 1, tool, requested, outcomes: outcomes.map(outcomeEvidence) };
+}

package/extensions/public-evidence.ts

@@ -0,0 +1,90 @@
+/** Composition-only bridge. Snapshot definitions when dispatch actually selects them, never reread paths. */
+import {
+  capturePublicEvidence,
+  type PublicEvidenceOwner,
+  type PublicEvidenceRequest,
+  type PublicDefinitionEvidence,
+} from "../src/products/public-evidence.ts";
+import { digestDefinition, type SkillDefinition } from "../src/kernel/definitions.ts";
+import { executionEvidence } from "./execution-evidence.ts";
+import type { DelegationOutcome } from "./execute-child.ts";
+type Tool = "delegate_describe" | "delegate" | "delegate_all" | "delegate_chain";
+interface Result {
+  isError?: boolean;
+  content: { type: "text"; text: string }[];
+  details?: unknown;
+}
+export function publicEvidenceCall(
+  owner: PublicEvidenceOwner | undefined,
+  toolCallId: string,
+  tool: Tool,
+  specs: readonly { agent?: string; definitionId?: string }[],
+  executionIds: readonly string[] = [],
+) {
+  const requested: PublicEvidenceRequest[] = specs.map((spec, index) => ({
+    ordinal: index + 1,
+    agent: spec.agent ?? null,
+    requestedDefinitionId: spec.definitionId ?? null,
+    definitionId: null,
+    executionId: executionIds[index] ?? null,
+  }));
+  const definitions = new Map<number, PublicDefinitionEvidence>();
+  return {
+    selected(index: number, definition: SkillDefinition | undefined) {
+      if (!owner) return;
+      definitions.delete(index);
+      if (requested[index]) requested[index].definitionId = null;
+      if (!definition) return;
+      const request = requested[index];
+      if (!request || !definition.definitionId) return;
+      request.definitionId = definition.definitionId;
+      definitions.set(index, {
+        agent: definition.name,
+        definitionId: definition.definitionId,
+        sourceHash: definition.sourceHash ?? null,
+        bodySha256: digestDefinition(definition).sha256,
+        binding: definition.binding ?? null,
+        snapshot: definition.sourceSnapshot,
+      });
+    },
+    finish<T extends Result>(result: T, outcomes: readonly DelegationOutcome[] = []): T {
+      if (!owner) return result;
+      let status: unknown;
+      try {
+        const ref = capturePublicEvidence(owner, {
+          toolCallId,
+          tool,
+          response: { isError: result.isError ?? false, content: result.content },
+          requested,
+          runtimeEvidence: tool === "delegate_describe" ? null : executionEvidence(tool, outcomes, specs.length),
+          definitions: [...definitions.values()],
+          finals: outcomes.map((outcome, index) => ({
+            ordinal: index + 1,
+            executionId: requested[index]?.executionId ?? null,
+            final:
+              outcome.final?.state === "complete"
+                ? {
+                    state: "complete",
+                    text: outcome.final.text,
+                    sessionId: outcome.final.sessionId,
+                    messageId: outcome.final.messageId,
+                    leafId: outcome.final.leafId,
+                    sha256: outcome.final.sha256,
+                  }
+                : null,
+          })),
+        });
+        status = { status: "captured", ref: { path: ref.path, sha256: ref.sha256 } };
+      } catch (error) {
+        status = {
+          status: "failed",
+          reason: error instanceof Error ? error.message : "public evidence capture failed",
+        };
+      }
+      return {
+        ...result,
+        content: [...result.content, { type: "text", text: "Public evidence capture: " + JSON.stringify(status) }],
+      };
+    },
+  };
+}

package/extensions/run-delegation.ts

@@ -73,6 +73,8 @@ interface DelegationToolContext extends ApprovalUIContext {
 /** A planned delegation, plus whatever approvals contributed to it. */
 export interface GatedPlan {
   plan: ReturnType<typeof planDelegation>;
+  /** Opt-in observation of the exact context used by the final planner invocation. */
+  definition?: import("../src/kernel/definitions.ts").SkillDefinition;
   /** Absent when the gate was never reached — i.e. the plan succeeded or failed for another reason. */
   approval?: ApprovalOutcome;
 }
@@ -112,8 +114,17 @@ export async function planWithApprovals(
   // the re-plan — and two spellings of one argument is the defect R-28 was.
   const approvalSubject = request.agent ?? DELEGATE_SUBJECT;
 
-  let plan = planDelegation(request, { ...(await session.delegationContext(preApproved)), ...extra });
-  if (plan.ok || !shouldSeekApproval(plan.result)) return { plan };
+  let definition: GatedPlan["definition"];
+  const observedPlan = (context: Parameters<typeof planDelegation>[1]) => {
+    const next = planDelegation(request, context);
+    definition =
+      session.publicEvidence && next.definitionDigest && request.agent
+        ? context.definitions?.get(request.agent)
+        : undefined;
+    return next;
+  };
+  let plan = observedPlan({ ...(await session.delegationContext(preApproved)), ...extra });
+  if (plan.ok || !shouldSeekApproval(plan.result)) return { plan, ...(definition ? { definition } : {}) };
 
   let approval: ApprovalOutcome | undefined;
   try {
@@ -133,7 +144,7 @@ export async function planWithApprovals(
     );
     const outcome = approval;
     if (outcome.approved.length > 0) {
-      plan = planDelegation(request, {
+      plan = observedPlan({
         // The scope is the REAL one: a `once` approval still authorises this spawn, and
         // `inheritApprovals` then keeps it from reaching the child. See ADR-0014. R-29 is what makes
         // this safe under fan-out: a `once` is consumed by exactly one concurrent caller.
@@ -170,7 +181,7 @@ export async function planWithApprovals(
     plan = { ...plan, reason: message, refusal: structuredRefusal("APPROVAL_FLOW_FAILED", message) };
   }
 
-  return { plan, approval };
+  return { plan, approval, ...(definition ? { definition } : {}) };
 }
 
 /**
@@ -211,6 +222,7 @@ export async function runOneDelegation(
     /** Trusted reservation made before a chain's upfront gate. */
     capacityReservation?: CapacityReservation;
     /** Exact pair selected during the chain preflight; never reselect after its approval. */
+    onDefinition?: (definition: import("../src/kernel/definitions.ts").SkillDefinition | undefined) => void;
     resolvedRuntime?: import("./definition-runtime.ts").ResolvedDefinitionRuntime;
     /** Actual public execute argument, never read from model-authored correlation or output. */
     toolCallId?: string;
@@ -266,6 +278,7 @@ export async function runOneDelegation(
   try {
     await session.ensureDefinitions?.();
     assertDefinitionIdentity(session, spec);
+
     const { toolCallId, onProgress, preApproved, taskFrom, taskFromExecutionId, approvalFacts } = options;
     // pi resolves a BARE model id to an unauthenticated provider and the child dies at startup — the id
     // alone is not enough, it must be qualified with its provider (`Model<Api>` carries both).
@@ -347,6 +360,7 @@ export async function runOneDelegation(
       // no child process.
       const preview = await planWithApprovals(session, request, planContext, null, signal, preApproved);
       plan = preview.plan;
+      options.onDefinition?.(preview.definition);
       if (plan.ok || shouldSeekApproval(plan.result)) {
         try {
           preparedWorkspace = await prepareDelegationWorkspace({
@@ -363,6 +377,7 @@ export async function runOneDelegation(
           request.correlation = preparedWorkspace.correlation;
           const gated = await planWithApprovals(session, request, planContext, ctx, signal, preApproved);
           plan = gated.plan;
+          options.onDefinition?.(gated.definition);
           approvalOutcome = gated.approval;
         } catch (error) {
           const value =
@@ -382,6 +397,7 @@ export async function runOneDelegation(
         preApproved,
       );
       plan = gated.plan;
+      options.onDefinition?.(gated.definition);
       approvalOutcome = gated.approval;
     }
 

package/extensions/session.ts

@@ -13,6 +13,8 @@
  * module reads them **through this object**, live, rather than capturing a copy at load time; capturing a
  * copy of `ownGrant` before observation is exactly how a stale upper bound would become an enforced one.
  */
+import { createPublicEvidenceOwner, type PublicEvidenceOwner } from "../src/products/public-evidence.ts";
+import { ENV_PUBLIC_EVIDENCE_DIR } from "../src/kernel/env-names.ts";
 import { randomUUID } from "node:crypto";
 import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 import type { discoverSkillPackages } from "../src/kernel/skill-packages.ts";
@@ -139,6 +141,8 @@ export function activityChildEnv(activity: { rootId: string; path: string; taskI
 }
 /** Keep each child's pane after it finishes, for inspection. Off by default: fan-out would flood it. */
 export interface GrantsSession extends NativeSessionHost {
+  /** Reconciled from the actual owner root on reload; captured call owners stay immutable. */
+  publicEvidence?: PublicEvidenceOwner;
   /** Legacy PI_GRANTS_* names adopted at construction (ADR-0076 PR 3b); the session-start warning names them. */
   readonly adoptedLegacyEnv: readonly string[];
   /** False only for the explicit PI_DADDY_GOVERNANCE opt-out; otherwise roots are observed-bound. */
@@ -519,7 +523,8 @@ async function loadProjectDiscovery(
   await establishRootPin(session, lifecycle);
   const skips: string[] = [];
   assertDiscoveryHealthy(session, lifecycle);
-  const snapshot = selected === undefined ? undefined : await selectedDefinitions(selected);
+  const snapshot =
+    selected === undefined ? undefined : await selectedDefinitions(selected, session.publicEvidence !== undefined);
   const definitions =
     snapshot?.definitions ??
     (await (session.discovery.definitions ?? loadDefinitions)(cwd, (_path, reason) => skips.push(reason)));
@@ -632,6 +637,7 @@ export function createGrantsSession(
      */
     mayDelegate: !governed || inherited.includes(DELEGATE_CAPABILITY) || inherited.includes(WILDCARD),
     ownerBound: false,
+    publicEvidence: createPublicEvidenceOwner(environment[ENV_PUBLIC_EVIDENCE_DIR]),
     allowUnresolvedModels: environment[ENV_ALLOW_UNRESOLVED_MODELS] === "1",
     nativeSessionRoot: nativeSessionRootFromEnv(process.env),
     modelResolutionCache: new Map<string, boolean>(),
@@ -707,6 +713,9 @@ export function createGrantsSession(
       session.publishChildEnv();
     },
     reconcileEnvironment: (environment, lifecycle) => {
+      const evidenceDirectory = environment[ENV_PUBLIC_EVIDENCE_DIR];
+      if (session.reloadLifecycle !== lifecycle || session.publicEvidence?.directory !== evidenceDirectory)
+        session.publicEvidence = createPublicEvidenceOwner(evidenceDirectory);
       if (session.reloadLifecycle !== lifecycle) {
         session.pinSettled = false;
         session.workspacePin = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.44.4",
+  "version": "0.45.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/kernel/definition-sources.ts

@@ -0,0 +1,12 @@
+/** Opt-in immutable copies of bytes already admitted by selected-resource discovery. Never authority. */
+export interface DefinitionSource {
+  readonly kind: "selected-skill" | "package" | "binding-manifest" | "delegated-agent";
+  readonly path: string;
+  /** Raw admitted bytes, including any BOM. Runtime sourceHash separately identifies decoded text. */
+  readonly base64: string;
+}
+export interface DefinitionSourceSnapshot {
+  readonly resources: readonly DefinitionSource[];
+  /** Exact body dispatched to the child; some generic definitions trim their source body. */
+  readonly body: string;
+}

package/src/kernel/definitions.ts

@@ -59,6 +59,8 @@ export function digestDefinition(definition: SkillDefinition): DefinitionDigest
 }
 
 export interface SkillDefinition {
+  /** Present only for explicit local public-evidence capture; excluded from authority and identity. */
+  sourceSnapshot?: import("./definition-sources.ts").DefinitionSourceSnapshot;
   /** Immutable selected-resource identity, independent of the model-authored name. */
   definitionId?: string;
   selectedSkillHash?: string;

package/src/kernel/env-names.ts

@@ -45,6 +45,8 @@ export const ENV_WORKSPACE_REGISTRY = "PI_DADDY_WORKSPACE_REGISTRY";
 export const ENV_WORKSPACE_LEASE_DIR = "PI_DADDY_WORKSPACE_LEASE_DIR";
 /** ADR-0042: what each authorised workspace id MEANT when the grant was established. Authority, not metadata. */
 export const ENV_WORKSPACE_PIN = "PI_DADDY_WORKSPACE_PIN";
+/** Explicit operator-only local public-response capture; never inherited by a captured child. */
+export const ENV_PUBLIC_EVIDENCE_DIR = "PI_DADDY_PUBLIC_EVIDENCE_DIR";
 export const ENV_EXECUTION_ARCHIVE = "PI_DADDY_EXECUTION_ARCHIVE";
 export const ENV_NATIVE_SESSION_ROOT = "PI_DADDY_NATIVE_SESSION_ROOT";
 export const ENV_RETAIN_NATIVE_SESSIONS = "PI_DADDY_RETAIN_NATIVE_SESSIONS";
@@ -100,6 +102,7 @@ export const GOVERNANCE_ENV_KEYS: readonly string[] = Object.freeze([
   ENV_WORKSPACE_REGISTRY,
   ENV_WORKSPACE_LEASE_DIR,
   ENV_WORKSPACE_PIN,
+  ENV_PUBLIC_EVIDENCE_DIR,
   ENV_EXECUTION_ARCHIVE,
   ENV_NATIVE_SESSION_ROOT,
   ENV_RETAIN_NATIVE_SESSIONS,

package/src/kernel/propagation.ts

@@ -25,6 +25,7 @@
  * interceptor and pi handed the child more than the parent held, the intersection clamps it back.
  */
 
+import { ENV_PUBLIC_EVIDENCE_DIR } from "./env-names.ts";
 import type { Capability } from "./resolve.ts";
 import { attenuateWorkspacePin, formatWorkspacePin, type WorkspacePins } from "./workspace-pin.ts";
 import { WILDCARD } from "./pi-tools.ts";
@@ -86,6 +87,7 @@ export {
  * to give it.
  */
 export const GRANT_ENV_KEYS = [
+  ENV_PUBLIC_EVIDENCE_DIR,
   // Not governance state, but the same rule applies for a stronger reason: neither a credential the parent holds
   // nor the switch that points it at a third party is something a child inherits by being spawned (ADR-0077).
   //

package/src/kernel/selected-definitions.ts

@@ -5,6 +5,7 @@ import { lstat, realpath } from "node:fs/promises";
 import { BoundedReadCleanupError, readBoundedBytes } from "./bounded-read.ts";
 import { ceilingForDefinition, parseSkillDefinition, type SkillDefinition } from "./definitions.ts";
 import { resolve } from "./resolve.ts";
+import type { DefinitionSource } from "./definition-sources.ts";
 import type { CatalogEntry } from "./catalog.ts";
 export interface SelectedCommand {
   source?: string;
@@ -16,13 +17,20 @@ const hash = (value: string) => createHash("sha256").update(value, "utf8").diges
 const object = (x: unknown): x is Record<string, unknown> => !!x && typeof x === "object" && !Array.isArray(x);
 const exact = (x: Record<string, unknown>, keys: string[]) =>
   Object.keys(x).sort().join(",") === [...keys].sort().join(",");
-async function read(path: string): Promise<string> {
+async function read(path: string, kind: DefinitionSource["kind"], sources?: DefinitionSource[]): Promise<string> {
   if (!(await lstat(path)).isFile()) throw Error(`nonregular selected resource: ${path}`);
   const result = await readBoundedBytes(path, { maxBytes: 1024 * 1024, timeoutMs: 3000 });
   if (!result.ok) throw Error(result.detail);
-  return new TextDecoder("utf-8", { fatal: true }).decode(result.bytes);
+  const text = new TextDecoder("utf-8", { fatal: true }).decode(result.bytes);
+  sources?.push(Object.freeze({ kind, path, base64: result.bytes.toString("base64") }));
+  return text;
 }
-async function principalBinding(path: string, inline: SkillDefinition, skillText: string): Promise<SkillDefinition> {
+async function principalBinding(
+  path: string,
+  inline: SkillDefinition,
+  skillText: string,
+  sources?: DefinitionSource[],
+): Promise<SkillDefinition> {
   const phase = inline.name;
   const marked = inline.metadata?.["principal-package"] === "principal-pi-skills";
   if (!phases.includes(phase) || path !== join(dirname(dirname(path)), phase, "SKILL.md")) {
@@ -32,7 +40,7 @@ async function principalBinding(path: string, inline: SkillDefinition, skillText
   const root = dirname(dirname(path));
   let packageText: string;
   try {
-    packageText = await read(join(root, "package.json"));
+    packageText = await read(join(root, "package.json"), "package", sources);
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === "ENOENT" && !marked) return inline;
     throw error;
@@ -42,7 +50,7 @@ async function principalBinding(path: string, inline: SkillDefinition, skillText
     if (marked) throw Error("marked Principal skill has missing or wrong package identity");
     return inline;
   }
-  const manifest: unknown = JSON.parse(await read(join(root, "principal-agents.json")));
+  const manifest: unknown = JSON.parse(await read(join(root, "principal-agents.json"), "binding-manifest", sources));
   if (
     !object(manifest) ||
     !exact(manifest, ["version", "package", "bindings"]) ||
@@ -73,7 +81,7 @@ async function principalBinding(path: string, inline: SkillDefinition, skillText
     (await realpath(path)) !== join(await realpath(root), row.skill)
   )
     throw Error("Principal binding path escaped its selected package");
-  const agentText = await read(agentPath);
+  const agentText = await read(agentPath, "delegated-agent", sources);
   if (hash(skillText) !== row.skillSha256 || hash(agentText) !== row.agentSha256)
     throw Error("Principal binding hash mismatch");
   const agent = parseSkillDefinition(agentPath, agentText);
@@ -106,7 +114,10 @@ async function principalBinding(path: string, inline: SkillDefinition, skillText
     binding: Object.freeze({ package: "principal-pi-skills", phase }),
   };
 }
-export async function selectedDefinitions(commands: readonly SelectedCommand[]): Promise<{
+export async function selectedDefinitions(
+  commands: readonly SelectedCommand[],
+  captureSources = false,
+): Promise<{
   definitions: Map<string, SkillDefinition>;
   skills: CatalogEntry[];
   skips: string[];
@@ -127,10 +138,11 @@ export async function selectedDefinitions(commands: readonly SelectedCommand[]):
     try {
       if (!command.sourceInfo?.path) throw Error("selected resource lacks a public source path");
       const path = resolvePath(command.sourceInfo.path);
-      const text = await read(path);
+      const sources: DefinitionSource[] | undefined = captureSources ? [] : undefined;
+      const text = await read(path, "selected-skill", sources);
       const parsed = parseSkillDefinition(path, text);
       if (!parsed || parsed.name !== name) throw Error("selected name/path does not match definition");
-      const bound = await principalBinding(path, parsed, text);
+      const bound = await principalBinding(path, parsed, text, sources);
       const definitionId = hash(
         JSON.stringify({
           name,
@@ -145,7 +157,16 @@ export async function selectedDefinitions(commands: readonly SelectedCommand[]):
         }),
       );
       if (bound.metadata) Object.freeze(bound.metadata);
-      definitions.set(name, Object.freeze({ ...bound, definitionId }));
+      definitions.set(
+        name,
+        Object.freeze({
+          ...bound,
+          definitionId,
+          ...(sources
+            ? { sourceSnapshot: Object.freeze({ resources: Object.freeze(sources), body: bound.body }) }
+            : {}),
+        }),
+      );
       skills.push({ capability: `skill:${name}`, kind: "skill", source: path });
     } catch (error) {
       if (error instanceof BoundedReadCleanupError) throw error;